作者Blog(http://genylife.top/)

密鑰制作(命名解釋：k -> keymanager ; t -> TrustManager)

• 通過Java 的keytool 工具生成密鑰

  keytool -genkey -v -alias server -keyalg RSA -storetype PKCS12 -keystore kserver.p12
  

  NOTICE:

  1. 指定別名為server
  2. 指定存儲類型為PKCS12
  3. 指定文件名kserver.p12

• 導出所生成的密鑰證書

  keytool -export -alias server -keystore kserver.p12 -storetype PKCS12 -file server.cer
  

  NOTICE:

  1. 指定別名為上一步所設置的別名
  2. 指定密鑰文件為上一步生成的文件名
  3. 存儲類型匹配PKCS12
  4. 制定文件名server.cer

• 將證書導出為Android 支持的BKS 格式

  keytool -importcert -v -trustcacerts -alias server -file server.cer -keystore tclient.bks -storetype BKS -providerclass org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath bcprov-jdk15on-146.jar
  

  NOTICE:

  1. 指定證書文件server.cer
  2. 指定生成的BKS格式文件tclient.bks
  3. 指定存儲類型BKS
  4. 需要下載文件bcprov-jdk15on-146.jar ，并設置其路徑，路徑指定為providerpath
  5. 設置轉換的providerclass

• 至此，服務器端的密鑰和客戶端的證書就制作完成了，然后再制作客戶端的密鑰和服務器端的證書

  keytool -genkey -v -alias clent -keyalg RSA -storetype PKCS12 -keystore kclient.p12
  

  keytool -export -alias client -keystore kclient.p12 -storetype PKCS12 -file client.cer
  

  keytool -importcert -v -trustcacerts -alias server -file client.cer -keystore tserver.bks -storetype BKS -providerclass org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath bcprov-jdk15on-146.jar
  

• 把kserver.p12 和tserver.bks 放在服務器端，把kclient.p12 和tclient.bks 放在客戶端

創建KeyManagers

public class AliasKeyManager implements X509KeyManager {

        private KeyStore _ks;
        private String _alias;
        private String _password;

        public AliasKeyManager(KeyStore ks, String alias, String password) {
            _ks = ks;
            _alias = alias;
            _password = password;
        }

        public String chooseClientAlias(String[] str, Principal[] principal, Socket socket) {
            return _alias;
        }

        public String chooseServerAlias(String str, Principal[] principal, Socket socket) {
            return _alias;
        }

        public X509Certificate[] getCertificateChain(String alias) {
            try {
                java.security.cert.Certificate[] certificates = this._ks.getCertificateChain(alias);
                if(certificates == null) {
                    throw new FileNotFoundException("no certificate found for alias:" + alias);
                }
                X509Certificate[] x509Certificates = new X509Certificate[certificates.length];
                System.arraycopy(certificates, 0, x509Certificates, 0, certificates.length);
                return x509Certificates;
            } catch (Exception e) {
                e.printStackTrace();
                return null;
            }
        }

        public String[] getClientAliases(String str, Principal[] principal) {
            return new String[]{_alias};
        }

        public PrivateKey getPrivateKey(String alias) {
            try {
                return (PrivateKey) _ks.getKey(alias, _password == null ? null : _password.toCharArray());
            } catch (Exception e) {
                e.printStackTrace();
                return null;
            }
        }

        public String[] getServerAliases(String str, Principal[] principal) {
            return new String[]{_alias};
        }
    }

KeyManager[] createKeyManagers(String keyStoreFileName, String keyStorePassword, String alias)
            throws CertificateException, IOException, KeyStoreException, NoSuchAlgorithmException, UnrecoverableKeyException {
        final String KEY_STORE_TYPE_P12 = "PKCS12";
        InputStream inputStream = pContext.getResources().getAssets().open(keyStoreFileName);
        KeyStore keyStore = KeyStore.getInstance(KEY_STORE_TYPE_P12);
        keyStore.load(inputStream, keyStorePassword.toCharArray());

        KeyManager[] managers;
        if(alias != null) {
            managers = new KeyManager[]{new AliasKeyManager(keyStore, alias, keyStorePassword)};
        } else {
            KeyManagerFactory keyManagerFactory =
                    KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
            keyManagerFactory.init(keyStore, keyStorePassword == null ? null : keyStorePassword.toCharArray());
            managers = keyManagerFactory.getKeyManagers();
        }
        return managers;

創建TrustManagers

TrustManager[] createTrustManagers(String trustStoreFileName, String trustStorePassword)
            throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException {
        final String KEY_STORE_TYPE_BKS = "bks";
        InputStream inputStream = pContext.getResources().getAssets().open(trustStoreFileName);
        KeyStore trustStore = KeyStore.getInstance(KEY_STORE_TYPE_BKS);
        trustStore.load(inputStream, trustStorePassword.toCharArray());

        TrustManagerFactory trustManagerFactory =
                TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);
        return trustManagerFactory.getTrustManagers();
    }

創建SocketFactory

 SSLContext context = SSLContext.getInstance("TLS");
 KeyManager[] keyManagers = createKeyManagers(keyStoreFileName, keyStorePassword, alias);
 TrustManager[] trustManagers = createTrustManagers(trustStoreFileName, trustStorePassword);
 context.init(keyManagers, trustManagers, null);

 //  獲取SSLServerSocketFactory
 SSLServerSocketFactory socketFactory = context.getServerSocketFactory();

 //  獲取SSLSocketFactory
 SSLSocketFactory socketFactory = context.getSocketFactory();

作者Blog(http://genylife.top/)