android 自签名证书不起作用

Question

最近我使用本教程在 Apache Web 服务器中制作了一个自签名证书:

http://theheat.dk/blog/?p=1023&cpage=1

Web 服务需要证书才能打开。在浏览器中一切顺利。我导入了证书，网站将打开。

我从 rootCA.crt、client.crt、winter fell.crt 制作了 BKS 文件，但没有一个工作。
在 Android 中我得到

SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate No CAs known to server for verification?

apache 日志中的错误消息。

看来我的问题是关于发送到服务器的证书组合!在浏览器中我使用客户端和 rootCA，如何将它们组合起来发送到网络服务器？

我的代码:

  try {
        DefaultHttpClient httpclient = new MyHttpClient(getApplicationContext());
        HttpGet get = new HttpGet("https://xxx.xxx.xxx.xxx/index.php");

        try {
            HttpResponse response = httpclient.execute(get);
        } catch (ClientProtocolException e) {
            System.out.println(e.getMessage());
        } catch (IOException e) {
            System.out.println(e.getMessage());
        }
        return "OK";


    } catch (Exception err) {
        return "Err";
    }

和

public class MyHttpClient extends DefaultHttpClient {

final Context context;

public MyHttpClient(Context context) {
    this.context = context;
}

@Override
protected ClientConnectionManager createClientConnectionManager() {
    SchemeRegistry registry = new SchemeRegistry();
    // Register for port 443 our SSLSocketFactory with our keystore
    // to the ConnectionManager
    registry.register(new Scheme("https", newSslSocketFactory(), 443));
    return new SingleClientConnManager(getParams(), registry);
}

private SSLSocketFactory newSslSocketFactory() {
    try {
        // Get an instance of the Bouncy Castle KeyStore format
        KeyStore trusted = KeyStore.getInstance("BKS");
        // Get the raw resource, which contains the keystore with
        // your trusted certificates (root and any intermediate certs)
        InputStream in = context.getResources().openRawResource(R.raw.comb);
        try {
            // Initialize the keystore with the provided trusted certificates
            // Also provide the password of the keystore
            trusted.load(in, "mysecret".toCharArray());
        } finally {
            in.close();
        }

        // Pass the keystore to the SSLSocketFactory. The factory is responsible
        // for the verification of the server certificate.
        SSLSocketFactory sf = new SSLSocketFactory(trusted);
        // Hostname verification from certificate
        // http://hc.apache.org/httpcomponents-client-ga/tutorial/html/connmgmt.html#d4e506
        //sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
        HttpsURLConnection.setDefaultHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

        return sf;
    } catch (Exception e) {
        throw new AssertionError(e);
    }
}

非常感谢您的帮助!

Answer 1

使用下面给定的自定义 SSLSocketFactory 类。

public class AndroidSSLSocketFactory extends SSLSocketFactory {
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(
            "X509");
    public AndroidSSLSocketFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
        super(truststore);
        tmf.init(truststore);
        TrustManager[] trustManagers = tmf.getTrustManagers();
        final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];
        TrustManager tm = new X509TrustManager() {
            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                return origTrustmanager.getAcceptedIssuers();
            }

            @Override
            public void checkClientTrusted(
                    java.security.cert.X509Certificate[] chain, String authType)
                    throws CertificateException {
                origTrustmanager.checkClientTrusted(chain, authType);
            }

            @Override
            public void checkServerTrusted(
                    java.security.cert.X509Certificate[] chain, String authType)
                    throws CertificateException {
                origTrustmanager.checkServerTrusted(chain, authType);
            }
        };
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, new TrustManager[]{tm}, null);
    }
}

此类通过 X509 证书管理服务器与 Android 之间的传输层安全。

在您的 newSslSocketFactory() 方法中使用它。替换

SSLSocketFactory sf = new SSLSocketFactory(trusted);

与

SSLSocketFactory sf = new AndroidSSLSocketFactory(trusted);

希望对您有所帮助。

Info :- HttpClient is deprecated from Android 6.0, you should use HttpURLConnection instead.Link.

更新 1:-根据 this链接以便使用自签名证书您可以创建自己的 TrustManager。因此，请更改 TrustManager 代码。这可能会对 future 的用户有所帮助。