android - 如何使用 Resttemplate 在 android 中使用 ssl pinning 验证 hsotnameverifyer

Question

我正在做一个银行应用程序，用于使用 HTTPs 安全地交互客户端和服务器，因为我必须使用 rest 模板在 android 中添加 SSL 固定。我检查了许多链接以获取重新模板代码，但它无法正常工作。这对于 Android 中的 SSL 固定是否正确？我在 Google.Developer.android 找到了这段代码

我已经在我的应用程序中添加了 cert 证书，但是如何与 restemplate 连接:

   CertificateFactory cf = CertificateFactory.getInstance("X.509");

            InputStream is  = ctx.getResources().openRawResource(R.raw.cedgenetbankingin); // Place your 'your_cert.crt' file in `res/raw`

            InputStream caInput = new BufferedInputStream(is);

            Certificate ca;
            try {
                ca = cf.generateCertificate(caInput);
                System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
            } finally {
                caInput.close();
            }

// Create a KeyStore containing our trusted CAs
            String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore = KeyStore.getInstance(keyStoreType);
            keyStore.load(null, null);
            keyStore.setCertificateEntry("ca", ca);

// Create a TrustManager that trusts the CAs in our KeyStore
            String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
            tmf.init(keyStore);

// Create an SSLContext that uses our TrustManager
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, tmf.getTrustManagers(), null);

            HostnameVerifier allHostsValid = new HostnameVerifier() {
                public boolean verify(String hostname, SSLSession session) {
                    Log.i("JJ","true--");
                    return true;
                }

            };
            HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
            HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());

注意:添加证书就够了吧？从原始文件夹我添加了 crt 文件。如果我对文件进行了一些更改，我会遇到异常，因此 resttemplate 不会调用。如果文件正确就意味着它可以正常工作？

再模板代码:

  RestTemplate restTemplate = new RestTemplate();
     //   RestTemplate restTemplate = new RestTemplate();
        try {
            restTemplate.getMessageConverters().add(new StringHttpMessageConverter());

            HttpHeaders headers = createHttpHeaders();


            HttpEntity<String> entity = new HttpEntity<>(str_encodedparams, headers);

            ResponseEntity<String> response = restTemplate.postForEntity(url, entity, String.class);

            System.out.println("Result - status (" + response.getStatusCode() + ") has body: " + response.hasBody());
            System.out.println(response.getBody());
            respo = response.getBody();
            System.out.println(respo);


        } catch (Exception eek) {

            eek.printStackTrace();
            System.out.println("** Exception: " + eek.getMessage());
        }

Answer 1

将证书锁定应用于 Android 应用的最佳方法是针对证书的公钥进行锁定，这允许您在后端轮换证书而无需发布新的移动应用版本，考虑到您使用同一个公钥。对于已泄露的证书，我们通常会提供备用 PIN，从而让您有时间发布新版本的移动应用。

我写了一篇文章Securing HTTPS with Certificate Pinning on Android采用这种方法并将网络安全配置文件与 TrustKit 结合使用包裹:

<?xml version="1.0" encoding="utf-8"?>
<network-security-config>

    <!-- Official Android N API -->
    <!--https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html-->
    <domain-config>
        <domain>currency-converter-demo.pdm.approov.io</domain>
        <trust-anchors>
            <!--<certificates src="user" />-->
            <certificates src="system" />
        </trust-anchors>
        <pin-set>
            <!-- Pin for: currency-converter-demo.pdm.approov.io -->
            <pin digest="SHA-256">qXHiE7hFX2Kj4ZCtnr8u8yffl8w9CTv6kE0U5j0o1XY=</pin>

            <!-- Backup Pin for: currency-converter-demo.pdm.approov.io -->
            <pin digest="SHA-256">47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=</pin>
        </pin-set>

        <!-- TrustKit Android API -->
        <!-- enforce pinning validation -->
        <trustkit-config enforcePinning="true" disableDefaultReportUri="true">
            <!-- Add a reporting URL for pin validation reports -->
            <report-uri>https://report.pdm.approov.io/pinning-violation/report</report-uri>
        </trustkit-config>
    </domain-config>

</network-security-config>

请阅读链接的文章以更好地理解所有内容如何组合在一起并查看示例演示。