您需要配置JSSE系统属性，特别是指向客户端证书存储。

通过命令行:

java -Djavax.net.ssl.trustStore=truststores/client.ts com.progress.Client

或者通过Java代码:

import java.util.Properties;
    ...
    Properties systemProps = System.getProperties();
    systemProps.put("javax.net.ssl.keyStorePassword","passwordForKeystore");
    systemProps.put("javax.net.ssl.keyStore","pathToKeystore.ks");
    systemProps.put("javax.net.ssl.trustStore", "pathToTruststore.ts");
    systemProps.put("javax.net.ssl.trustStorePassword","passwordForTrustStore");
    System.setProperties(systemProps);
    ...

更多详情请参阅RedHat网站。

I am working on a tutorial for REST web services at www.udemy.com (REST Java Web Services). The example in the tutorial said that in order to have SSL, we must have a folder called "trust_store" in my eclipse "client" project that should contain a "key store" file (we had a "client" project to call the service, and "service" project that contained the REST web service - 2 projects in the same eclipse workspace, one the client, the other the service). To keep things simple, they said to copy "keystore.jks" from the glassfish app server (glassfish\domains\domain1\config\keystore.jks) we are using and put it into this "trust_store" folder that they had me make in the client project. That seems to make sense: the self-signed certs in the server's key_store would correspond to the certs in the client trust_store. Now, doing this, I was getting the error that the original post mentions. I have googled this and read that the error is due to the "keystore.jks" file on the client not containing a trusted/signed certificate, that the certificate it finds is self-signed.

为了让事情更清楚，让我说一下我理解的“密钥库”。“Jks”包含自签名的certs，以及“cacerts. Jks”。“jks”文件中包含CA证书(由CA签名)。“密钥存储库。Jks是“密钥存储库”，cacerts是“cacerts”。Jks”是“信任商店”。正如一位名叫“布鲁诺”的评论者所说，“密钥库。Jks是本地的，cacerts是本地的。Jks”用于远程客户端。

So, I said to myself, hey, glassfish also has the "cacerts.jks" file, which is glassfish's trust_store file. cacerts.jsk is supposed to contain CA certificates. And apparently I need my trust_store folder to contain a key store file that has at least one CA certificate. So, I tried putting the "cacerts.jks" file in the "trust_store" folder I had made, on my client project, and changing the VM properties to point to "cacerts.jks" instead of "keystore.jks". That got rid of the error. I guess all it needed was a CA cert to work.

这对于生产来说可能并不理想，甚至对于开发来说也不理想。例如，您可以使用“keytool”命令将CA证书添加到“密钥存储库”中。Jks”文件在客户端。但无论如何，希望这至少能缩小可能导致错误的情况。

另外:我的方法似乎对客户端有用(服务器证书添加到客户端trust_store)，看起来上面解决原始帖子的注释对服务器有用(客户端证书添加到服务器trust_store)。欢呼。

Eclipse项目设置:

MyClientProject src 测验 JRE系统库 .．. trust_store ——cacerts.jks ——keystore.jks

MyClientProject.java文件片段:

static {
  // Setup the trustStore location and password
  System.setProperty("javax.net.ssl.trustStore","trust_store/cacerts.jks");
  // comment out below line
  System.setProperty("javax.net.ssl.trustStore","trust_store/keystore.jks");
  System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
  //System.setProperty("javax.net.debug", "all");

  // for localhost testing only
  javax.net.ssl.HttpsURLConnection.setDefaultHostnameVerifier(new javax.net.ssl.HostnameVerifier() {
        public boolean verify(String hostname, javax.net.ssl.SSLSession sslSession) {
          return hostname.equals("localhost");
        }

  });
}

我的问题是通过软件更新在我的工作笔记本电脑上安装了一个云访问安全代理NetSkope。这正在改变证书链，在将整个链导入到cacerts密钥存储库后，我仍然无法通过java客户端连接到服务器。我禁用了NetSkope，并且能够成功连接。

JDK 8迁移到JDK 10时的解决方案

证书是非常不同的 JDK 10有80个，而JDK 8有151个 JDK 10最近添加了certs https://dzone.com/articles/openjdk-10-now-includes-root-ca-certificates http://openjdk.java.net/jeps/319

JDK 10

root@c339504909345:/opt/jdk-minimal/jre/lib/security #  keytool -cacerts -list
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 80 entries

JDK 8

root@c39596768075:/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts #  keytool -cacerts -list
Enter keystore password:
Keystore type: JKS
Keystore provider: SUN

Your keystore contains 151 entries

修复步骤

我删除了JDK 10证书，并将其替换为JDK 8 由于我正在构建Docker图像，我可以使用多阶段构建快速完成 我正在使用jlink作为/opt/jdk/bin/jlink \构建一个最小的JRE ——模块路径/ opt / jdk / jmods……

这里是不同的路径和命令的顺序…

# Java 8
COPY --from=marcellodesales-springboot-builder-jdk8 /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts /etc/ssl/certs/java/cacerts

# Java 10
RUN rm -f /opt/jdk-minimal/jre/lib/security/cacerts
RUN ln -s /etc/ssl/certs/java/cacerts /opt/jdk-minimal/jre/lib/security/cacerts

检查$JAVA_HOME/lib/security/cacerts文件是否存在! 在我的情况下，它不是一个文件，而是一个到/etc/ssl/certs/java/cacerts的链接，而且这是一个到自身的链接(什么??)，因此JVM无法找到该文件。

解决方案: 复制真正的cacerts文件(你可以从另一个JDK)到/etc/ssl/certs/java/目录，它将解决你的问题:)

eclipse / Sts用户注意:

因为eclipse使用它自己的JRE，您应该将cert添加到它自己的JRE密钥存储库中。 我有这个问题，直到我添加certs到圣的JRE。

SSL日志:

`javax.net.ssl|DEBUG|1A|restartedMain|2021-12-06 23:04:00.874` IRST|TrustStoreManager.java:113|trustStore is: D:\sts-4.12.0.RELEASE\plugins\org.eclipse.justj.openjdk.hotspot.jre.full.win32.x86_64_16.0.2.v20210721-1149\jre\lib\security\cacerts
This is the full path: "sts-4.12.0.RELEASE\plugins\org.eclipse.justj.openjdk.hotspot.jre.full.win32.x86_64_16.0.2.v20210721-1149\jre\lib\security\cacerts"