Статус: Новичок
Группы: Участники
Зарегистрирован: 10.11.2016(UTC)
Сообщений: 5
|
Добрый день! Пытаемся заставить работать приложение на Spring Boot (2.1.8.RELEASE) + JTLS (версия Tomcat 9.0.24) Сделали следующее: - установили контейнер сертификата сервера в /var/opt/cprocsp/keys/username (username = пользователь , из под которого запускаем приложение) - установили cpSSL из дистрибутива JCP 2.0.40035 - импортировали сертификат в keystore через keytool - конфигурация коннектора TomcatEmbedded: Код:
@Bean
public EmbeddedServletContainerFactory tomcatServletWebServerFactory() {
TomcatEmbeddedServletContainerFactory tomcat = new TomcatEmbeddedServletContainerFactory();
tomcat.addConnectorCustomizers(connector -> {
connector.setScheme("https");
connector.setPort(8443);
connector.setSecure(true);
connector.setEnableLookups(false);
Http11NioProtocol protocol = (Http11NioProtocol) connector.getProtocolHandler();
protocol.setSslImplementationName("ssl.jsse.JCPJSSEImplementation");
protocol.setAlgorithm("GostX509");
protocol.setTruststoreAlgorithm("GostX509");
protocol.setKeystoreType("HDImageStore");
protocol.setKeystoreFile("/home/<username>/cert-keystore");
protocol.setKeystorePass("12345678");
protocol.setKeystoreProvider("JCP");
protocol.setSSLCipherSuite("TLS_CIPHER_2012");
protocol.setSSLProtocol("GostTLS");
protocol.setSslEnabledProtocols("TLSv1");
protocol.setDisableUploadTimeout(true);
protocol.setSSLEnabled(true);
});
return tomcat;
}
При запуске приложения в логе получаем слудующее: Код:
. ____ _ __ _ _
/\\ / ___'_ __ _ _(_)_ __ __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
\\/ ___)| |_)| | | | | || (_| | ) ) ) )
' |____| .__|_| |_|_| |_\__, | / / / /
=========|_|==============|___/=/_/_/_/
:: Spring Boot :: (v2.1.8.RELEASE)
2021-02-24 11:31:05.833 INFO 12826 --- [ main] ru.tecforce.ssl.Application : Starting Application on tf138 with PID 12826 (/home/username/projects/ssl/untitled/target/classes started by username in /home/username/projects/ssl/untitled)
2021-02-24 11:31:05.835 INFO 12826 --- [ main] ru.tecforce.ssl.Application : No active profile set, falling back to default profiles: default
2021-02-24 11:31:06.591 INFO 12826 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat initialized with port(s): 8443 (https)
2021-02-24 11:31:06.610 INFO 12826 --- [ main] o.apache.catalina.core.StandardService : Starting service [Tomcat]
2021-02-24 11:31:06.610 INFO 12826 --- [ main] org.apache.catalina.core.StandardEngine : Starting Servlet engine: [Apache Tomcat/9.0.24]
2021-02-24 11:31:06.680 INFO 12826 --- [ main] o.a.c.c.C.[Tomcat].[localhost].[/] : Initializing Spring embedded WebApplicationContext
2021-02-24 11:31:06.680 INFO 12826 --- [ main] o.s.web.context.ContextLoader : Root WebApplicationContext: initialization completed in 811 ms
2021-02-24 11:31:06.825 INFO 12826 --- [ main] o.s.s.concurrent.ThreadPoolTaskExecutor : Initializing ExecutorService 'applicationTaskExecutor'
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.SSLContextImpl engineInit
INFO: SSLContextImpl init.
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.TrustManagerFactoryImpl a
INFO: trustStore is : No File Available, using empty keystore.
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.TrustManagerFactoryImpl a
INFO: trustStore type is : HDImageStore
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.TrustManagerFactoryImpl a
INFO: trustStore provider is :
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.TrustManagerFactoryImpl a
INFO: init truststore
2021-02-24 11:31:07.071 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : SSLContextImpl init.
2021-02-24 11:31:07.074 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : trustStore is : No File Available, using empty keystore.
2021-02-24 11:31:07.074 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : trustStore type is : HDImageStore
2021-02-24 11:31:07.075 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : trustStore provider is :
2021-02-24 11:31:07.075 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : init truststore
2021-02-24 11:31:07.484 INFO 12826 --- [ main] ru.CryptoPro.JCP.tools.JCPLogger : Loading JCP 2.0.40035
2021-02-24 11:31:07.506 INFO 12826 --- [ main] ru.CryptoPro.JCP.tools.JCPLogger : JCP loaded.
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.cl_125 a
FINE:
%% adding as trusted certificates %%
--------
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.cl_125 a
FINE: adding as trusted cert:
Subject: CN=test
Issuer: CN=test, O=test, OU=test, STREET=test, L=test, ST=test, C=RU, EMAILADDRESS=test@test
Algorithm: GOST3410_2012_256
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.SSLContextImpl engineInit
INFO: trigger seeding of SecureRandom
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.SSLContextImpl engineInit
INFO: done seeding SecureRandom
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.SSLContextImpl engineInit
INFO: SSLContextImpl initialized.
