??xml version="1.0" encoding="utf-8" standalone="yes"?>国产午夜亚洲不卡,亚洲日本中文字幕天堂网,亚洲人成电影福利在线播放http://www.tkk7.com/josson/天地生h,有一人应有一Z?人生在世,生一日当一日之?zh-cnSun, 11 May 2025 15:43:37 GMTSun, 11 May 2025 15:43:37 GMT60Z客户端(览器)证书w䆾认证的方?/title><link>http://www.tkk7.com/josson/archive/2011/12/09/365966.html</link><dc:creator>josson</dc:creator><author>josson</author><pubDate>Fri, 09 Dec 2011 08:09:00 GMT</pubDate><guid>http://www.tkk7.com/josson/archive/2011/12/09/365966.html</guid><wfw:comment>http://www.tkk7.com/josson/comments/365966.html</wfw:comment><comments>http://www.tkk7.com/josson/archive/2011/12/09/365966.html#Feedback</comments><slash:comments>0</slash:comments><wfw:commentRss>http://www.tkk7.com/josson/comments/commentRss/365966.html</wfw:commentRss><trackback:ping>http://www.tkk7.com/josson/services/trackbacks/365966.html</trackback:ping><description><![CDATA[1、介l?br /><div><div>通过证书验证用户w䆾Q浏览器Q,其核心是利用cookie实现http和https的信息共享(同域名)。如http://test.abc.com/app/index.html 发现未验证后Q蟩转到https://test.abc.com:443/app/checkCrt.htmlw䆾验证Q要求出去证书,认后将w䆾信息带入httph头部Q蟩转到原请求页面(http://test.abc.com/app/index.html Q,dw䆾信息后进入页?Z安全考虑Cookie需要加??/div></div><br />程?br /><img src="http://www.tkk7.com/images/blogjava_net/josson/certauth.png" border="0" alt="" width="666" height="589" data-pinit="registered" /><br />程说明Q?br /><div><div>d程详细介绍Q?/div><div>1Q? 未登录用戯问页?如:http://test.abc.com/app/index.html</div><div>2Q? 【CertAuthValve】判断是否访问受限制资源Q如讉K受限制的资源则判断用戯n份是否已验证Q未验证则将用户重定向到w䆾验证面Q原始请求的url做ؓ</div><div>query的一部分Q登录成功后可以跌{回来Q?如:https://test.abc.com:443/app/checkCrt.htm?done=/index.html?/div><div>3Q? 【CertAuthValve】对于httpshQapachedh提供的用戯书,获取证书中的邮g地址Qƈ该信息写入h头中?/div><div>4Q? 【GetUserInfoValve】读取请求头Q获取刚刚设|的用户邮g地址信息Q进一步获取用L详细信息Q然后将q些信息加密后放入cookie中?/div><div>5Q? d完成Q将用户外部重定向回原始面?/div></div>2、具体实?br />1Q、安装apache、ssh、java、jboss{环境,略?br />2Q、生成服务证书和服务密码<div><div><div style="font-size: 13px; border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: #cccccc; border-right-color: #cccccc; border-bottom-color: #cccccc; border-left-color: #cccccc; padding-right: 5px; padding-bottom: 4px; padding-left: 4px; padding-top: 4px; width: 98%; word-break: break-all; background-color: #eeeeee; "><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />-->openssl req -<span style="color: #0000FF; ">new</span> -x509 -nodes -out /home/admin/app/conf/ssl.crt/server.crt -keyout /home/admin/app/conf/ssl.crt/server.key -days 3600</div></div><div>因ؓ要和内网证书交互Q所以需要一个内|证书公钥文Ӟ可以通过以下方式获取:</div><div>获取ҎQIE->工具->Internet选项->内容->证书->受信ȝ根证书颁发机构,扑ֈintranet行,点击导出Q选择下一步,选择Base64~码X.509,证书文件保存ؓintranet-ca.crtQ拷贝到目录/home/admin/app/conf/ssl.crt/?br />3Q、apache(httpd.conf)配置</div></div>应用和n份验证页面放在一P所以需要同旉|两个虚拟主机,同时监听80Q处理httphQ?43Q处理httpshQ端口?br /><div style="border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: #cccccc; border-right-color: #cccccc; border-bottom-color: #cccccc; border-left-color: #cccccc; padding-right: 5px; padding-bottom: 4px; padding-left: 4px; padding-top: 4px; width: 98%; word-break: break-all; background-color: #eeeeee; "><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><font class="Apple-style-span" size="2">#监听端口</font><br /><font class="Apple-style-span" size="2">Listen 80</font><br /><font class="Apple-style-span" size="2">Listen 443</font><br /><br /><font class="Apple-style-span" size="2">#app的虚拟主机配|?/font><br /><div><div style="font-size: 13px; ">NameVirtualHost *:80</div><div style="font-size: 13px; "><VirtualHost *:80></div><div style="font-size: 13px; ">    ServerAdmin sa@abc.com</div><div style="font-size: 13px; ">    ServerName test.abc.com</div><div style="font-size: 13px; ">    DocumentRoot /home/admin/app/target/app/htdocs/</div><div><font class="Apple-style-span" size="2"></VirtualHost></font><br /><br /><font class="Apple-style-span" size="2">#w䆾验证的虚拟主机配|?/font><br /><div><div>NameVirtualHost *:443</div><div><VirtualHost *:443></div><div>    ServerAdmin sa@abc.com</div><div>    ServerName test.abc.com</div><div>    DocumentRoot <span id="aesqeoi" class="Apple-style-span" style="font-size: 13px; ">/home/admin/app/target/app/htdocs/</span></div><div></div><div>    SSLEngine on</div><div>    SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+SSLv3:+EXP:+eNULL<br /><br /><div>    #该指令ؓ虚拟L指定证书文g名?