Two-way SSL ticket verification on the Android platform

Two-way SSL ticket verification on the Android platform

Environment: SERVER: apache server, openssl.

Clients: PC, java, and android platforms.

Ideas:

1. Perform one-way ssl verification and then two-way ssl verification.

2. PC first, java platform, and android. You don't have to do this. You have to make a choice. I personally want to figure out the entire process and take more steps.

Procedure:

1. An http server is built with apache on the pc, and a self-Signed CA certificate ca. crt is built with openssl. The server certificate server. crt is issued and the client certificate client. crt is issued. (There are many materials for configuring ssl communication in apache + openssl)

2. Install ca. crt, configure the server, enable one-way authentication, and test and verify one-way ssl communication using a browser.

3. Package client. crt and client. key to generate the client. pfx file in pkcs12 format.

4. Configure the server, enable two-way authentication, import the client. pfx file through a browser, and test and verify two-way ssl communication.

Important:

The Java platform recognizes certificate files in jks format by default, but the android platform only recognizes certificate files in bks format. You need to configure the BC library in java. For details, refer to: keystore.

For code reference, refer. (Some items need to be fine-tuned. I hope you can change them by yourself. For some people, there may be some pitfalls. If you have any questions, please leave a message and I will try my best to answer them)

1. Public class MySSLSocket extends Activity {
2. Private static final int SERVER_PORT = 50030; // port number
3. Private static final String SERVER_IP = "218.206.176.146"; // connection IP
4. Private static final String CLIENT_KET_PASSWORD = "123456"; // private Key Password
5. Private static final String CLIENT_TRUST_PASSWORD = "123456"; // trust the certificate Password
6. Private static final String CLIENT_AGREEMENT = "TLS"; // protocol of use
7. Private static final String CLIENT_KEY_MANAGER = "X509"; // key manager
8. Private static final String CLIENT_TRUST_MANAGER = "X509 ";//
9. Private static final String CLIENT_KEY_KEYSTORE = "BKS"; // password library. BouncyCastle password library is used here.
10. Private static final String CLIENT_TRUST_KEYSTORE = "BKS ";//
11. Private static final String ENCONDING = "UTF-8"; // Character Set
12. Private SSLSocket Client_sslSocket;
13. Private Log tag;
14. Private TextView TV;
15. Private Button btn;
16. Private Button btn2;
17. Private Button btn3;
18. Private EditText et;
20. /** Called when the activity is first created .*/
21. @ Override
22. Public void onCreate (Bundle savedInstanceState ){
23. Super. onCreate (savedInstanceState );
24. SetContentView (R. layout. main );
25. TV = (TextView) findViewById (R. id. TextView01 );
26. Et = (EditText) findViewById (R. id. EditText01 );
27. Btn = (Button) findViewById (R. id. Button01 );
28. Btn2 = (Button) findViewById (R. id. Button02 );
29. Btn3 = (Button) findViewById (R. id. Button03 );
31. Btn. setOnClickListener (new Button. OnClickListener (){
32. @ Override
33. Public void onClick (View arg0 ){
34. If (null! = Client_sslSocket ){
35. GetOut (Client_sslSocket, et. getText (). toString ());
36. GetIn (Client_sslSocket );
37. Et. setText ("");
38. }
39. }
40. });
41. Btn2.setOnClickListener (new Button. OnClickListener (){
42. @ Override
43. Public void onClick (View arg0 ){
44. Try {
45. Client_sslSocket.close ();
46. Client_sslSocket = null;
47. } Catch (IOException e ){
48. E. printStackTrace ();
49. }
50. }
51. });
52. Btn3.setOnClickListener (new View. OnClickListener (){
53. @ Override
54. Public void onClick (View arg0 ){
55. Init ();
56. GetIn (Client_sslSocket );
57. }
58. });
59. }
61. Public void init (){
62. Try {
63. // Obtain an SSL SSLContext instance
64. SSLContext sslContext = SSLContext. getInstance (CLIENT_AGREEMENT );
65. // Obtain the X509 key manager instance of KeyManagerFactory and TrustManagerFactory
66. KeyManagerFactory keyManager = KeyManagerFactory. getInstance (CLIENT_KEY_MANAGER );
67. TrustManagerFactory trustManager = TrustManagerFactory. getInstance (CLIENT_TRUST_MANAGER );
68. // Obtain the BKS password library instance
69. KeyStore kks = KeyStore. getInstance (CLIENT_KEY_KEYSTORE );
70. KeyStore tks = KeyStore. getInstance (CLIENT_TRUST_KEYSTORE );
71. // Add the client to load the certificate and private key, and read the key and trust certificate by reading the resource file
72. Kks. load (getBaseContext ()
73. . GetResources ()
74. . OpenRawResource (R. drawable. kclient), CLIENT_KET_PASSWORD.toCharArray ());
75. Tks. load (getBaseContext ()
76. . GetResources ()
77. . OpenRawResource (R. drawable. lt_client), CLIENT_TRUST_PASSWORD.toCharArray ());
78. // Initialize the key manager
79. KeyManager. init (kks, CLIENT_KET_PASSWORD.toCharArray ());
80. TrustManager. init (tks );
81. // Initialize SSLContext
82. SslContext. init (keyManager. getKeyManagers (), trustManager. getTrustManagers (), null );
83. // Generate SSLSocket
84. Client_sslSocket = (SSLSocket) sslContext. getSocketFactory (). createSocket (SERVER_IP, SERVER_PORT );
85. } Catch (Exception e ){
86. Tag. e ("MySSLSocket", e. getMessage ());
87. }
88. }
90. Public void getOut (SSLSocket socket, String message ){
91. PrintWriter out;
92. Try {
93. Out = new PrintWriter (
94. New BufferedWriter (
95. New OutputStreamWriter (
96. Socket. getOutputStream ()
97. )
98. ), True );
99. Out. println (message );
100. } Catch (IOException e ){
101. E. printStackTrace ();
102. }
103. }
105. Public void getIn (SSLSocket socket ){
106. BufferedReader in = null;
107. String str = null;
108. Try {
109. In = new BufferedReader (
110. New InputStreamReader (
111. Socket. getInputStream ()));
112. Str = new String (in. readLine (). getBytes (), ENCONDING );
113. } Catch (UnsupportedEncodingException e ){
114. E. printStackTrace ();
115. } Catch (IOException e ){
116. E. printStackTrace ();
117. }
118. New AlertDialog
119. . Builder (MySSLSocket. this)
120. . SetTitle ("Server Message ")
121. . SetNegativeButton ("OK", null)
122. . SetIcon (android. R. drawable. ic_menu_agenda)
123. . SetMessage (str)
124. . Show ();
125. }
126. }
     

