# 鍥藉瘑TLS璁捐鍜屽疄鐜� ## 鑳屾櫙 浜掕仈缃戜笂浼犺緭鐨勬暟鎹紝姣忔椂姣忓埢閮藉瓨鍦ㄧ潃琚獌鍚拰绡℃敼鐨勯闄╋紝 __SSL/TLS鍗忚__ 鍦ㄤ繚鎶ょ敤鎴� __鏁版嵁鏈哄瘑鎬с€佸畬鏁存€т互鍙婅韩浠介壌鍒玙_ 绛夋柟闈㈠彂鎸ヤ簡閲嶅ぇ浣滅敤銆傚浗闄呴€氱敤TLS鍗忚骞朵笉鍖呭惈涓浗鍥藉瘑灞€鎺ㄨ崘浣跨敤鐨勫晢鐢ㄥ瘑鐮佺畻娉� (鍗� __鍥藉瘑绠楁硶__ ) 濂椾欢锛岃€岀粷澶ч儴鍒嗙殑缂栫▼璇█鍘熺敓TLS瀹炵幇銆佺涓夋柟寮€婧怲LS瀹炵幇澶ч兘涓嶆敮鎸佸浗瀵嗗浠躲€傞殢鐫€鍥藉唴瀹夊叏鍚堣銆佽嚜涓诲彲鎺ф斂绛栫殑鎸囧紩锛� __鍥藉瘑TLS__ 鐨勯渶姹備篃瓒婃潵瓒婂ぇ锛屽挨鍏跺湪閲戣瀺銆佹斂鍔￠鍩熷凡鐒舵垚涓哄垰闇€銆備笌姝ゅ悓鏃讹紝鍥藉瘑鐩稿叧瀵嗙爜浜у搧澶у渚濇墭浜庣‖浠舵垨鑰呰姱鐗囷紝瀛樺湪浠锋牸鏄傝吹锛岄儴缃叉垚鏈珮锛岄儴鍒嗕腑灏忎紒涓氱敤鎴烽毦浠ユ壙鎷呯殑闂銆� 鍥藉瘑杞欢浜у搧瀛樺湪浠ヤ笅闂涔熸€ラ渶瑙ｅ喅锛� 1. 鏈舰鎴愬浗瀵嗘潈濞佸瘑鐮佸疄鐜板簱锛屽紑婧愮敓鎬佷笉娲昏穬 2. 鍥藉瘑TLS瀹炵幇涓嶅畬鍠勶紝鍚勮瑷€鐗堟湰鏀寔鐜扮姸鍙傚樊涓嶉綈銆� 鍥藉瘑绠楁硶濂椾欢鍖呮嫭 SM2 绛惧悕銆丼M2 闈炲绉板姞瀵嗐€丼M3 鏉傚噾鍑芥暟 (鍝堝笇)銆丼M4 瀵圭О鍔犲瘑锛屼互鍙婁竴涓浗瀵嗗瘑閽ュ崗鍟嗗崗璁€傝鍦ㄥ畨鍏ㄤ俊閬撲腑瀹屽叏浣跨敤鍥藉瘑绠楁硶锛屽TLS鍗忚瀹炵幇銆佷笌鍏剁浉鍏崇殑X509鍗忚瀹炵幇閮介渶瑕佸仛澶ч噺鐨勬敼閫犻€傞厤銆傚簲鐢ㄥ眰鐨勫崗璁� (GRPCS銆丠TTPS绛�) 鍦ㄥ疄鐜颁笂涔熼渶瑕佸仛鐩稿簲鐨勯€傞厤銆� 闀垮畨閾捐嚧鍔涗簬鎵撻€犲浗鍐呭畬鍏ㄨ嚜涓诲彲鎺у尯鍧楅摼锛屽惎鐢ㄥ叏鍥藉瘑绠楁硶锛屾敮鎸佸浗瀵員LS鎴愪负蹇呰闇€姹傘€� 鏈枃涓昏鍐呭锛� 1. 闀垮畨閾惧浗瀵嗘敮鎾戞暣浣撹璁℃€濊矾 2. 闀垮畨閾惧浗瀵員LS鏀寔鐜扮姸 3. 闀垮畨閾惧浗瀵嗘湭鏉ュ伐浣� ## 鏁翠綋璁捐鎬濊矾 __瀵嗙爜鎶€鏈痏_ 浣滀负闀垮畨閾惧簳灞傞噸瑕佹妧鏈箣涓€锛屽湪涓婚」鐩甤hainmaker-go锛宑a鏈嶅姟銆佷腑闂翠欢浠ュ強SDK涓兘鏈夋繁搴﹀簲鐢ㄣ€傞暱瀹夐摼鍦ㄦ暣浣撹璁′笂锛岀患鍚堣€冭檻浜� __绠楁硶鎬ц兘銆佹墿灞曟€с€佹爣鍑嗗寲__ 绛夋柟闈紝瀵嗙爜鐩稿叧缁勪欢濡備笅锛� <img loading="lazy" src="../images/TLS-design-principal.png" style="zoom:50%;" /> 1. 