java - 忽略 Apache HTTPClient 4.5 中的自签名证书

Question

我正在尝试使用 Apache HTTPClient 4.5 版接受所有证书，和/或接受自签名证书(教程链接 here)

我一直在通过 SO 上的一堆帖子来解决这个问题。到目前为止，他们都没有工作。

我不断收到此错误:尝试执行请求时出错。 javax.net.ssl.SSLHandshakeException:握手期间远程主机关闭连接

Apache 文档:

• Apache v4.5 tutorial
• SSL/TLS customization
• Apache has a guide适用于版本 3，但不适用于版本 4。

相关 StackOverflow 问题 - 以下是我尝试过的解决方案的一些链接:

• Ignoring SSL certificate in Apache HttpClient 4.3
• How to ignore SSL certificate errors in Apache HttpClient 4.0
• Ignore SSL Certificate Errors with Java
• Need to trust all the certificates during the development using Spring
• How to handle invalid SSL certificates with Apache HttpClient?

请注意，在所有这些示例中，我还传递了一个 cookie 存储和一个我之前定义的代理凭据提供程序。这些都在工作，我只是想添加 SSL 支持。

尝试#1

使用 SSLContextBuilder 创建我自己的 ssl 上下文，并使用 TrustSelfSignedStrategy 信任所有自签名策略。

SSLContextBuilder sshbuilder = new SSLContextBuilder();
sshbuilder.loadTrustMaterial(null, new TrustSelfSignedStrategy());
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sshbuilder.build());

CloseableHttpClient httpclient = HttpClients.custom()
    .setDefaultCredentialsProvider(credsProvider)
    .setDefaultCookieStore(cookieStore)
    .setSSLSocketFactory(sslsf)
    .build();

结果:没有成功。尝试执行请求时出现 错误。 javax.net.ssl.SSLHandshakeException:握手期间远程主机关闭连接

尝试 #2

同上，但是添加了一个PoolingHttpClientConnectionManager

SSLContextBuilder builder = new SSLContextBuilder();
builder.loadTrustMaterial(null, new TrustSelfSignedStrategy());
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(builder.build(),SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory>create()
        .register("http", new PlainConnectionSocketFactory())
        .register("https", sslsf)
        .build();
PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(registry);
cm.setMaxTotal(2000);//max connection

CloseableHttpClient httpclient = HttpClients.custom()
    .setDefaultCredentialsProvider(credsProvider)
    .setDefaultCookieStore(cookieStore)
    .setSSLSocketFactory(sslsf)
    .setConnectionManager(cm)
    .build();

结果:没有成功。尝试执行请求时出现 错误。 javax.net.ssl.SSLHandshakeException:握手期间远程主机关闭连接

尝试#3

通过覆盖 TrustStrategy 简单地接受所有证书(不推荐这样做)

SSLContextBuilder builder = new SSLContextBuilder();
builder.loadTrustMaterial(null, new TrustStrategy() {
    @Override
    public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        return true;
    }
});
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(builder.build(),
    SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

CloseableHttpClient httpclient = HttpClients.custom()
    .setDefaultCredentialsProvider(credsProvider)
    .setDefaultCookieStore(cookieStore)
    .setSSLSocketFactory(sslsf)
    .build();

结果:没有成功。尝试执行请求时出现 错误。 javax.net.ssl.SSLHandshakeException:握手期间远程主机关闭连接

尝试#4

我从 this answer 中找到了一些有用的东西:

As of version 4.5 HttpClient disables SSLv3 protocol version by default

这是他给出的解决方案:

SSLContext sslcontext = SSLContexts.createSystemDefault();
SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(
        sslcontext, new String[] { "TLSv1", "SSLv3" }, null,
        SSLConnectionSocketFactory.getDefaultHostnameVerifier());

Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
        .register("http", PlainConnectionSocketFactory.INSTANCE)
        .register("https", sslConnectionSocketFactory)
        .build();
PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(socketFactoryRegistry);

httpclient = HttpClients.custom()
    .setDefaultCredentialsProvider(credsProvider)
    .setDefaultCookieStore(cookieStore)
    .setSSLSocketFactory(sslConnectionSocketFactory)
    .setConnectionManager(cm)
    .build();

结果:没有成功。尝试执行请求时出现 错误。 javax.net.ssl.SSLHandshakeException:握手期间远程主机关闭连接

Answer 1

我使用的是 Apache HttpClient 4.5.3，但上述解决方案均无济于事。我总是得到错误

PKIX Path building failed

.

我在 http://www.baeldung.com/httpclient-ssl 中找到了解决方案

这是我的代码:

try {
    SSLContext sslContext = new SSLContextBuilder()
            .loadTrustMaterial(null, (certificate, authType) -> true).build();
    httpClient = HttpClients.custom().setSSLContext(sslContext)
            .setSSLHostnameVerifier(new NoopHostnameVerifier())
            .build();
} catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
    e.printStackTrace();
}