tornado平台中使用微信证书退款(https证书退款)( [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed解决)

 python  tornado平台中使用微信证书退款(https证书退款)( [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed解决)已关闭评论
9月 272016
 

使用tornado的httpclient做微信支付开发时,如果需要调用退款等需要证书验证的api时,可以使用下面的函数做证书验证:
(微信提供下载的证书文件有: apiclient_cert.p12, apiclient_cert.pem,apiclient_key.pem,rootca.pem)

from tornado import httpclient 
def get_response_httpclient_withcert(url,body,method, header = None, client_key=None, client_cert=None, ca_certs=None):
    http_client = httpclient.HTTPClient()
    request = httpclient.HTTPRequest(url, headers = header, body=body, method=method, client_key=client_key, client_cert=client_cert, connect_timeout=20.0, request_timeout=20.0)

    #如果出现类似“xxxxxx/tornado/iostream.py[line:1276] WARNING :SSL Error on 14 (‘x.x.x.x.’, 443): [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed (_ssl.c:590)”这样的错误,可以将ca_certs的参数也带上(即带上rootca.pem),使用下面的语句: 
    #request = httpclient.HTTPRequest(url, headers = header, body=body, method=method, client_key=client_key,     client_cert=client_cert, ca_certs=ca_certs, connect_timeout=20.0, request_timeout=20.0) 
    response = http_client.fetch(request)
    return response.body

调用举例:
module_path = os.path.dirname(__file__) 
client_cert_path = os.path.abspath(os.path.join(module_path, “../keys/apiclient_cert.pem”))
client_key_path = os.path.abspath(os.path.join(module_path, “../keys/apiclient_key.pem”))
 ca_certs_path = os.path.abspath(os.path.join(module_path, “../keys/rootca_wx.pem”))
resp = webRequrestUtil.get_response_httpclient_withcert(‘https://api.mch.weixin.qq.com/secapi/pay/refund’, “<xml> xxxxxxxxx</xml>”, “POST”, client_key=client_key_path, client_cert=client_cert_path, ca_certs=ca_certs_path)

 

6月 162015
 

好文章一起分享下:http://www.gaojinbo.com/openssl-%E7%94%9F%E6%88%90%E8%87%AA%E7%AD%BE%E8%AF%81%E4%B9%A6.html

要生成证书的目录下建立几个文件和文件夹,有./demoCA/ ./demoCA/newcerts/  ./demoCA/index.txt ./demoCA/serial,在serial文件中写入第一个序列号“01”

1.生成X509格式的CA自签名证书 
$openssl req -new -x509 -keyout ca.key -out ca.crt

 

2.生成服务端的私钥(key文件)及csr 文件 
$openssl genrsa -des3 -out server.key 1024 
$openssl req -new -key server.key -out server.csr

 

3.生成客户端的私钥(key文件)及csr文件 
$openssl genrsa -des3 -out client.key 1024 
$openssl req -new -key client.key -out client.csr

 

4.用生成的CA的证书为刚才生成的server.csr,client.csr文件签名 
$openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key 
$openssl ca -in client.csr -out client.crt -cert ca.crt -keyfile ca.key

 

5. 生成p12格式证书 
$openssl pkcs12 -export -inkey client.key -in client.crt -out client.pfx 
$openssl pkcs12 -export -inkey server.key -in server.crt -out server.pfx

 

6.生成pem格式证书 
有时需要用到pem格式的证书,可以用以下方式合并证书文件(crt)和私钥文件(key)来生成 
$cat client.crt client.key> client.pem 
$cat server.crt server.key > server.pem

 

7.PFX文件转换为X509证书文件和RSA密钥文件 
$openssl pkcs12 -in server.pfx -nodes -out server.pem 
$openssl rsa -in server.pem -out server2.key 
$openssl x509 -in server.pem -out server2.crt

 

这样生成服务端证书:ca.crt, server.key, server.crt, server.pem, server.pfx,客户端证书:ca.crt, client.key, client.crt, client.pem, client.pfx

6月 122015
 

生成keystore文件

keytool -genkey -alias test -keyalg RSA -keystore /key.store

RSA是一个既能用于数据加密也能用于数字签名的算法。
DSA(Digital Signature Algorithm,数字签名算法,用作数字签名标准的一部分),它是另一种公开密钥算法,它不能用作加密,只用作数字签名。DSA使用公开密钥,为接受者验证数据的完整性和数据发送者的身份。

提取证书的方法:
keytool -export -alias 别名 -keystore 文件名 -file 证书名称

但是我们无法通过KEYTOOL工具来提取私钥的..我们只能通过java的KeyStore类getEntry() 或者getKey()来提取私钥.

