java - 如何使用 Apache HTTPClient 忽略 SSL 证书错误但记录它

Question

关于如何使用 Apache HTTPClient 忽略 SSL 证书的示例有很多；我按照 this 创建了一个客户端所以回答。到目前为止，一切都很好。问题是，当证书无效时，客户会盲目接受它，就像我告诉它的那样。却又不想静静的接受；我想记录某种警告，让我知道已接受无效证书。

有什么办法吗？

P.S.:这是针对内部工具，而不是产品代码。我理解并接受忽略证书的风险，所以请不要开始“比你更神圣”的演讲。

Answer 1

这只是装饰传递给 SSLContext#init 方法的 X509TrustManager 实例的简单问题

static class TrustManagerDelegate implements X509TrustManager {

    private final X509TrustManager trustManager;

    TrustManagerDelegate(final X509TrustManager trustManager) {
        super();
        this.trustManager = trustManager;
    }

    @Override
    public void checkClientTrusted(
            final X509Certificate[] chain, final String authType) throws CertificateException {
        trustManager.checkClientTrusted(chain, authType);
    }

    @Override
    public void checkServerTrusted(
            final X509Certificate[] chain, final String authType) {
        try {
            trustManager.checkServerTrusted(chain, authType);
        } catch (CertificateException ex) {
            // Implement proper logging;
            System.out.println(chain[0]);
            ex.printStackTrace(System.out);
        }
    }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return trustManager.getAcceptedIssuers();
    }

}

...

TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmfactory.init((KeyStore) null);
final TrustManager[] tms = tmfactory.getTrustManagers();
if (tms != null) {
    for (int i = 0; i < tms.length; i++) {
        final TrustManager tm = tms[i];
        if (tm instanceof X509TrustManager) {
            tms[i] = new TrustManagerDelegate((X509TrustManager) tm);
        }
    }
}
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, tms, null);

CloseableHttpClient client = HttpClientBuilder.create()
        .setSSLContext(sslContext)
        .build();