Добрый день! Помогите, пожалуйста. Делаю запрос в НБКИ. Получаю ошибку:

Exception in thread "main" javax.net.ssl.SSLHandshakeException: ru.CryptoPro.ssl.pc_4.cl_5: PKIX path validation failed: java.security.cert.CertPathValidatorException: Path does not chain with any of the trust anchors
at ru.CryptoPro.ssl.cl_2.a(Unknown Source)
at ru.CryptoPro.ssl.cl_97.a(Unknown Source)
at ru.CryptoPro.ssl.cl_58.a(Unknown Source)
at ru.CryptoPro.ssl.cl_58.a(Unknown Source)
at ru.CryptoPro.ssl.cl_15.a(Unknown Source)
at ru.CryptoPro.ssl.cl_15.a(Unknown Source)
at ru.CryptoPro.ssl.cl_58.u(Unknown Source)
at ru.CryptoPro.ssl.cl_58.a(Unknown Source)
at ru.CryptoPro.ssl.cl_97.a(Unknown Source)
at ru.CryptoPro.ssl.cl_97.n(Unknown Source)
at ru.CryptoPro.ssl.cl_97.b(Unknown Source)
at ru.CryptoPro.ssl.cl_97.startHandshake(Unknown Source)
at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:573)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:557)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:414)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180)
at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144)
at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:134)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445)
at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
at MainJCP.sendRequest(MainJCP.java:186)
at MainJCP.p1(MainJCP.java:180)
at MainJCP.main(MainJCP.java:58)

Создал хранилище сертификатов, добавил туда те, которые разршешают доступ на icrs.nbki.ru.
Добавил с jre/lib/security/cacert сертификаты от НБКИ.

Код:


private static void main() throws Exception {

Security.addProvider(new DIGTProvider());
Security.setProperty("ssl.SocketFactory.provider", "ru.CryptoPro.ssl.SSLSocketFactoryImpl");
Security.setProperty("ssl.KeyManagerFactory.algorithm", Provider.KEYMANGER_ALG);
Security.setProperty("ssl.TrustManagerFactory.algorithm", Provider.KEYMANGER_ALG);

System.setProperty("com.sun.security.enableCRLDP", "true");
System.setProperty("com.ibm.security.enableCRLDP", "true");

// В прикреплении сертификаты
String keystore = "C:\\Users\\Admin\\Documents\\Работа\\нбки\\jcp\\mykeystore2";
String password = "111";

System.setProperty("javax.net.ssl.trustStoreType", JCP.CERT_STORE_NAME);
System.setProperty("javax.net.ssl.trustStore", keystore);
System.setProperty("javax.net.ssl.trustStorePassword", password);

KeyStore trustStore = KeyStore.getInstance(JCP.CERT_STORE_NAME);
trustStore.load(new FileInputStream(keystore), password.toCharArray()); // хранилище корневых сертификатов
TrustManagerFactory tmf = TrustManagerFactory.getInstance("GostX509");
tmf.init(trustStore);

SSLContext sslCtx = SSLContext.getInstance("GostTLS"); // Защищенный контекст
sslCtx.init(null, tmf.getTrustManagers(), null);

SSLSocketFactory socketFactory = new SSLSocketFactory(sslCtx);

// // Регистрируем HTTPS схему.
SchemeRegistry registry = new SchemeRegistry();
registry.register(new Scheme("http", 8080, PlainSocketFactory.getSocketFactory()));
registry.register(new Scheme("https", 8443, socketFactory));
//
// // Параметры соединения.
HttpParams params = new BasicHttpParams();
HttpConnectionParams.setSoTimeout(params, 5000);
HttpConnectionParams.setConnectionTimeout(params, 5000);
ClientConnectionManager ccm = new ThreadSafeClientConnManager(params, registry);

DefaultHttpClient httpClient = new DefaultHttpClient(ccm, params);

String url= "https://icrs.nbki.ru/products/B2BRequestServlet";

HttpGet r = new HttpGet();
r.setURI(new URI(url));
CloseableHttpResponse resp = httpClient.execute(r);
System.out.println(resp.getStatusLine());
}


Сертификаты:

Bezymjannyjj.png (56kb) загружен 21 раз(а).

Если есть линки на верные решения - очень прошу поделиться!

Отредактировано пользователем 22 августа 2017 г. 17:55:19(UTC)  | Причина: Не указана