使用 HTTPS 混淆的 Java HTTP 发布 - javax.net.ssl.SSLException : hostname in certificate didn't match

Question

我正在使用 Apache HttpClient 在某个 url 上发送 https POST。

HttpClient httpClient = new DefaultHttpClient();
HttpPost httpPost = new HttpPost(url);
HttpResponse response = httpClient.execute(httpPost);

然后我得到:

javax.net.ssl.SSLException: hostname in certificate didn't match: <*.*.*.*> != <*.url 

现在经过搜索，我在stackoverflow上找到了解决方案:

HostnameVerifier hostnameVerifier = org.apache.http.conn.ssl.SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER;
SchemeRegistry registry = new SchemeRegistry();
SSLSocketFactory socketFactory = SSLSocketFactory.getSocketFactory();
socketFactory.setHostnameVerifier((X509HostnameVerifier) hostnameVerifier);
registry.register(new Scheme("https", socketFactory, 443));
SingleClientConnManager mgr = new SingleClientConnManager(client.getParams(), registry);
HttpClient httpClient = new DefaultHttpClient(mgr, client.getParams());
HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);

POST 成功完成。

但我不明白这里发生了什么! 我的连接仍然安全吗？这是正确的解决方案吗？如果不是，最好的解决方案是什么？

Answer 1

如果您不验证主机名，您就不会检查您正在与您打算与之交谈的实体交谈:它可能是 MITM。这与 disabling VERIFYHOST with Curl 是同一个问题， 例如。您可能还对 this question on Security.SE 感兴趣.

关于您最初的问题，证书中的主机名(或 IP 地址)需要与您要联系的主机名相匹配，即 URL 中的主机名。如果您使用的是 IP 地址，则该 IP 地址需要位于证书的主题备用名称中。 (参见 this question。)通常，使用名称比使用 IP 地址更容易，即使在 LAN 上也是如此。

编辑:考虑到您使用的是 Apache Http Client 4.0.2，release notes for 4.0.3说:

This is an emergency release fixing a critical regression in the SSL connection management code. HttpClient 4.0.2 release included an improved support for multihome hosts, which unfortunately had a bug causing the default SSL hostname verification logic to fail. An attempt to establish an SSL connection with HttpClient 4.0.2 can result in javax.net.ssl.SSLException: "hostname in certificate didn't match ..." error.