導(dǎo)讀：在進(jìn)行多證書驗(yàn)證的過程中，會(huì)出現(xiàn)握手失敗的情況
2020-12-31 10:43:26.673 4415-4415/? W/System.err: Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:229)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at org.eclipse.paho.client.mqttv3.internal.SSLNetworkModule.start(SSLNetworkModule.java:97)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at org.eclipse.paho.client.mqttv3.internal.ClientComms$ConnectBG.run(ClientComms.java:676)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: ... 1 more
2020-12-31 10:43:26.673 4415-4415/? W/System.err: Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.TrustManagerImpl.verifyChain(TrustManagerImpl.java:661)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:539)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.TrustManagerImpl.checkTrustedRecursive(TrustManagerImpl.java:605)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:495)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:418)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.TrustManagerImpl.getTrustedChainForServer(TrustManagerImpl.java:339)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at android.security.net.config.NetworkSecurityTrustManager.checkServerTrusted(NetworkSecurityTrustManager.java:94)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at android.security.net.config.RootTrustManager.checkServerTrusted(RootTrustManager.java:88)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:208)
2020-12-31 10:43:26.673 4415-4415/? W/System.err: at com.android.org.conscrypt.ConscryptFileDescriptorSocket.verifyCertificateChain(ConscryptFileDescriptorSocket.java:404)
2020-12-31 10:43:26.674 4415-4415/? W/System.err: at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
2020-12-31 10:43:26.674 4415-4415/? W/System.err: at com.android.org.conscrypt.NativeSsl.doHandshake(NativeSsl.java:375)
2020-12-31 10:43:26.674 4415-4415/? W/System.err: at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:224)
場景：MQTT Android 端與服務(wù)端Mosquitto作傳輸通訊過程，需要用到：
mMqttConnectOptions = new MqttConnectOptions();
InputStream caCrtFileI = getResources().openRawResource(R.raw.ca_c88);
InputStream crtFile = getResources().openRawResource(R.raw.crt_c88);
InputStream keyFile = getResources().openRawResource(R.raw.key_c88);
mMqttConnectOptions.setSocketFactory(getSocketFactory(caCrtFileI, crtFile, keyFile, ""));
/**
* 多證書認(rèn)證
* @param caCrtFile ca.crt
* @param crtFile 92e89e010253a4ab2e430f6254850c88.crt
* @param keyFile 92e89e010253a4ab2e430f6254850c88.key
* @param password " "
* @return
* @throws Exception
*/
public static SSLSocketFactory getSocketFactory(InputStream caCrtFile, InputStream crtFile, InputStream keyFile, String password) throws Exception {
Security.addProvider(new BouncyCastleProvider());
// load CA certificate
X509Certificate caCert = null;
BufferedInputStream bis = new BufferedInputStream(caCrtFile);
CertificateFactory cf = CertificateFactory.getInstance("X.509");
while (bis.available() > 0) {
caCert = (X509Certificate) cf.generateCertificate(bis);
}
// load client certificate
BufferedInputStream bis1 = new BufferedInputStream(crtFile);
X509Certificate cert = null;
while (bis1.available() > 0) {
cert = (X509Certificate) cf.generateCertificate(bis1);
}
// load client private cert
PEMParser pemParser = new PEMParser(new InputStreamReader(keyFile));
Object object = pemParser.readObject();
JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
KeyPair key = converter.getKeyPair((PEMKeyPair) object);
KeyStore caKs = KeyStore.getInstance(KeyStore.getDefaultType());
caKs.load(null, null);
caKs.setCertificateEntry("cert-certificate", caCert);
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(caKs);
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(null, null);
ks.setCertificateEntry("certificate", cert);
ks.setKeyEntry("private-cert", key.getPrivate(), password.toCharArray(),
new java.security.cert.Certificate[]{cert});
KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(ks, password.toCharArray());
SSLContext context = SSLContext.getInstance("TLSv1.2");
// SSLContext context = SSLContext.getInstance("TLS");
context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
return context.getSocketFactory();
}
解決方法：
這是由于當(dāng)前證書：ca.crt cert.crt cert.key 其中ca.crt cert.crt需要在運(yùn)行設(shè)備上的系統(tǒng)設(shè)置里進(jìn)行證書信任。
當(dāng)前證書申請時(shí)針對設(shè)備，一機(jī)一證書。
信任步驟：
1.將證書放到設(shè)備的SD卡或者內(nèi)置存儲(chǔ)的某個(gè)文件夾下
預(yù)先將證書放到設(shè)備文件夾下
2.打開設(shè)備的系統(tǒng)設(shè)置：【安全性和位置信息】（不同品牌或者系統(tǒng)略有不同）。找到該位置下的【加密與憑據(jù)】-【從SD卡安裝】-選擇放置證書的那個(gè)文件夾找到其中.crt證書依次點(diǎn)擊信任即可。
微信圖片_20201231171249.jpg
微信圖片_20201231171258.jpg
微信圖片_20201231171302.jpg
3.證書信任之后，【用戶憑據(jù)】中即可查看已信任的證書?！拘湃蔚膽{據(jù)】中可以查看用戶層級的信任證書【BSJ】
微信圖片_20201231171305.jpg
微信圖片_20201231172137.jpg
Screenshot_20201231-155702.png
至此，MQTT中認(rèn)證服務(wù)端mosquitto三個(gè)證書認(rèn)證的問題即已解決，但是情況不同，還需依據(jù)具體的情況分析，此篇文章僅提供其中一種情況參考。
