使用自签名证书的 Spray https 服务器的配置问题？

我在 Mac 10.9.4 上使用 Spray 1.3、Akka 2.3 和 Scala 2.11 来设置 HTTP 服务器。我正在关注 Ch. Manning 的 Akka in Action 中的 2 个示例（此处提供示例代码：https://github.com/RayRoestenburg/akka-in-action.git https://github.com/RayRoestenburg/akka-in-action.git），当我使用 http 时，它会按预期编译、运行和运行，但我在配置它以与 https 一起使用时遇到问题。

为了使用 https 运行，我生成了一个自签名证书，如下所示：

keytool -genkey -keyalg RSA -alias selfsigned -keystore myjks.jks -storepass abcdef -validity 360 -keysize 2048

按照这个例子，https://github.com/spray/spray/tree/v1.2-M8/examples/spray-can/simple-http-server/src/main/scala/spray/examples https://github.com/spray/spray/tree/v1.2-M8/examples/spray-can/simple-http-server/src/main/scala/spray/examples

我添加了一个 SSL 配置类：

package com.goticks

import java.security.{SecureRandom, KeyStore}
import javax.net.ssl.{KeyManagerFactory, SSLContext, TrustManagerFactory}
import spray.io._

// for SSL support (if enabled in application.conf)
trait MySSLConfig {

  // if there is no SSLContext in scope implicitly the HttpServer uses the default SSLContext,
  // since we want non-default settings in this example we make a custom SSLContext available here
  implicit def sslContext: SSLContext = { 
    val keyStoreResource = "myjks.jks"
    val password = "abcdef"

    val keyStore = KeyStore.getInstance("jks")
    keyStore.load(getClass.getResourceAsStream(keyStoreResource), password.toCharArray)
    val keyManagerFactory = KeyManagerFactory.getInstance("SunX509")
    keyManagerFactory.init(keyStore, password.toCharArray)
    val trustManagerFactory = TrustManagerFactory.getInstance("SunX509")
    trustManagerFactory.init(keyStore)
    val context = SSLContext.getInstance("TLS")
    context.init(keyManagerFactory.getKeyManagers, trustManagerFactory.getTrustManagers, new SecureRandom)
    context
  }

  // if there is no ServerSSLEngineProvider in scope implicitly the HttpServer uses the default one,
  // since we want to explicitly enable cipher suites and protocols we make a custom ServerSSLEngineProvider
  // available here
  implicit def sslEngineProvider: ServerSSLEngineProvider = { 
    ServerSSLEngineProvider { engine =>
      engine.setEnabledCipherSuites(Array("TLS_RSA_WITH_AES_256_CBC_SHA"))
      engine.setEnabledProtocols(Array("SSLv3", "TLSv1"))
      engine
    }   
  }
}

我已更新 Main 类以使用 SSL 配置：

package com.goticks

import akka.actor._
import akka.io.IO

import spray.can.Http
import spray.can.server._

import com.typesafe.config.ConfigFactory

object Main extends App with MySSLConfig {
  val config = ConfigFactory.load()
  val host = config.getString("http.host")
  val port = config.getInt("http.port")

  implicit val system = ActorSystem("goticks")

  val api = system.actorOf(Props(new RestInterface()), "httpInterface")
  IO(Http) ! Http.Bind(listener = api, interface = host, port = port)
}

我已经更新了 application.conf：

spray {
  can {
    server {
      server-header = "GoTicks.com REST API"
      ssl-encryption = on
    }
  }
}

编译并运行服务器后，当我尝试执行 https GET 时，出现以下错误：

[ERROR] [09/15/2014 10:40:48.056] [goticks-akka.actor.default-dispatcher-4] [akka://goticks/user/IO-HTTP/listener-0/7] Aborting encrypted connection to localhost/0:0:0:0:0:0:0:1%0:59617 due to [SSLHandshakeException:no cipher suites in common] -> [SSLHandshakeException:no cipher suites in common]

我不确定我的问题是与生成的密钥有关，还是与我的配置有关。顺便说一句，我的最终目标是将此配置与 TCP 套接字一起使用（请参阅我的其他问题：Scala 上的 TCP 套接字和 Akka 上的 SSL https://stackoverflow.com/questions/25797965/tcp-socket-with-ssl-on-scala-with-akka），但我无法找到运行安全 TCP 的文档，所以我想我应该从 HTTPS 开始。

任何帮助表示赞赏。

我终于能够使用它来工作阿帕奇骆驼 http://camel.apache.org/按照发现的建议here https://groups.google.com/d/msg/spray-user/Vtgtaf_duB8/ke5s1yRik7oJ。仅仅为了设置 SSLContext 就引入 Camel 似乎有点矫枉过正，但这就是最终起作用的方法。

我的 SSLConfig 最终看起来像这样：

import javax.net.ssl.SSLContext
import spray.io._
import org.apache.camel.util.jsse._

trait MySSLConfig {
    implicit def sslContext: SSLContext = {
        //val keyStoreFile = "/Users/eschow/repo/services/jks/keystore.jks"
        val keyStoreFile = "/Users/eschow/code/scala/akka-in-action/chapter2/myjks.jks"

        val ksp = new KeyStoreParameters()
        ksp.setResource(keyStoreFile);
        ksp.setPassword("abcdef")

        val kmp = new KeyManagersParameters()
        kmp.setKeyStore(ksp)
        kmp.setKeyPassword("abcdef")

        val scp = new SSLContextParameters()
        scp.setKeyManagers(kmp)

        val context= scp.createSSLContext()

        context
      }

    implicit def sslEngineProvider: ServerSSLEngineProvider = {
        ServerSSLEngineProvider { engine =>
            engine.setEnabledCipherSuites(Array("TLS_RSA_WITH_AES_256_CBC_SHA"))
            engine.setEnabledProtocols(Array("SSLv3", "TLSv1"))
            engine
        }
    }
}

顺便说一句，Camel 记录的错误更有帮助。做一些愚蠢的事情，例如提供通往梯形校正的错误路径或不正确的密码，会产生有意义的、人类可读的错误，而不是我之前看到的无声故障。