瀵嗙爜绠楁硶搴擄細鎻愪緵缁熶竴瀵嗙爜绠楁硶鎺ュ彛锛屾敮鎸佷笉鍚屽瘑鐮佺畻娉曚互鍙婂疄鐜扮殑鎵╁睍銆� 2. 瀵嗙爜鍗忚搴擄細鏀寔鏍囧噯TLS锛屽寘鎷浗闄呮爣鍑嗗拰鍥藉瘑鏍囧噯 3. 瀵嗙爜搴旂敤锛氶暱瀹夐摼瀵嗙爜鎶€鏈簲鐢ㄤ緷璧栦簬鈥滃瘑鐮佺畻娉曞簱鈥濆拰鈥滃瘑鐮佸崗璁簱鈥濓紝瑙ｈ€﹀叿浣撳疄鐜扮粏鑺傘€� ## TLS鏀寔鐜扮姸 闀垮畨閾惧悗绔湇鍔￠噰鐢� __Golang璇█__ 瀹炵幇锛岄€氳繃grpc瀵瑰鎻愪緵鍖哄潡閾炬湇鍔°€傜敓鎬佸伐鍏稴DK鏀寔Golang銆丣ava绛変笉鍚岃瑷€銆傜洰鍓嶄负姝紝闀垮畨閾惧凡缁忓畬鎴愪簡鍖哄潡閾炬湇鍔′笌瀹㈡埛绔疭DK锛屽尯鍧楅摼缃戠粶鑺傜偣涔嬮棿鐨� __鍙屽悜鍥藉瘑TLS閫氫俊__ 銆� 闀垮畨閾炬湇鍔¤皟鐢ㄤ互鍙婂浗瀵員LS鏀拺鍥惧涓嬶細 <img loading="lazy" src="../images/TLS-interconn-flow.png" style="zoom:50%;" /> 1. golang鏈嶅姟绔細搴曞眰鍩轰簬grpc閫氫俊锛屽叾涓璽ls鎻℃墜閲囩敤闀垮畨閾惧瘑鐮佸崗璁簱锛堟敮鎸佸浗瀵員LS浠ュ強鍥介檯TLS鍗忚锛� 2. golang瀹㈡埛绔細鍚屼笂 3. java瀹㈡埛绔細鐢变簬java璋冪敤闀垮畨閾緂olang瀵嗙爜鍗忚搴撴敮鎸佸浗瀵員LS锛屽伐浣滈噺杈冨ぇ骞朵笖缁存姢鍥伴毦锛屽疄鐜颁笂閲囩敤浜嗘瘮杈冩垚鐔熺殑netty-tcnative + 鍥藉瘑openssl鏂瑰紡銆� ### 瀵嗙爜绠楁硶搴� __闀垮畨閾惧瘑鐮佺畻娉曞簱__ 閲囩敤golang璇█瀹炵幇锛岀洰鍓嶆敮鎸佷富娴佸浗闄呭瘑鐮佺畻娉旳ES銆丷SA銆丒CC浠ュ強SHA绯诲垪绠楁硶锛屽苟宸茬粡鍏ㄩ潰鏀寔SM2銆丼M3浠ュ強SM4鍥藉瘑绠楁硶銆傚簳灞傚浗瀵嗗疄鐜扮洰鍓嶉噰鐢ㄤ簡tjfoc瀵嗙爜搴撱€� ### 瀵嗙爜鍗忚搴� __闀垮畨閾惧瘑鐮佸崗璁簱__ 鍖呭惈 __鍥藉瘑x509銆佸浗瀵員LS__ 锛屽苟鍏煎鍥介檯x509銆佸浗闄匱LS鏍囧噯銆� 鍥藉瘑TLS瀹炵幇搴撳寘鍚� __golang 鍥藉瘑tls__ 鍜� __java鍥藉瘑tls__ 