Proxy 가 적용된 네트워크 환경에서 java 코드를 이용해 Remote 사이트에 접속을 시도하는 경우 Remote site 의 인증서가 신뢰하는 인증기관 인증서 목록에 없으면 오류가 발생한다. 이런 경우 아래와 같이 인증서를 넣어주면 해결 할 수 있다.

1. 해당 내용을 복사하여 InstallCertProxy.java 파일로 만든다.

import java.io.BufferedReader;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.net.InetSocketAddress;
import java.net.Proxy;
import java.net.URL;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;

public class InstallCertProxy {

    public static void main(String[] args) throws Exception {

        String httpsUrl = null;
        String host;
        int port;
        char[] passphrase;
        if (args.length == 0) {
            httpsUrl = "https://www.google.com/";
            port = 443;
            host = "www.google.com";
            passphrase = "changeit".toCharArray();
        } else if ((args.length == 1) || (args.length == 2)) {
            String[] c = args[0].split(":");
            host = c[0];
            port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
            String p = (args.length == 1) ? "changeit" : args[1];
            passphrase = p.toCharArray();
            httpsUrl = "https://" + host;
            if (port != 443) {
                httpsUrl += ":" + port;
            }
        } else {
            System.out.println("Usage: java InstallCert [host:port] [passphrase]");
            return;
        }
        System.out.println("target: " + httpsUrl);
        File file = new File("jssecacerts");
        if (file.isFile() == false) {
            char SEP = File.separatorChar;
            File dir = new File(System.getProperty("java.home") + SEP + "lib"
                    + SEP + "security");
            file = new File(dir, "jssecacerts");
            if (file.isFile() == false) {
                file = new File(dir, "cacerts");
            }
        }
        System.out.println("Loading KeyStore " + file + "...");
        InputStream in = new FileInputStream(file);
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(in, passphrase);
        in.close();

        SSLContext context = SSLContext.getInstance("TLS");
        TrustManagerFactory tmf = TrustManagerFactory
                .getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(ks);
        X509TrustManager defaultTrustManager = (X509TrustManager) tmf
                .getTrustManagers()[0];
        SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
        context.init(null, new TrustManager[] { tm }, null);
        SSLSocketFactory factory = context.getSocketFactory();

        System.out
                .println("Opening connection to " + host + ":" + port + "...");

        String httpsProxyHost = System.getProperty("https.proxyHost");
        String httpsProxyPortStr = System.getProperty("https.proxyPort");

        int httpsProxyPort = httpsProxyPortStr != null ? Integer.parseInt(httpsProxyPortStr) : 8080;
        if (httpsProxyHost == null) {
            System.err.println("Please set your https proxy : example -Dhttps.proxyHost=proxy -Dhttps.proxyPort=80");
        }
        URL url = new URL(httpsUrl);
        Proxy p = new Proxy(Proxy.Type.HTTP, new InetSocketAddress(
                httpsProxyHost, httpsProxyPort));
        HttpsURLConnection conn = (HttpsURLConnection) url.openConnection(p);
        conn.setSSLSocketFactory(factory);
        conn.setConnectTimeout(3000); // 3 seconds.
        conn.setReadTimeout(3000); // 3 seconds
        conn.setRequestProperty("User-Agent",
                "Mozilla/5.0 (Windows NT 6.0; WOW64; rv:19.0) Gecko/20100101 Firefox/19.0");
        try {
            System.out.println("Starting SSL handshake...");
            conn.connect();
            System.out.println();
            System.out.println("No errors, certificate is already trusted");
        } catch (SSLException e) {
            System.out.println();
            e.printStackTrace(System.out);
        } finally {
            conn.disconnect();
        }

        X509Certificate[] chain = tm.chain;
        if (chain == null) {
            System.out.println("Could not obtain server certificate chain");
            return;
        }

        BufferedReader reader = new BufferedReader(new InputStreamReader(
                System.in));

        System.out.println();
        System.out.println("Server sent " + chain.length + " certificate(s):");
        System.out.println();
        MessageDigest sha1 = MessageDigest.getInstance("SHA1");
        MessageDigest md5 = MessageDigest.getInstance("MD5");
        for (int i = 0; i < chain.length; i++) {
            X509Certificate cert = chain[i];
            System.out.println(" " + (i + 1) + " Subject "
                    + cert.getSubjectDN());
            System.out.println("   Issuer  " + cert.getIssuerDN());
            sha1.update(cert.getEncoded());
            System.out.println("   sha1    " + toHexString(sha1.digest()));
            md5.update(cert.getEncoded());
            System.out.println("   md5     " + toHexString(md5.digest()));
            System.out.println();
        }

        System.out
                .println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
        String line = reader.readLine().trim();
        int k;
        try {
            k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
        } catch (NumberFormatException e) {
            System.out.println("KeyStore not changed");
            return;
        }

        X509Certificate cert = chain[k];
        String alias = host + "-" + (k + 1);
        ks.setCertificateEntry(alias, cert);

        OutputStream out = new FileOutputStream(file); 
        ks.store(out,passphrase); 
        out.close();
        
        System.out.println();
        System.out.println(cert);
        System.out.println();
        System.out
                .println("Added certificate to keystore " + file.getAbsolutePath() + " using alias '"
                        + alias + "'");
    }

    private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

    private static String toHexString(byte[] bytes) {
        StringBuilder sb = new StringBuilder(bytes.length * 3);
        for (int b : bytes) {
            b &= 0xff;
            sb.append(HEXDIGITS[b >> 4]);
            sb.append(HEXDIGITS[b & 15]);
            sb.append(' ');
        }
        return sb.toString();
    }

    private static class SavingTrustManager implements X509TrustManager {

        private final X509TrustManager tm;
        private X509Certificate[] chain;

        SavingTrustManager(X509TrustManager tm) {
            this.tm = tm;
        }

        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
            // throw new UnsupportedOperationException();
            // src: http://infposs.blogspot.nl/2013/06/installcert-and-java-7.html
        }

        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            throw new UnsupportedOperationException();
        }

        public void checkServerTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            this.chain = chain;
            tm.checkServerTrusted(chain, authType);
        }
    }
}

2. java 파일 내용중 Proxy 정보를 수정한다

String httpsProxyHost = System.getProperty("https.proxyHost"); String httpsProxyPortStr = System.getProperty("https.proxyPort");

 String httpsProxyHost = "10.10.10.10";
 String httpsProxyPortStr = "8080";

3. cmd 창에서 파일을 컴파일 한다.

javac InstallCertProxy.java

4. cmd 창에서 컴파일 된 파일에 remote 사이트 정보를 넣어서 실행한다.

java –cp ./ InstallCertProxy start.spring.io