1. 导出私钥参考下面例子中的export方法

2. 怎么来验证提取的私钥是否正确呢 (因为公钥私钥必须成对出现,我们可以通过证书提取去公钥,然后用公钥加密,使用刚刚获得的私钥解密) ,参考代码中check方法

代码如下:

import java.io.File;
import java.io.FileInputStream;
import java.io.FileWriter;
import java.security.Key;
import java.security.KeyPair;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.PrivateKey;
import java.security.PublicKey;
import java.security.UnrecoverableKeyException;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;

import javax.crypto.Cipher;

import sun.misc.BASE64Encoder;

public class ExportPrivateKey {
private File keystoreFile;
private String keyStoreType;
private char[] password;
private String alias;
private File exportedFile;

public static KeyPair getPrivateKey(KeyStore keystore, String alias,
char[] password) {
try {
Key key = keystore.getKey(alias, password);
if (key instanceof PrivateKey) {
Certificate cert = keystore.getCertificate(alias);
PublicKey publicKey = cert.getPublicKey();
return new KeyPair(publicKey, (PrivateKey) key);
}
} catch (UnrecoverableKeyException e) {
} catch (NoSuchAlgorithmException e) {
} catch (KeyStoreException e) {
}
return null;
}

public void export() throws Exception {
KeyStore keystore = KeyStore.getInstance(keyStoreType);
BASE64Encoder encoder = new BASE64Encoder();
keystore.load(new FileInputStream(keystoreFile), password);
KeyPair keyPair = getPrivateKey(keystore, alias, password);
PrivateKey privateKey = keyPair.getPrivate();
String encoded = encoder.encode(privateKey.getEncoded());
FileWriter fw = new FileWriter(exportedFile);
fw.write(“—–BEGIN RSA PRIVATE KEY—–n”);
fw.write(encoded);
fw.write(“n”);
fw.write(“—–END RSA PRIVATE KEY—–“);
fw.close();
}

public void check(){
//通过证书,获取公钥
 CertificateFactory cf;
try {
cf = CertificateFactory.getInstance(“X.509”);
FileInputStream in = new FileInputStream(“/home/ouu/keystore/server.cer”);
//生成一个证书对象并使用从输入流 inStream 中读取的数据对它进行初始化。
Certificate c = cf.generateCertificate(in);
PublicKey publicKey = c.getPublicKey();

       KeyStore keystore = KeyStore.getInstance(keyStoreType);
BASE64Encoder encoder = new BASE64Encoder();
keystore.load(new FileInputStream(keystoreFile), password);
KeyPair keyPair = getPrivateKey(keystore, alias, password);
PrivateKey privateKey = keyPair.getPrivate();

//通过下面这段代码提取的私钥是否正确
String before = “asdf”;
       byte[] plainText = before.getBytes(“UTF-8”);
       Cipher cipher = Cipher.getInstance(“RSA/ECB/PKCS1Padding”);
       cipher.init(Cipher.ENCRYPT_MODE, publicKey);
       // 用公钥进行加密,返回一个字节流
       byte[] cipherText = cipher.doFinal(plainText);
       cipher.init(Cipher.DECRYPT_MODE, privateKey);
       // 用私钥进行解密,返回一个字节流
       byte[] newPlainText = cipher.doFinal(cipherText);
       System.out.println(new String(newPlainText, “UTF-8”)); 
       
       

       

} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}

public static void main(String args[]) throws Exception {
ExportPrivateKey export = new ExportPrivateKey();
export.keystoreFile = new File(
“/home/ouu/keystore/server.keystore”);
export.keyStoreType = “JKS”;
export.password = “123456”.toCharArray();
export.alias = “server”;
export.exportedFile = new File(“server.key”);
export.export(); //导出私钥匙
export.check();  //检测私钥正确性
}
}