涓や釜瀹炵幇銆� 1. golang鍥藉瘑tls锛氬湪golang鏍囧噯搴擄紙golang1.14鐗堟湰锛夊熀纭€涓婏紝澧炲姞浜哠M2绠楁硶銆丼M3绠楁硶銆佸浗瀵哫509浠ュ強SM2-SM3绠楁硶濂椾欢鏀寔锛屽苟鐙珛涓哄崟鐙殑鍥藉瘑鍗忚搴撱€� 2. java鍥藉瘑tls锛氬寘鍚浗瀵嗙畻娉曢儴鍒嗗拰鍥藉瘑TLS鍗忚涓や釜閮ㄥ垎銆� __鍥藉瘑绠楁硶閮ㄥ垎__ Java渚х敱 __Java鏍囧噯搴揅urveDB绫籣_ 鎻愪緵锛屽浗瀵嗛€氳繃鍙嶅皠鏈哄埗娉ㄥ叆鍒癑ava鏍囧噯搴擄紝鍥藉瘑绠楁硶瀹炵幇鑷富鐮斿彂锛岀鍚堝浗瀵嗙畻娉曟爣鍑嗐€� __鍥藉瘑TLS鍗忚__ 閮ㄥ垎涓昏鐢遍暱瀹夐摼 __鍥藉瘑openssl__ 鎻愪緵锛孞ava渚ч€氳繃鍙嶅皠鏈哄埗灏哠M3WithSM2鏍囪瘑娉ㄥ叆鍒皀etty ssl `io.netty.handler.ssl.ExtendedOpenSslSession` 鏀寔鐨勭鍚嶇畻娉� `LOCAL_SUPPORTED_SIGNATURE_ALGORITHMS` 鍒楄〃涓紝Java netty閫氳繃netty-tcnative璋冪敤openssl搴曞眰瀵嗙爜鍔熻兘銆傜洰鍓� __netty-tcnative__ 宸叉敮鎸乵acOS銆乴inux銆亀indows浠ュ強linux_aarch绛夊钩鍙帮紝骞跺湪闀垮畨閾綾hainmaker-java-sdk涓疄鐜颁簡 __骞冲彴鍏煎鎬_ 锛岀敤鎴峰彧瑕佷笅杞介暱瀹夐摼瀹樻柟java sdk灏卞彲浠ュ疄鐜板鎴风涓庨摼鐨勫浗瀵員LS閫氫俊锛屾棤闇€鍏冲績netty-tcnative鍥藉瘑鐨勮法骞冲彴闂銆� ### __鍥藉瘑openssl__ 闀垮畨閾剧殑鍥藉瘑openssl瀹炵幇鏄湪OpenSSL-1.1.1l鐨勫熀纭€涓婃敼閫犵殑銆侽penSSL 鍦� __1.1.1__ 鐗堟湰涓紩鍏ヤ簡鍥藉瘑绠楁硶鐨勫疄鐜帮紝浣嗘槸浠呬粎鎻愪緵浜嗙畻娉曟帴鍙ｏ紝娌℃湁鎶婂浗瀵嗙畻娉曞紩鍏ュ埌浠讳綍閫氫俊鍗忚涓幓鏀寔銆� 闀垮畨閾惧浗瀵唎penssl鎶婂浗瀵嗙畻娉曠殑鏀寔鍔犲叆鍒� __X509鍗忚__ 涓€備富瑕佸寘鎷細 1. 鎸塒KCS8鏍囧噯瀹炵幇SM2绉侀挜鐨勭紪鐮佸簭鍒楀寲锛� 2. 鎸塒KIX瀹氫箟鐨勫叕閽ョ紪鐮佹柟寮忓疄鐜癝M2绠楁硶鍏挜鐨勫簭鍒楀寲锛� 3. 