如何在基于SSL的Java RMI服务中获取客户端证书并校验主机？

核心问题分析 #

你当前代码的问题在于：直接复用默认SSLSocketFactory未正确配置服务端的密钥库/信任库，且手动包装ServerSocket的方式不符合RMI的SSL交互逻辑，导致无法触发客户端证书校验并获取证书信息。

正确实现步骤 #

1. 配置SSLContext（加载密钥库、信任库并开启客户端认证）

首先需要初始化一个配置完整的SSLContext，指定服务端的密钥（用于身份认证）、信任的客户端证书库，并强制要求客户端提供证书。

import javax.net.ssl.*;
import java.io.FileInputStream;
import java.security.KeyStore;

public class SSLContextUtil {
    public static SSLContext createServerSSLContext(String keyStorePath, String keyStorePassword, String trustStorePath, String trustStorePassword) throws Exception {
        // 加载服务端密钥库
        KeyStore keyStore = KeyStore.getInstance("JKS");
        try (FileInputStream fis = new FileInputStream(keyStorePath)) {
            keyStore.load(fis, keyStorePassword.toCharArray());
        }

        // 加载信任库（信任客户端证书）
        KeyStore trustStore = KeyStore.getInstance("JKS");
        try (FileInputStream fis = new FileInputStream(trustStorePath)) {
            trustStore.load(fis, trustStorePassword.toCharArray());
        }

        // 初始化密钥管理器和信任管理器
        KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        kmf.init(keyStore, keyStorePassword.toCharArray());

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);

        // 创建SSLContext并开启客户端认证
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        return sslContext;
    }
}

2. 自定义SslRMIServerSocketFactory

基于配置好的SSLContext创建自定义的RMI服务端Socket工厂，确保每个接受的连接都强制进行客户端证书校验。

import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import java.io.IOException;
import java.net.ServerSocket;
import java.rmi.server.RMIServerSocketFactory;

public class AuthorizedRMIServerSocketFactory implements RMIServerSocketFactory {
    private final SSLServerSocketFactory sslServerSocketFactory;
    private final String[] allowedHosts;

    public AuthorizedRMIServerSocketFactory(SSLContext sslContext, String[] allowedHosts) {
        this.sslServerSocketFactory = sslContext.getServerSocketFactory();
        this.allowedHosts = allowedHosts;
    }

    @Override
    public ServerSocket createServerSocket(int port) throws IOException {
        SSLServerSocket sslServerSocket = (SSLServerSocket) sslServerSocketFactory.createServerSocket(port);
        // 强制要求客户端提供证书
        sslServerSocket.setNeedClientAuth(true);
        // 添加握手完成监听器，用于校验客户端证书
        sslServerSocket.addHandshakeCompletedListener(new ClientCertificateAuthListener(allowedHosts));
        return sslServerSocket;
    }
}

3. 实现握手监听器，校验客户端证书与授权主机

在握手完成后，提取客户端证书中的主机名（通常是证书的CN字段或SAN扩展），并校验是否在授权列表内，若未授权则直接断开连接。

import javax.net.ssl.HandshakeCompletedEvent;
import javax.net.ssl.HandshakeCompletedListener;
import javax.net.ssl.SSLSession;
import java.security.cert.Certificate;
import java.security.cert.X509Certificate;
import java.util.Arrays;

public class ClientCertificateAuthListener implements HandshakeCompletedListener {
    private final String[] allowedHosts;

    public ClientCertificateAuthListener(String[] allowedHosts) {
        this.allowedHosts = allowedHosts;
    }

    @Override
    public void handshakeCompleted(HandshakeCompletedEvent event) {
        SSLSession session = event.getSession();
        try {
            // 获取客户端证书链
            Certificate[] clientCerts = session.getPeerCertificates();
            if (clientCerts == null || clientCerts.length == 0) {
                throw new SecurityException("未提供客户端证书");
            }

            // 解析X509证书，提取主机名
            X509Certificate clientCert = (X509Certificate) clientCerts[0];
            String clientHost = clientCert.getSubjectX500Principal().getName().split("CN=")[1].split(",")[0].trim();

            // 校验主机是否在授权列表
            if (!Arrays.asList(allowedHosts).contains(clientHost)) {
                throw new SecurityException("未授权主机: " + clientHost);
            }

            System.out.println("授权主机连接: " + clientHost);
        } catch (Exception e) {
            // 未通过校验，断开连接
            try {
                event.getSocket().close();
            } catch (IOException ex) {
                ex.printStackTrace();
            }
            throw new SecurityException("客户端认证失败: " + e.getMessage());
        }
    }
}

4. 绑定自定义SocketFactory到RMI服务

在发布RMI服务时，指定使用自定义的Socket工厂：

import java.rmi.registry.LocateRegistry;
import java.rmi.registry.Registry;
import java.rmi.server.UnicastRemoteObject;

public class RMIServer {
    public static void main(String[] args) {
        try {
            // 初始化SSLContext
            SSLContext sslContext = SSLContextUtil.createServerSSLContext(
                    "server_keystore.jks", "server_pass",
                    "truststore.jks", "trust_pass"
            );

            // 定义授权主机列表
            String[] allowedHosts = {"client-host-1", "client-host-2"};

            // 创建自定义Socket工厂
            RMIServerSocketFactory serverSocketFactory = new AuthorizedRMIServerSocketFactory(sslContext, allowedHosts);

            // 创建RMI注册表并绑定服务
            Registry registry = LocateRegistry.createRegistry(1099, null, serverSocketFactory);
            YourRemoteService service = new YourRemoteServiceImpl();
            YourRemote stub = (YourRemote) UnicastRemoteObject.exportObject(service, 0, null, serverSocketFactory);
            registry.rebind("YourRemoteService", stub);

            System.out.println("RMI服务已启动，仅允许授权主机连接");
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

关键注意事项 #

• 确保服务端信任库中已导入所有授权客户端的证书
• 客户端证书的CN字段需与主机名一致，若使用SAN扩展，需修改代码解析SAN字段
• 生产环境中避免硬编码密钥库密码，建议通过环境变量或配置文件读取

内容的提问来源于stack exchange，提问作者esh_08