HandShake TLS-证书未知

Question

我已经通过TLS添加了必要的证书来通信web服务，客户端和服务器都将证书添加到keystore中，但是在握手中，将返回未知证书。

SSL会话：

Is initial handshake: true
....
*** ClientHello, TLSv1
*** ServerHello, TLSv1

*** Certificate chain
[ chain [0] = [
[
  Version: V3
  Subject: CN=certificate_server, OU=163831, O=groupc Inc., C=US
  Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5

  Key:  IBMJCE RSA Public Key:
modulus:
... more data
public exponent:
65537

  Validity: [From: Mon Apr 03 10:43:20 CDT 2017,
               To: Wed Apr 03 09:43:20 CST 2019]
  Issuer: CN=Internal DeviceCA Untrusted, DC=nsroot, DC=net
  SerialNumber: [110855813xxxxxxxxxxxxxxx]
Certificate Extensions: 10


Found trusted certificate:

 *** CertificateRequest
 Cert Types: RSA, DSS
 Cert Authorities:
 ....

 *** ServerHelloDone

 ** Certificate chain
[  O chain [0] = [
[
  Version: V3
  Subject: CN=certificateClient, OU=55552, O=groupc Inc., C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  IBMJCE RSA Public Key:
modulus:
.... more data
public exponent:
65537

  Validity: [From: Tue Aug 08 16:26:27 CDT 2017,
               To: Thu Aug 08 16:26:27 CDT 2019]
  Issuer: CN=Device CA1 G2 DEV, O=groupc Inc., C=US
  SerialNumber: [23415xxxxxxxxxxxxxxxxxxxxxxx]

Certificate Extensions: 10

*** CertificateVerify

*** Finished
 verify_data:  { 101, 203, 80, 212, 246, 137, 144, 225, 31, 134, 63, 46 }
 ***

 READ: TLSv1 Alert, length = 2
 3, RECV TLSv1 ALERT:  fatal, certificate_unknown
 3 fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

并列出密钥存储库以查看密钥和所需的密钥，在服务器中也是证书。

有没有办法知道哪个证书是未知的？或者比较客户端和服务器之间的求购字符串？

Answer 1

看起来调试输出是在客户端完成的。在这种情况下

3, RECV TLSv1 ALERT:  fatal, certificate_unknown

意味着客户端收到来自服务器的TLS警报，这意味着服务器不喜欢客户端发送的证书，即客户端证书：

Validity: [From: Tue Aug 08 16:26:27 CDT 2017,
           To: Thu Aug 08 16:26:27 CDT 2019]
Issuer: CN=Device CA1 G2 DEV, O=groupc Inc., C=US
SerialNumber: [23415xxxxxxxxxxxxxxxxxxxxxxx]

但是，调试输出和任何数据包捕获都不包含服务器不喜欢证书的信息。TLS警报仅包含信息certificate_unknown，不包含任何详细信息。

这可能是因为服务器信任的CA没有发出用于客户端证书验证的证书，缺少中间CA，主题错误等等。也许您可以在服务器端的一些日志中获得有关此问题的更多信息。