java - 如何绕过 Java Web 服务客户端中的证书检查

Question

用例:有一个发布为 https://a.b.c.d/zz?wsdl 的 Web 服务

我想做的是查询这个 URI，如果我得到一个有效的 WSDL，我返回一个 boolean 值“true”，否则返回“false”。现在，如果我通过 Chrome 浏览器转到此 URL，我将不得不手动接受证书警告，然后下载 WSDL。但是如何通过 Java/HttpsURLConnection 做到这一点

import java.net.URL;
import java.io.*;
import javax.net.ssl.HttpsURLConnection;

public class JavaHttpsExample
{
  public static void main(String[] args)
  throws Exception
  {
    String httpsURL = "https://a.b.c.d/zz/V2.0/api?wsdl";
    URL myurl = new URL(httpsURL);
    HttpsURLConnection con = (HttpsURLConnection)myurl.openConnection();
    InputStream ins = con.getInputStream();
    InputStreamReader isr = new InputStreamReader(ins);
    BufferedReader in = new BufferedReader(isr);

    String inputLine;

    while ((inputLine = in.readLine()) != null)
    {
      System.out.println(inputLine);
    }

    in.close();
  }
}

我得到一个错误:

Exception in thread "main" javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names matching IP address a.b.c.d found at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source) at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source) at JavaHttpsExample.main(JavaHttpsExample.java:14) Caused by: java.security.cert.CertificateException: No subject alternative names matching IP address a.b.c.d found at sun.security.util.HostnameChecker.matchIP(Unknown Source) at sun.security.util.HostnameChecker.match(Unknown Source) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkIdentity(Unknown Source) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)

我已经用 a.b.c.d 替换了真实 IP(当然)

Answer 1

不要使用 stub 的 TrustManager，因为这会使您的应用程序信任所有人。我建议下载该站点提供的证书并将其添加到私有(private)的、受信任的 keystore 中。这样一来，您就可以为该网站破例，而无需为所有人​​开绿灯。

我也喜欢这种方法，因为它不需要更改代码。

在 Chrome 中，单击 url 左侧的锁定图标。然后点击“证书信息”。转到“详细信息”选项卡，然后单击“复制到文件”。将其作为“base64 编码的 X.509 (.cer)”保存到“SITENAME.cer”。

将 $JAVA_HOME/lib/security/cacerts 作为“mykeystore.jks”复制到您的应用程序目录。

安装证书:

keytool -keystore mykeystore.jks -storepass changeit -importcert -alias SITENAME -trustcacerts -file SITE.cer

现在，当您运行您的应用程序时，告诉它使用私有(private)证书存储:

java -Djavax.net.ssl.trustStore=mykeystore.jks ...