客户端与服务器SSL双向认证(客户端：Android-服务端：vc)

package com.kortide.ssl; import java.io.BufferedOutputStream; import java.io.BufferedReader; import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; import java.io.OutputStream; import java.io.UnsupportedEncodingException; import java.net.InetSocketAddress; import java.security.KeyStore; import java.security.cert.X509Certificate; import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSocket; import javax.net.ssl.TrustManagerFactory; import android.app.Activity; import android.app.AlertDialog; import android.content.res.AssetManager; import android.os.Bundle; import android.util.Log; import android.view.View; import android.widget.Button; import android.widget.EditText; import android.widget.Toast; public class AndroidSSLClient extends Activity { private static final String LOG_TAG = "AndroidSSLClient"; private static final boolean LOG_DEBUG = true; private static final boolean LOG_RELEASE = true; InetSocketAddress isa; private static final String SERVER_IP = "192.168.5.160"; // 本地IP：一定不要用127.0.0.1否则连接不上 private static final int SERVER_PORT = 8443; // 端口号 private static final String CLIENT_KET_PASSWORD = "12345678";// "changeit";// // //私钥密码 private static final String CLIENT_TRUST_PASSWORD = "12345678";// "changeit";//信任证书密码 private static final String CLIENT_AGREEMENT = "TLS"; // 使用协议 private static final String CLIENT_KEY_MANAGER = "X509"; // 密钥管理器 private static final String CLIENT_TRUST_MANAGER = "X509"; // 信任证书管理器 private static final String CLIENT_KEY_KEYSTORE = "BKS"; // "JKS";//密库，这里用的是BouncyCastle密库 private static final String CLIENT_TRUST_KEYSTORE = "BKS"; // "JKS";// private static final String ENCONDING = "utf-8"; // 字符集 private SSLSocket Client_sslSocket; private Button btn1;// 传输数据 private Button btn2;// 关闭连接 private Button btn3;// 初始化，并取得socket连接 private EditText et;// 要传输的数据 private AssetManager mAssetManager = null; @Override public void onCreate(Bundle savedInstanceState) { super.onCreate(savedInstanceState); setContentView(R.layout.main); mAssetManager = getAssets(); et = (EditText) findViewById(R.id.EditText01); btn1 = (Button) findViewById(R.id.Button01); btn2 = (Button) findViewById(R.id.Button02); btn3 = (Button) findViewById(R.id.Button03); btn1.setOnClickListener(new Button.OnClickListener() { @Override public void onClick(View arg0) { if (null != Client_sslSocket) { getOut(Client_sslSocket, et.getText().toString()); getIn(Client_sslSocket); et.setText(""); } else { displayMessage("提示", "客户端已关闭，请重新建立连接"); } } }); btn2.setOnClickListener(new Button.OnClickListener() { @Override public void onClick(View arg0) { try { if (null != Client_sslSocket) { getOut(Client_sslSocket, "2");// 2:关闭连接命令 Client_sslSocket.close(); Client_sslSocket = null; } else { displayMessage("提示", "客户端已关闭"); } } catch (IOException e) { e.printStackTrace(); } } }); btn3.setOnClickListener(new View.OnClickListener() { @Override public void onClick(View arg0) { if (null == Client_sslSocket) { init(); } if (null != Client_sslSocket) { getOut(Client_sslSocket, "1");// 1:建立连接命令 getIn(Client_sslSocket); } } }); } public void init() { try { // 取得SSL的SSLContext实例 SSLContext sslContext = SSLContext.getInstance(CLIENT_AGREEMENT); // 取得KeyManagerFactory实例 KeyManagerFactory keyManager = KeyManagerFactory .getInstance(CLIENT_KEY_MANAGER); // 取得TrustManagerFactory的X509密钥管理器 TrustManagerFactory trustManager = TrustManagerFactory .getInstance(CLIENT_TRUST_MANAGER); // 取得BKS密库实例 KeyStore keyKeyStore = KeyStore.getInstance(CLIENT_KEY_KEYSTORE); KeyStore