ssl - 使用org.apache.commons.httpclient时如何忽略ssl认证？

Question

当我使用 Apache 包 commons-httpclient-3.1.jar 时，我尝试使用以下逻辑来避免 ssl 认证。

TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() {
                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                    return null;
                }
                public void checkClientTrusted(X509Certificate[] certs, String authType) {
                }
                public void checkServerTrusted(X509Certificate[] certs, String authType) {
                }
            }
        };

        // Install the all-trusting trust manager
        SSLContext sc = SSLContext.getInstance("SSL");
        sc.init(null, trustAllCerts, new java.security.SecureRandom());
        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

        // Create all-trusting host name verifier
        HostnameVerifier allHostsValid = new HostnameVerifier() {
            public boolean verify(String hostname, SSLSession session) {
                return true;
            }
        };

        // Install the all-trusting host verifier
        HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);

但不幸的是，我仍然有错误:Https 客户端证书认证错误:“javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException”

然后我选择了httpclient-4.3.3.jar，上面的逻辑并没有起作用，但是如果添加下面的逻辑，它就起作用了。

  httpClient.getConnectionManager().getSchemeRegistry().register(new Scheme("https", socketFactory, 443));

httpClient是DefaultHttpClient的实例，socketfactory的初始化方式:

   SSLContext ctx = SSLContext.getInstance("TLS");
   ctx.init(null, new TrustManager[] { xtm }, null);
   SSLSocketFactory socketFactory = new SSLSocketFactory(ctx);
   socketFactory.setHostnameVerifier(hostnameVerifier);             

看来Scheme Register是必须的。

但是对于包commons-httpclient-3.1.jar，scheme如何注册呢？

提前致谢!

Answer 1

经考察，以下方式可以满足要求。

Protocol easyhttps = new Protocol("https", (ProtocolSocketFactory)new EasySSLProtocolSocketFactory(), 443);
Protocol.registerProtocol("https", easyhttps);

EasySSLProtocolSocketFactory 在包 commons-httpclient-contrib-3.1.jar 中