Feb 24, 2021 11:31:07 AM ru.CryptoPro.ssl.cl_96 <init>
FINE: %% Initialized: [Session-1, SSL_NULL_WITH_NULL_NULL]
2021-02-24 11:31:07.546 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : trigger seeding of SecureRandom
2021-02-24 11:31:07.547 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : done seeding SecureRandom
2021-02-24 11:31:07.547 INFO 12826 --- [ main] ru.CryptoPro.ssl.SSLLogger : SSLContextImpl initialized.
2021-02-24 11:31:07.622 INFO 12826 --- [ main] o.s.b.w.embedded.tomcat.TomcatWebServer : Tomcat started on port(s): 8443 (https) with context path ''
2021-02-24 11:31:07.625 INFO 12826 --- [ main] ru.tecforce.ssl.Application : Started Application in 2.089 seconds (JVM running for 2.757)
При проверке утилитой csptest получаем exeption со стороны сервера: Код:
2021-02-24 11:35:16.039 ERROR 12826 --- [nio-8443-exec-1] org.apache.tomcat.util.net.NioEndpoint : Error running socket processor
java.lang.IllegalStateException: SSLContextImpl is not initialized
at sun.security.ssl.SSLContextImpl.engineCreateSSLEngine(SSLContextImpl.java:196) ~[na:1.8.0_231]
at javax.net.ssl.SSLContext.createSSLEngine(SSLContext.java:329) ~[na:1.8.0_231]
at ru.tecforce.ssl.jsse.JCPSSLContext.createSSLEngine(JCPSSLContext.java:30) ~[classes/:na]
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLEngine(AbstractJsseEndpoint.java:119) ~[tomcat-embed-core-9.0.24.jar:9.0.24]
at org.apache.tomcat.util.net.SecureNioChannel.processSNI(SecureNioChannel.java:329) ~[tomcat-embed-core-9.0.24.jar:9.0.24]
at org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:175) ~[tomcat-embed-core-9.0.24.jar:9.0.24]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1564) ~[tomcat-embed-core-9.0.24.jar:9.0.24]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-9.0.24.jar:9.0.24]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_231]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_231]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-9.0.24.jar:9.0.24]
at java.lang.Thread.run(Thread.java:748) [na:1.8.0_231]
Со стороны csptest, ошибка следующая: Код:
./csptest -tlsc -server locahost -port 8443 -v -nocheck
8 algorithms supported:
Aglid Class OID
[00] 0x661e 0x6000 1.2.643.2.2.21 (ГОСТ 28147-89)
[01] 0x801e 0x8000 1.2.643.2.2.3 (ГОСТ Р 34.11/34.10-2001)
[02] 0x8021 0x8000 1.2.643.7.1.1.2.2 (ГОСТ Р 34.11-2012 256 бит)
[03] 0x801f 0x8000
[04] 0x2e1e 0x2000 1.2.643.2.2.20 (ГОСТ Р 34.10-94)
[05] 0x2e23 0x2000 1.2.643.2.2.19 (ГОСТ Р 34.10-2001)
[06] 0x2e49 0x2000 1.2.643.7.1.1.1.1 (ГОСТ Р 34.10-2012)
[07] 0x2e3d 0x2000 1.2.643.7.1.1.1.2 (ГОСТ Р 34.10-2012)
Cipher strengths: 256..256
Supported protocols: 0xa80:
Transport Layer Security 1.0 client side
Transport Layer Security 1.1 client side
Transport Layer Security 1.2 client side
dwProtocolMask: 0x800a0aaa
Protocol version: 3.3
ClientHello: RecordLayer: TLS, Len: 98
Cipher Suites: (ff 85) (00 81) (00 32) (00 31)
103 bytes of handshake data sent
**** Server unexpectedly disconnected
An error occurred in running the program.
/dailybuildsbranches/CSP_4_0/CSPbuild/CSP/samples/csptest/WebClient.c:628:Error performing handshake.
Error number 0x80090304 (2148074244).
Внутренняя ошибка пакета безопасности
Total: SYS: 0,030 sec USR: 0,060 sec UTC: 24,650 sec
[ErrorCode: 0x80090304]
Подскажите, пожалуйста. В какую сторону копать ?
|
|
|
|
|
|
Быстрый переход
Вы не можете создавать новые темы в этом форуме.
Вы не можете отвечать в этом форуме.
Вы не можете удалять Ваши сообщения в этом форуме.
Вы не можете редактировать Ваши сообщения в этом форуме.
Вы не можете создавать опросы в этом форуме.
Вы не можете голосовать в этом форуме.
Important Information:
The Форум КриптоПро uses cookies. By continuing to browse this site, you are agreeing to our use of cookies.
More Details
Close