trustKeyStore = KeyStore .getInstance(CLIENT_TRUST_KEYSTORE); /** * ok:client.p12\server.p12 client.p12\ca.p12 服务端接收为：cl/ca * 如果为：ca.p12/server.p12 ca.p12/ca.p12服务端接收为：ca/ca * 如果为：server.p12/ca.p12 server.p12/server.p12 服务端接收为：svr/ca */ // 加载证书和私钥,通过读取资源文件的方式读取密钥和信任证书（kclient:密钥;lt_client:信任证书） InputStream is = mAssetManager.open("client.bks");// VC端传p12证书转成bks keyKeyStore.load(is, CLIENT_KET_PASSWORD.toCharArray());// kclient:密钥 is.reset(); InputStream is2 = mAssetManager.open("server.bks");// VC端传p12证书转成bks trustKeyStore.load(is2, CLIENT_TRUST_PASSWORD.toCharArray());// lt_client:信任证书 is.close(); is2.close(); // 初始化密钥管理器、信任证书管理器 keyManager.init(keyKeyStore, CLIENT_KET_PASSWORD.toCharArray()); trustManager.init(trustKeyStore); // 初始化SSLContext sslContext.init(keyManager.getKeyManagers(), trustManager.getTrustManagers(), null); // 生成客户端SSLSocket // isa = new InetSocketAddress(SERVER_IP,SERVER_PORT); // Client_sslSocket.connect(isa, 20000); Client_sslSocket = (SSLSocket) sslContext.getSocketFactory() .createSocket(SERVER_IP, SERVER_PORT); } catch (Exception e) { Log.e(LOG_TAG, "" + e.getMessage()); e.printStackTrace(); } } /** * 向server输出信息。 * * @param socket * The client socket * @param message * to be delivered to server */ public void getOut(SSLSocket socket, String message) { Log.i(LOG_TAG, "come int getOut()"); OutputStream output = null; try { // 这样发信息，不会堵塞socket output = socket.getOutputStream(); BufferedOutputStream bufferedOutput = new BufferedOutputStream( output); bufferedOutput.write(message.getBytes()); bufferedOutput.flush(); /* * PrintStream out; out = new PrintStream( new * BufferedOutputStream(socket.getOutputStream(), 8192), true); * //autoFlush==true //这样发信息，会堵塞socket out.println(message); * out.println(); */ Log.i(LOG_TAG, "send server message is: " + message); } catch (IOException e) { e.printStackTrace(); } } /** * 从server读出信息 * * @param socket * The client socket */ public void getIn(SSLSocket socket) { Log.i(LOG_TAG, "come int getIn()"); BufferedReader in = null; StringBuffer str = new StringBuffer(""); try { System.out.println("==============INFO================"); System.out.println("HOST:" + socket.getSession().getPeerHost()); System.out.println("POST:" + socket.getSession().getPeerPort()); // 显示授权信息. X509Certificate cert = (X509Certificate) socket.getSession() .getPeerCertificates()[0];// getLocalCertificates String subject = cert.getSubjectDN().getName(); String issuer = cert.getIssuerDN().getName(); System.out.println("Subject certificate: " + subject); System.out.println("Issuer certificate: " + issuer); System.out.println("==============INFO================"); String line = null; in = new BufferedReader(new InputStreamReader( socket.getInputStream()), 8192); // LOGD(LOG_TAG,"====in.ready()===="+in.ready());//不注释不显示服务端数据：in.ready()=false while ((line = in.readLine()) != null) { /* * LOGD(LOG_TAG, "in.ready() == " + in.ready()); if * (!in.ready()) { break; } */ str.append(line); LOGI(LOG_TAG, line); } LOGD(LOG_TAG, "after in.readLine"); } catch (UnsupportedEncodingException e) { e.printStackTrace(); } catch (NullPointerException e) { e.printStackTrace(); } catch (IOException e) { e.printStackTrace(); } catch (Exception e) { e.printStackTrace(); } displayMessage("服务器消息", str.toString()); } private void displayMessage(String title, String content) { new AlertDialog.Builder(AndroidSSLClient.this).setTitle(title) .setNegativeButton("确定", null) .setIcon(android.R.drawable.ic_menu_agenda).setMessage(content) .show(); }