Android X509TrustManager 应用拒绝谷歌播放

Question

应用程序运行良好，但在 Google Play Consol 中上传应用程序时出现以下错误

Vulnerability TrustManager To properly handle SSL certificate validation, change your code in the checkServerTrusted method of your custom X509TrustManager interface to raise either CertificateException or IllegalArgumentException whenever the certificate presented by the server does not meet your expectations. To confirm you’ve updated correctly, submit the updated version to the Developer Console and check back after five hours. If the app hasn’t been correctly upgraded, we will display a warning. For additional information and next steps, please see this Google Help Center article.

我使用了下面的 API 调用代码

    DefaultHttpClient client=null;
    try {
        SchemeRegistry schemeRegistry = new SchemeRegistry();
        // http scheme
        schemeRegistry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
        // https scheme
        schemeRegistry.register(new Scheme("https", new EasySSLSocketFactory(), 443));

        HttpParams mHttpParams = new BasicHttpParams();
        mHttpParams.setParameter(ConnManagerPNames.MAX_TOTAL_CONNECTIONS, 30);
        mHttpParams.setParameter(ConnManagerPNames.MAX_CONNECTIONS_PER_ROUTE, new ConnPerRouteBean(30));
        mHttpParams.setParameter(HttpProtocolParams.USE_EXPECT_CONTINUE, false);
        HttpProtocolParams.setVersion(mHttpParams, HttpVersion.HTTP_1_1);
        ClientConnectionManager cm = new ThreadSafeClientConnManager(mHttpParams, schemeRegistry);
        client = new DefaultHttpClient(cm, mHttpParams);
    } catch (Exception e) {
        e.printStackTrace();
        client = new DefaultHttpClient();
    }

我的url是基于HTTP的IP

我在下面使用了 X509TrustManager x509trustmanager-from-google trusting-all-certificates-using-httpclient

Answer 1

这是一个警告，您使用了不安全的 X509TrustManager 和空的 checkClientTrusted() 和 checkServerTrusted() 方法。这些方法假定检查客户端和服务器证书作为 HTTPS 契约(Contract)的一部分，并在给定的证书无效时抛出异常。通过将这些方法保留为空，您有点破坏了整个 HTTPS 安全性，因为您的代码几乎可以接受任何证书。例如，您的应用容易受到 a man in the middle attack 的攻击.这种空实现几乎与普通 HTTP 实现相同。

使用 SSLSocketFactory.getSocketFactory() 而不是 new EasySSLSocketFactory() 可以解决问题。您的应用连接的服务器必须具有有效的 CA 签名证书。