/div></div><div>    SSLCertificateFile /home/<span style="font-size: 13px; ">admin</span><span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">app</span><span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">conf</span><span style="font-size: 13px; ">/</span>ssl.crt/server.crt<br /><br /><div>    #该指令ؓ证书指定一个对应的U钥文g</div></div><div>    SSLCertificateKeyFile /home<span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">admin</span><span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">app</span><span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">conf</span><span style="font-size: 13px; ">/</span>ssl.crt/server.key<br /><br /><div>    #该指令ؓ指定一个包含Certificate Authority证书的文?br /><div><div>    #证书公钥</div></div></div></div><div>    SSLCACertificateFile /home<span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">admin</span><span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">app</span><span style="font-size: 13px; ">/</span><span style="font-size: 13px; ">conf</span><span style="font-size: 13px; ">/</span>ssl.crt/intranet-ca.cer</div><div></div><div>    SSLProxyEngine on</div><div>    RewriteEngine on</div><div>    #讄客户端证书验证ؓ必须</div><div>    SSLVerifyClient require<br /><br /><div><div>    #因ؓ一个CA证书能够被另一个CA证书验证Q所以可以Ş成一个CA证书?使用该指令可指定服务器验证用戯书时可以查找多少个CA证明?/div><div>    #讄认证深度Q一般用默认10?/div></div></div><div>    SSLVerifyDepth  10<br /><br />    #把mod_ssl里的变量变ؓ全局环境的变?/div><div>    SSLOptions +StdEnvVars<br /><br /><div><div>    #证书中的邮件地址d到请求头?/div></div></div><div>    RequestHeader unset SSL_CLIENT_S_DN_Email</div><div>    RequestHeader add SSL_CLIENT_S_DN_Email %{SSL_CLIENT_S_DN_Email}e</div><div></VirtualHost></div></div></div></div></div><br />4)、代码片D?br /><div style="font-size: 13px; border-top-width: 1px; border-right-width: 1px; border-bottom-width: 1px; border-left-width: 1px; border-top-style: solid; border-right-style: solid; border-bottom-style: solid; border-left-style: solid; border-top-color: #cccccc; border-right-color: #cccccc; border-bottom-color: #cccccc; border-left-color: #cccccc; padding-right: 5px; padding-bottom: 4px; padding-left: 4px; padding-top: 4px; width: 98%; word-break: break-all; background-color: #eeeeee; "><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #008000; ">        //</span><span style="color: #008000; ">CertAuthValve.java<br />        </span><span style="color: #008000; ">//</span><span style="color: #008000; ">判断session中是否有用户邮箱地址</span><span style="color: #008000; "><br /></span>        SessionValue session = SessionHelper.getSessionValue(rundata);<br />        <span style="color: #0000FF; ">if</span> (StringUtil.isNotEmpty(session.getCropEmail())) {<br />            <span style="color: #0000FF; ">return</span> <span style="color: #0000FF; ">null</span>;<br />        }<br />        <br />        <span style="color: #008000; ">//</span><span style="color: #008000; "> 从内|证书中获取用户邮箱地址: </span>SSL_CLIENT_S_DN_Email<span style="color: #008000; "><br /></span>        String cropEmail = rundata.getRequest().getHeader(SSL_CLIENT_HEADER_MAIL);<br />        <span style="color: #0000FF; ">if</span> (StringUtil.isNotEmpty(cropEmail)) {<br />            <span style="color: #008000; ">//</span><span style="color: #008000; ">邮地址保存到session</span><span style="color: #008000; "><br /></span>            session.setCropEmail(cropEmail);<br />            SessionHelper.saveSessionValue(rundata, session);<br />            <span style="color: #0000FF; ">if</span> (log.isDebugEnabled()) {<br />                log.debug("用户" + session.getCropEmail() + "已经通过证书验证");<br />            }<br />            <span style="color: #0000FF; ">return</span> <span style="color: #0000FF; ">null</span>;<br />        }<br />        <br />        URIBrokerService uriBrokerService = (URIBrokerService) getWebxComponent().getService(<br />                URIBrokerService.SERVICE_NAME);<br />        URIBroker noPermissionUriBroker = uriBrokerService.getURIBroker(CHECK_CRT_URL);<br />        <span style="color: #008000; ">//</span><span style="color: #008000; ">h的原始URL & 验证的URL</span><span style="color: #008000; "><br /></span>        String requestPath = rundata.getPathInfo().replace("_", "");<br />        String checkCrtUrl = (String) noPermissionUriBroker.getPath().get(<br />                noPermissionUriBroker.getPath().size() - 1);<br /><br />        <span style="color: #0000FF; ">try</span> {<br />            <span style="color: #008000; ">//</span><span style="color: #008000; ">原始h判断</span><span style="color: #008000; "><br /></span>            <span style="color: #0000FF; ">if</span> (requestPath.equalsIgnoreCase(checkCrtUrl)) {<br />                <span style="color: #008000; ">//</span><span style="color: #008000; ">当前是httpshQ但是依然不能得到证书信?转到止面<br />                </span><span style="color: #008000; ">//</span><span style="color: #008000; ">(要将止面加入到允许访问的配置文g中,不然会导致@环重定向)</span><span style="color: #008000; "><br /></span>                URIBroker uriBroker = uriBrokerService.getURIBroker("forbidden");<br />                rundata.setRedirectLocation(uriBroker.render());<br />            } <span style="color: #0000FF; ">else</span> {<br />                <span style="color: #008000; ">//</span><span style="color: #008000; ">转到证书验证面</span><span style="color: #008000; "><br /></span>                rundata.setRedirectLocation(noPermissionUriBroker.render() + "?done=" + rundata.getPathInfo());<br />            }<br />        } <span style="color: #0000FF; ">catch</span> (IOException e) {<br />            log.error("权限验证重定向出?, e);<br />        }<br />        <span style="color: #0000FF; ">return</span> <span style="color: #0000FF; ">new</span> BreakPipeline();</div><br /><div style="background-color:#eeeeee;font-size:13px;border:1px solid #CCCCCC;padding-right: 5px;padding-bottom: 4px;padding-left: 4px;padding-top: 4px;width: 98%;word-break:break-all"><!--<br /><br />Code highlighting produced by Actipro CodeHighlighter (freeware)<br />http://www.CodeHighlighter.com/<br /><br />--><span style="color: #008000; ">        //</span><span style="color: #008000; ">GetUserInfoValve.java</span><span style="color: #008000; "><br /></span>        Object user = rundata.getSession().getAttribute("userInfo");<br />        <span style="color: #0000FF; ">if</span> (user == <span style="color: #0000FF; ">null</span>) {<br />            SessionValue session = SessionHelper.getSessionValue(rundata);<br />            String email = session.getCropEmail();<br />            Employe employe = PersonInfoUtil.getPersonInfoByEmail(email);<br /><br />            <span style="color: #008000; ">//</span><span style="color: #008000; "> 写入cookie</span><span style="color: #008000; "><br /></span>            session.setEmployeeId(employe.getEmployeId());<br />            session.setName(employe.getName());<br />            session.setCropEmail(employe.getEmail());<br />            SessionHelper.saveSessionValue(rundata, session);<br />        }</div><br /> <pinit id="__huaban_Button" style="display: none; ">采集到花?/pinit><img src ="http://www.tkk7.com/josson/aggbug/365966.html" width = "1" height = "1" /><br><br><div align=right><a style="text-decoration:none;" href="http://www.tkk7.com/josson/" target="_blank">josson</a> 2011-12-09 16:09 <a href="http://www.tkk7.com/josson/archive/2011/12/09/365966.html#Feedback" target="_blank" style="text-decoration:none;">发表评论</a></div>]]></description></item><item><title>firefox中证书的使用http://www.tkk7.com/josson/archive/2011/12/09/365953.htmljossonjossonFri, 09 Dec 2011 05:54:00 GMThttp://www.tkk7.com/josson/archive/2011/12/09/365953.htmlhttp://www.tkk7.com/josson/comments/365953.htmlhttp://www.tkk7.com/josson/archive/2011/12/09/365953.html#Feedback1http://www.tkk7.com/josson/comments/commentRss/365953.htmlhttp://www.tkk7.com/josson/services/trackbacks/365953.html
Jailbreak [https://www.isecpartners.com/application-security-tools/jailbreak.html]Qwin32的一个小软gQ可以帮助我们导出IE证书Q用很单?br />1、windows环境Qxp\win7均可Q,以adminstratordQ?br />2、下载jailbreakQ解包后Q运行jailbreak.exeQ非jailbreak.mscQ;
3、导书:Certificates - Current User > 个h > 证书Q选所有Q务导出;


选择导出U钥?br />
4、在firefox中导入证书:选项 > 高 > 查看证书Q您的证书) > 导入(刚导书文?Q?br />
5、搞定?/div>