Nie można korzystać z interfejsu API Amazon S3 przez SSL?

Question

Próbuję użyć interfejsu API Amazon S3 do zaszyfrowania i przesłania pliku.

public class AmazonS3 { 

    String KmsId = "my_id_comes_here"; 

    private TransferManager getTransferManager() { 
     AWSCredentials awsCredentials = new ProfileCredentialsProvider().getCredentials(); 
     KMSEncryptionMaterialsProvider materialProvider = new KMSEncryptionMaterialsProvider(KmsId); 
     AmazonS3EncryptionClient s3Client = new AmazonS3EncryptionClient(awsCredentials, materialProvider, 
       new CryptoConfiguration().withKmsRegion(Regions.EU_CENTRAL_1)).withRegion(Regions.EU_CENTRAL_1); 
     s3Client.setEndpoint("s3.eu-central-1.amazonaws.com"); 
     TransferManager transferManager = new TransferManager(s3Client); 
     return transferManager; 
    } 

    public void upload(String bucket, String keyName, String filePath) 
      throws InterruptedException, NoSuchAlgorithmException, IOException, InvalidKeySpecException { 

     TransferManager transferManager = getTransferManager(); 
     // TransferManager processes all transfers asynchronously, so this call will return immediately. 
     Upload upload = transferManager.upload(bucket, keyName, new File(filePath)); 

     try { 
      // Or you can block and wait for the upload to finish 
      upload.waitForCompletion(); 
      System.out.println("Upload complete."); 
     } catch (AmazonClientException amazonClientException) { 
      System.out.println("Unable to upload file, upload was aborted."); 
      amazonClientException.printStackTrace(); 
     } 
    } 

Który działa dobrze, jeśli nie zdam mojeTruStore jako argumenty do mojej aplikacji.

Ale jeśli zainicjować mój wniosek z moim TruStore tak:

-Dspring.profiles.active="dev" -Djavax.net.debug=all -Djavax.net.ssl.trustStore=/usr/share/ca-certificates/anevis/java/activemq/client.ts -Djavax.net.ssl.trustStorePassword=changeit 

daje mi ten błąd:

com.amazonaws.AmazonClientException: Unable to execute HTTP request: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:516) 
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:317) 
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:3595) 
    at com.amazonaws.services.s3.AmazonS3Client.getObjectMetadata(AmazonS3Client.java:999) 
    at com.amazonaws.services.s3.transfer.TransferManager.doDownload(TransferManager.java:779) 
    at com.amazonaws.services.s3.transfer.TransferManager.download(TransferManager.java:691) 
    at com.anevis.documentengine.configuration.jms.AmazonS3.download(AmazonS3.java:57) 
    at com.anevis.documentengine.configuration.jms.S3UploadTest.testUpload(S3UploadTest.java:25) 
    at com.anevis.documentengine.configuration.jms.S3UploadTest.main(S3UploadTest.java:9) 
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:497) 
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:144) 
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) 
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) 
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) 
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) 
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509) 
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) 
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) 
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:914) 
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) 
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) 
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:535) 
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:403) 
    at com.amazonaws.http.conn.ssl.SdkTLSSocketFactory.connectSocket(SdkTLSSocketFactory.java:128) 
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177) 
    at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:304) 
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611) 
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446) 
    at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863) 
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) 
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:57) 
    at com.amazonaws.http.AmazonHttpClient.executeOneRequest(AmazonHttpClient.java:749) 
    at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:505) 
    ... 13 more 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) 
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) 
    at sun.security.validator.Validator.validate(Validator.java:260) 
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) 
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) 
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) 
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491) 
    ... 32 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:146) 
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131) 
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) 
    ... 38 more 

Jak można naprawić ten błąd?

Answer 1

Twój magazyn zaufania nie ma urzędu certyfikacji, który zabezpiecza interfejsy API AWS. Musisz utworzyć nowy magazyn zaufanych certyfikatów, który łączy client.ts z tymi, które są wymagane dla AWS. Najłatwiejszy sposób to scalenie client.ts z plikiem kluczy cacerts ze środowiska JRE.

przykład:

keytool -importkeystore -srckeystore client.ts -destkeystore combined.ts -srcstorepass changeit -deststorepass changeit 
keytool -importkeystore -srckeystore $JAVA_HOME/jre/lib/security/cacerts -destkeystore combined.ts -srcstorepass changeit -deststorepass changeit 

Następnie za pomocą combined.ts zamiast client.ts.

Answer 2

Dziękuję, mieliśmy podobny problem, ale poprawiłem nieco odpowiedź na nasz scenariusz.

Otrzymałem ten com.amazonaws.AmazonClientException: Nie można wykonać żądania HTTP: sun.security.validator.ValidatorException: PKIX budynek ścieżka nie powiodło się: sun.security.provider.certpath.SunCertPathBuilderException: nie można odnaleźć prawidłową ścieżkę certyfikacji na żądanie docelowy

wyjątek podczas próby połączenia z AmazonDynamoDB.

Kiedy przenieśliśmy naszą aplikację do HTTPS, zaczęliśmy otrzymywać ten błąd.

Rozwiązanie było takie samo, różnica polegała na tym, że zamiast klienta musiałem dodać certyfikat do cacerts, który został wygenerowany podczas migracji HTTPS.

keytool -importkeystore -srckeystore $ JAVA_HOME/jre/lib/security/cacerts -destkeystore test.p12 -srcstorepass changeit -deststorepass test;

Dzięki,