瀹炵幇ECC缂栫爜鐨凷M2绛惧悕鐨勫簭鍒楀寲锛� 4. 灏哠M2绠楁硶銆丼M3绠楁硶銆丼M2-SM3绠楁硶濂椾欢銆丼M2鏇茬嚎鐨凮ID寮曞叆鍒癤509鐨勯€昏緫涓€� 瀹屾垚浜哫509鍗忚鐨勫浗瀵嗘敮鎸佸悗锛岃繘涓€姝ユ敼閫犱簡 __TLS鍗忚__ 锛屼富瑕佸寘鎷細 1. 鎶婂浗瀵嗙畻娉曞浠跺姞鍏ュ埌鏀寔鐨勫瘑鐮佺畻娉曞寘鍒楄〃涓紝浠ヤ緵server銆乧lient涓ょ杩涜绠楁硶濂椾欢鐨勫崗鍟� 2. 鍦‥CDSA瀵瑰簲鐨勫崗璁浠朵腑鍘绘敮鎸佷簡鍥藉瘑绠楁硶鐨勯€昏緫 3. 韬唤璁よ瘉闃舵锛屼娇鐢ㄦ敼閫犺繃鐨剎509鍗忚杩涜鍥藉瘑璇佷功楠岃瘉銆� ## 鏈潵宸ヤ綔 1. 鏀寔 __楂樻€ц兘鍥藉瘑搴揰_ 瀹炵幇锛氶暱瀹夐摼寮€婧愮殑鍥藉瘑绠楁硶搴撶洰鍓嶄粎鏀寔tjfoc涓€绉嶅疄鐜帮紝涓庡寳澶mssl浣跨敤C璇█瀹炵幇鐨勫瘑鐮佸簱鐩告瘮瀛樺湪鏁伴噺绾т笂鐨勫樊璺濄€傦紙宸插疄鐜帮紝鍙傝€�- [ChainMaker - 瀵嗙爜绠楁硶寮曟搸浠嬬粛鍜屼娇鐢ㄦ墜鍐宂(./瀵嗙爜绠楁硶寮曟搸.md) 锛� 2. 鏀寔 __鍥藉瘑鍙岃瘉涔_ 浣撶郴锛氱洰鍓嶉暱瀹夐摼鍥藉瘑TLS鍦ㄥ浗瀵嗚瘉涔︺€佸浗瀵嗙畻娉昐M2鍜孲M3涓婅繘琛屼簡鏀寔锛屽湪涓庢爣鍑嗗浗瀵哠SL浜掕仈浜掗€氫笂杩橀渶瑕佽繘涓€姝ユ敼杩涘拰瀹屽杽銆傦紙go璇█鐩稿叧缁勪欢宸插叏閮ㄦ敮鎸侊紝鍏朵粬璇█鏀寔涓€� 鍙傝€�- [ChainMaker - 璇佷功鐢熸垚宸ュ叿](../dev/CA璇佷功鏈嶅姟.md) 锛� ## 澶囨敞 1. 鐩墠闀垮畨閾惧凡缁忓湪v2.1.0鍙婁互涓婄増鏈敮鎸佸浗瀵員LS, SDK鍦板潃锛�<a href="https://git.chainmaker.org.cn/chainmaker/sdk-java" target="_blank"> chainmaker-sdk-java </a> 2. netty-tcnative鍥藉瘑jar鍖呭熀浜庨暱瀹夐摼鍥藉瘑openssl浠ュ強netty-tcnative鐨�2.0.39.Final鐗堟湰锛屾瀯寤烘祦绋嬪弬鑰� netty-tcnative瀹樻柟鍦板潃锛� <a href="https://netty.io/wiki/forked-tomcat-native.html" target="_blank">netty-tcnative wiki</a>