SEC_E_INVALID_TOKEN (0x80090308) - Jetty HTTPS servlet

Question

我正在尝试解决通过 HTTPS 运行的 Jetty servlet 的问题。

这是浏览器中的错误：

这是卷曲中的错误：

我做了什么：

1. 我创建了我的密钥库和信任库，如下所述：如何生成密钥库和信任库以及此处https://serverfault.com/questions/488003/keytool-subjectalternativename

   这是我创建密钥库和信任库的批处理脚本：

keytool -keystore keystore.jks -storepass P4ssW0rd -keypass P4ssW0rd -genkey -alias example -validity 365 -dname "CN=example,OU=Example,O=Example,L=Bratislava,ST=Slovakia,C=SK" -ext "SAN=DNS:example.com,DNS:www.example.com,DNS:test.example.com"
"C:\Program Files\Git\usr\bin\openssl.exe" req -new -x509 -subj "/C=SK/ST=Slovakia/L=Bratislava/O=Example/OU=Example/CN=Root-CA" -keyout ca-key -out ca-cert -days 365 -passout pass:P4ssW0rd
keytool -keystore truststore.jks -storepass P4ssW0rd -import -alias ca-root -file ca-cert -noprompt
keytool -keystore keystore.jks -storepass P4ssW0rd -certreq -alias exmaple -file cert-file
echo [SAN] > extFile
echo subjectAltName=DNS:example.com,DNS:www.example.com,DNS:test.example.com >> extFile
"C:\Program Files\Git\usr\bin\openssl.exe" x509 -req -CA ca-cert -CAkey ca-key -in cert-file -out test.pem -days 365 -CAcreateserial -passin pass:P4ssW0rd -extensions SAN -extfile extFile
keytool -keystore keystore.jks -storepass P4ssW0rd -import -alias ca-root -file ca-cert -noprompt
keytool -keystore keystore.jks -storepass P4ssW0rd -import -alias metahost -file test.pem
pause

2. keystore.jks 和 truststore.jks 被复制到我的项目目录中，并编写代码来加载这些文件。

package sk.cood.metahost.server;

import jakarta.servlet.ServletException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.eclipse.jetty.server.*;
import org.eclipse.jetty.servlet.ServletContextHandler;
import org.eclipse.jetty.servlet.ServletHolder;
import org.eclipse.jetty.util.ssl.SslContextFactory;

import java.io.*;

@WebServlet(displayName = "MetaHostServlet", urlPatterns = { "/*" })
public class MetaHostServlet extends HttpServlet {
    private static File keyStoreFile;
    private static File trustStoreFile;

    public static void main(String[] args) throws Exception {
        loadKeyStores();

        Server server = new Server(443);
        ServerConnector connector = createSSLConnector(server, "P4ssW0rd", "P4ssW0rd", false);
        server.addConnector(connector);

        ServletContextHandler context = new ServletContextHandler(ServletContextHandler.SESSIONS);
        context.addServlet(new ServletHolder(new MetaHostServlet()),"/*");
        context.setContextPath("/");
        server.setHandler(context);

        server.start();
        server.join();
    }

    private static void loadKeyStores() {
        keyStoreFile = new File("keystore.jks");
        trustStoreFile = new File("truststore.jks");
        if (!keyStoreFile.exists()) {
            throw new RuntimeException("Key store file does not exist on path '"+keyStoreFile.getAbsolutePath()+"'");
        }
        if (!trustStoreFile.exists()) {
            throw new RuntimeException("Trust store file does not exist on path '"+trustStoreFile.getAbsolutePath()+"'");
        }
    }

    private static ServerConnector createSSLConnector(Server server, String keyStorePassword, String trustStorePassword, boolean isClientAuthNeeded) {
        SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
        sslContextFactory.setKeyStorePath(keyStoreFile.getAbsolutePath());
        sslContextFactory.setKeyStorePassword(keyStorePassword);
        sslContextFactory.setTrustStorePath(trustStoreFile.getAbsolutePath());
        sslContextFactory.setTrustStorePassword(trustStorePassword);
        sslContextFactory.setNeedClientAuth(isClientAuthNeeded);

        HttpConfiguration https_config = new HttpConfiguration();
        https_config.setSendServerVersion(false);
        https_config.setRequestHeaderSize(512 * 1024);
        https_config.setResponseHeaderSize(512 * 1024);

        SecureRequestCustomizer src = new SecureRequestCustomizer();
        https_config.addCustomizer(src);

        return new ServerConnector(server, sslContextFactory, new HttpConnectionFactory(https_config));
    }

    @Override
    public void doGet(HttpServletRequest req, HttpServletResponse res) throws IOException, ServletException {
        res.setContentType("text/html");
        res.setStatus(HttpServletResponse.SC_OK);
        res.getWriter().println("<h1>Hello World!</h1>");
        res.getWriter().println("session=" + req.getSession(true).getId());
    }
}

3. 我用 jetty 启动了我的 servlet 并尝试连接到 https://example.com/ 并出现了提到的错误。

我不知道我的情况出了什么问题，也许对码头和证书更有经验的人会有所帮助。

非常感谢！

Answer 1

您的

ServerConnector

不会对 SSL 执行任何操作，至少不会直接执行。

这条线...

return new ServerConnector(server, sslContextFactory, 
    new HttpConnectionFactory(https_config));

它仅支持 HTTP/1.1 普通明文，不支持 SSL，并且依赖 JVM

ServiceLoader

根据您的

SslConnectionFactory

找到合适的

SslContextFactory.Server

。

由于您没有指定适合您环境的类加载器/类路径，也没有指定 Jetty 的具体版本，所以我鼓励您更直接地表达您的

ServerConnector

和 SSL/TLS 需求，不要依赖于

ServiceLoader

如果不需要的话。

像这样...

return new ServerConnector(server, 
    new SslConnectionFactory(slContextFactory, "http/1.1"),
    new HttpConnectionFactory(https_config));

这可能会改善你的情况，但如果没有更多细节，我无法告诉你到底发生了什么或如何解决它。