     
     

     Unidirectional:

     1. Use keytool to import ca. crt to the certificate library ca. bks in bks format to verify the server certificate. The command is as follows:

     Keytool-import-alias ca-file ca. crt-keystore ca. bks-storetype BKS-provider org. bouncycastle. jce. provider. BouncyCastleProvider

     2. The server is configured with one-way authentication, and ca. bks is placed in the assets or raw of the android project. The corresponding read is in the code

     1. Kks. load (getBaseContext ()
     2. . GetResources ()
     3. . OpenRawResource (R. drawable. kclient), CLIENT_KET_PASSWORD.toCharArray ());

        Not necessarily R. drawable. kclient. You can modify and read the file based on your actual situation.

        At this point, one-way ssl communication should be OK.

        (PS: for operations in 2, you do not have to do this. You can also set the ca. bks is imported to cacerts on the android platform. bks file, and then read authentication from this file, how to import, a lot of online information, such as: http://blog.csdn.net/haijun286972766/article/details/6247675

        
        

        For problems encountered during debugging, refer:

        Generally, it can pass through the simulator, and it will be okay on the real platform.

        Note the validity period of the Certificate. You must perform the operation within the validity period of the certificate.

        Bidirectional:

        Two-way implementation on the basis of one-way, but Mr Cheng can recognize other client certificates on the android platform. This is also a headache. There are very few materials on the Internet to generate client certificates in bks format, which are rarely used for reference.

        At this point, it is too frustrating. It is estimated that many of the guys are also getting stuck here. At the beginning, there was no clue that client certificates can be generated on PCs and JAVA platforms, however, it is dumb to switch to the android platform. You cannot use keytool to export the crt certificate generated by other tools to the bks format. You cannot use keytool to generate a new bks certificate;

        I tried all the methods I could think about. I was wondering if I was wrong about any details. In theory, I was sure I could do something. Why couldn't I see any implementation? I 've been looking for information for several days, but I haven't made any progress.

        Later, I will refer to the foreign documents about using openssl to generate pkcs12. pfx format certificate, and then use the tool portecle to convert to the BKS format. It is used on the android platform. At the beginning, it is a mandatory conversion. If an error occurs, the conversion fails, however, it is no problem to convert the format to jks. You can only find a solution based on the error prompt. After trying a lot, I am confused;

        1. Finally, I saw a sentence from the foreign documents. I had an epiphany and used the portecle tool to create a bks-format keystore, and then set the client. the key pair import (import key pair) in pfx and save the bks file. The test is successful. It turns out to be a little bit more.

        PS: It should be okay to use portecle for direct conversion, but I have never been successful. It may be that there is a problem with my java environment, and the old prompt is illegal key size.

        2. Configure the server for two-way authentication, and put ca. bks to the assets or raw of the android project. The corresponding read is in the code

        1. Tks. load (getBaseContext ()
        2. . GetResources ()
        3. . OpenRawResource (R. drawable. lt_client), CLIENT_TRUST_PASSWORD.toCharArray ());