Certificates does not conform to algorithm constraints

心已赠人 2022-06-11 06:54 98阅读 0赞

遇见问题

在爬取北京移动网厅时，遇见问题：

SLF4J: See http://www.slf4j.org/codes.html#multiple_bindings for an explanation.
    SLF4J: Actual binding is of type [org.slf4j.impl.Log4jLoggerFactory]
    javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates does not conform to algorithm constraints
    	at sun.security.ssl.Alerts.getSSLException(Unknown Source)
    	at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
    	at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    	at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
    	at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
    	at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
    	at sun.security.ssl.Handshaker.processLoop(Unknown Source)
    	at sun.security.ssl.Handshaker.process_record(Unknown Source)
    	at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
    	at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    	at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    	at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
    	at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(Unknown Source)
    	at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)
    	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Unknown Source)
    	at com.geotmt.base.common.HttpsUtil2.post(HttpsUtil2.java:102)
    	at com.geotmt.base.common.HttpsUtil2.main(HttpsUtil2.java:124)
    Caused by: java.security.cert.CertificateException: Certificates does not conform to algorithm constraints
    	at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(Unknown Source)
    	at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(Unknown Source)
    	at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source)
    	... 15 more

解决办法：

在网上百度一下，说是jdk6以后对于jdk.certpath.disabledAlgorithms 有加强了限制。该配置路径在jre\\lib\\security\\java.security中，改造是将jdk.certpath.disabledAlgorithms 后面的配置删除掉。

但是对于该jdk配置，本人因能力有限，不敢这么来。

而是否又会有很么影响，还在探索中。。。。

# Algorithm restrictions for certification path (CertPath) processing
    #
    # In some environments, certain algorithms or key lengths may be undesirable
    # for certification path building and validation.  For example, "MD2" is
    # generally no longer considered to be a secure hash algorithm.  This section
    # describes the mechanism for disabling algorithms based on algorithm name
    # and/or key length.  This includes algorithms used in certificates, as well
    # as revocation information such as CRLs and signed OCSP Responses.
    #
    # The syntax of the disabled algorithm string is described as this Java
    # BNF-style:
    #   DisabledAlgorithms:
    #       " DisabledAlgorithm { , DisabledAlgorithm } "
    #
    #   DisabledAlgorithm:
    #       AlgorithmName [Constraint]
    #
    #   AlgorithmName:
    #       (see below)
    #
    #   Constraint:
    #       KeySizeConstraint
    #
    #   KeySizeConstraint:
    #       keySize Operator DecimalInteger
    #
    #   Operator:
    #       <= | < | == | != | >= | >
    #
    #   DecimalInteger:
    #       DecimalDigits
    #
    #   DecimalDigits:
    #       DecimalDigit {DecimalDigit}
    #
    #   DecimalDigit: one of
    #       1 2 3 4 5 6 7 8 9 0
    #
    # The "AlgorithmName" is the standard algorithm name of the disabled
    # algorithm. See "Java Cryptography Architecture Standard Algorithm Name
    # Documentation" for information about Standard Algorithm Names.  Matching
    # is performed using a case-insensitive sub-element matching rule.  (For
    # example, in "SHA1withECDSA" the sub-elements are "SHA1" for hashing and
    # "ECDSA" for signatures.)  If the assertion "AlgorithmName" is a
    # sub-element of the certificate algorithm name, the algorithm will be
    # rejected during certification path building and validation.  For example,
    # the assertion algorithm name "DSA" will disable all certificate algorithms
    # that rely on DSA, such as NONEwithDSA, SHA1withDSA.  However, the assertion
    # will not disable algorithms related to "ECDSA".
    #
    # A "Constraint" provides further guidance for the algorithm being specified.
    # The "KeySizeConstraint" requires a key of a valid size range if the
    # "AlgorithmName" is of a key algorithm.  The "DecimalInteger" indicates the
    # key size specified in number of bits.  For example, "RSA keySize <= 1024"
    # indicates that any RSA key with key size less than or equal to 1024 bits
    # should be disabled, and "RSA keySize < 1024, RSA keySize > 2048" indicates
    # that any RSA key with key size less than 1024 or greater than 2048 should
    # be disabled. Note that the "KeySizeConstraint" only makes sense to key
    # algorithms.
    #
    # Note: This property is currently used by Oracle's PKIX implementation. It
    # is not guaranteed to be examined and used by other implementations.
    #
    # Example:
    #   jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048
    #
    #
    jdk.certpath.disabledAlgorithms=