ssl - Apache HttpClient 自签名证书

Question

自签名证书是指未经证书颁发机构 (CA) 签名的证书。 JAVA 存储大部分 CA 的证书(此处为 jre/lib/security/cacerts)，因此如果您想使用 CA 签名的证书连接到 https 站点，则没有特殊代码。 (http 调用的相同代码可以工作)

基本上是这样

CloseableHttpClient httpclient = HttpClients.createDefault();
HttpGet httpGet = new HttpGet(https_url);
httpclient.execute(httpGet)

但是如果我们有一个自签名证书，那么我们就需要配置客户端并让它工作。否则我们会看到

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

javax.net.ssl.SSLPeerUnverifiedException: Host name 'localhost' does not match the certificate subject provided by the peer ...

如何为这种情况配置http客户端？

Answer 1

http 客户端 4.x

方法一

通过调试选项配置 TrustStrore

-Djavax.net.ssl.trustStore=/Users/amodpandey/.keystore

即使不传递密码(信任库的密码)，Java 也能够读取信任库

但即使在这之后你可能会面临

javax.net.ssl.SSLPeerUnverifiedException: Host name 'localhost' does not match the certificate subject provided by the peer ...

CloseableHttpClient httpClient =
  HttpClientBuilder.create()
        .setSSLHostnameVerifier(new HostnameVerifier() {              
          @Override
          public boolean verify(String arg0, SSLSession arg1) {
            return true;
          }
        })
        .build();

而且有效..

方法二

全部放在代码里

CloseableHttpClient httpClient =
  HttpClientBuilder.create()
        .setSslcontext(SSLContexts.custom().loadTrustMaterial(new File(Thread.currentThread().getContextClassLoader().getResource("keystore").getFile())).build())
        .setSSLHostnameVerifier(new HostnameVerifier() {              
          @Override
          public boolean verify(String arg0, SSLSession arg1) {
            return true;
          }
        })
        .build();

方法三

在使用连接管理器时

使用时忽略setSslcontext和setSSLHostnameVerifier

.setConnectionManager(connectionManager)

所以应该配置连接管理器

Files.copy(ClassLoader.getSystemResourceAsStream("keystore"), Paths.get(URI.create("file:/tmp/keystore")),
    StandardCopyOption.REPLACE_EXISTING);
Registry<ConnectionSocketFactory> socketFactoryRegistry =
    RegistryBuilder
        .<ConnectionSocketFactory>create()
        .register(
            "https",
            new SSLConnectionSocketFactory(SSLContextBuilder.create()
                .loadTrustMaterial(new File("/tmp/keystore")).build(),
                new HostnameVerifier() {
                  @Override
                  public boolean verify(String hostname, SSLSession session) {
                    return true;
                  }
                })).register("http", PlainConnectionSocketFactory.INSTANCE).build();

PoolingHttpClientConnectionManager connectionManager =
    new PoolingHttpClientConnectionManager(socketFactoryRegistry);

CloseableHttpClient httpClient =
    HttpClientBuilder.create()
        .setConnectionManager(connectionManager)
        .build();

注意事项

• -Djavax.net.debug=all 调试选项对于查看正在使用的证书非常有帮助

• SSLContext 使用文件，如果我们计划将证书与代码打包在一个 Jar 中，那么我们需要创建一个文件以将其传递给 File 对象(它不适用于 jar 中的文件)

  Files.copy(ClassLoader.getSystemResourceAsStream("keystore"),Paths.get(URI.create("file:/tmp/utskeystore")),StandardCopyOption.REPLACE_EXISTING)