Android - Retrofit : java. security.cert.CertPathValidatorException:找不到证书路径的信任 anchor

Question

我试图在我的个人后端服务器上调用 API，但我收到此 SSL 错误响应。

如何让 Retrofit 忽略 SSL 错误？

谢谢，

2019-07-17 15:43:33.385 31394-31394/com.test E/com.test.site.ui.SiteFragment: getSitesList() - onFailure() Could not load sites list: 
    javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
        at com.android.org.conscrypt.ConscryptFileDescriptorSocket.startHandshake(ConscryptFileDescriptorSocket.java:229)
        at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.kt:351)
        at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.kt:310)
        at okhttp3.internal.connection.RealConnection.connect(RealConnection.kt:178)
        at okhttp3.internal.connection.ExchangeFinder.findConnection(ExchangeFinder.kt:236)
        at okhttp3.internal.connection.ExchangeFinder.findHealthyConnection(ExchangeFinder.kt:109)

应用.kt:

package com.test

import android.app.Application
import com.test.site.service.SiteService
import okhttp3.OkHttpClient
import okhttp3.logging.HttpLoggingInterceptor
import retrofit2.Retrofit
import retrofit2.converter.gson.GsonConverterFactory


class App : Application() {

    companion object {

        lateinit var instance: App

        // Create interceptor to get HTTP logs
        private val httpClient = OkHttpClient.Builder()
            .addInterceptor(HttpLoggingInterceptor())
            .build();

        // Create retrofit instance for whole application
        private val retrofit = Retrofit.Builder()
            .client(httpClient)
            .baseUrl("https://api.mydomain.com/")
            .addConverterFactory(GsonConverterFactory.create())
            .build()

        // Create siteService
        val siteService: SiteService = retrofit.create(SiteService::class.java)

    }

    override fun onCreate() {
        super.onCreate()
        instance = this
    }


}

Answer 1

I have the "pem" certificate of my backend server. How can I integrate this certificate with retrofit ?

您已经有一个自定义的 OkHttpClient。给它添加逻辑来教它about your custom SSL certificate .然后，由于 Retrofit 正在使用您的 OkHttpClient，Retrofit 将知道该 SSL 证书并且应该与您的服务器一起工作。

或者，将您的服务器切换为使用来自公认的根机构(例如，Let's Encrypt)的 SSL 证书。