SSLServerSocket如何关闭renegotiation

要关闭 SSLServerSocket 的重新协商功能，可以在 SSLServerSocket 上调用 setEnabledCipherSuites() 方法，将其设置为不支持任何支持重新协商的密码套件。例如，可以使用以下代码禁用重新协商：

SSLServerSocket sslServerSocket = (SSLServerSocket) serverSocket;
String[] cipherSuites = sslServerSocket.getEnabledCipherSuites();
List<String> newCipherSuites = new ArrayList<>();
for (String cipherSuite : cipherSuites) {
    if (!cipherSuite.contains("_RENEGOTIATION_")) {
        newCipherSuites.add(cipherSuite);
    }
}
sslServerSocket.setEnabledCipherSuites(newCipherSuites.toArray(new String[0]));

该代码从 SSLServerSocket 中获取所有启用的密码套件，并将其遍历以查找包含“_RENEGOTIATION_”字符串的密码套件。对于不包含该字符串的密码套件，将其添加到新的密码套件列表中。最后，将新的密码套件列表设置回 SSLServerSocket 上，以禁用支持重新协商的密码套件。

相关问题

SSLServerSocket关闭RENEGOTIATION

如果您想关闭Java SSLServerSocket上的RENEGOTIATION，则可以使用以下代码：

SSLServerSocketFactory factory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket sslServerSocket = (SSLServerSocket) factory.createServerSocket(port);
sslServerSocket.setEnabledProtocols(new String[] {"TLSv1", "TLSv1.1", "TLSv1.2"});
sslServerSocket.setEnabledCipherSuites(new String[] {"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"});
sslServerSocket.setNeedClientAuth(true);
SSLParameters sslParams = new SSLParameters(new String[] {"TLSv1", "TLSv1.1", "TLSv1.2"}, new String[] {"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256", "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"});
sslParams.setEndpointIdentificationAlgorithm(null);
sslParams.setWantClientAuth(true);
sslServerSocket.setSSLParameters(sslParams);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);
sslServerSocket.setWantClientAuth(true);
sslServerSocket.setNeedClientAuth(true);
sslServerSocket.setEnableSessionCreation(true);
sslServerSocket.setUseClientMode(false);

这将设置SSLServerSocket仅接受TLSv1，TLSv1.1和TLSv1.2协议，使用支持的密码套件，并需要客户端证书验证。此外，还需要使用`setEndpointIdentificationAlgorithm(null)`来禁用服务器名称验证，从而避免TLS握手中的RENEGOTIATION。

SSLServerSocket如何关闭重新协商renegotiation

要关闭重新协商，可以使用 SSLParameters.setRenegotiationEnabled(false) 方法。该方法可用于禁用 SSL 重新协商，以增强安全性。重新协商是指 SSL 握手期间允许双方重新协商已经达成的协议参数，这可能会导致安全漏洞，因此关闭重新协商可以提高安全性。

具体实现可以参考以下代码：

SSLServerSocketFactory factory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket serverSocket = (SSLServerSocket) factory.createServerSocket(port);

SSLParameters params = serverSocket.getSSLParameters();
params.setRenegotiationEnabled(false);
serverSocket.setSSLParameters(params);

在以上代码中，我们首先获取默认的 SSLServerSocketFactory，然后创建一个 SSLServerSocket。接着，我们获取 SSLServerSocket 的 SSLParameters，将重新协商设置为 false，并将设置后的 SSLParameters 应用于 SSLServerSocket。这样就成功关闭了重新协商。