java - 信任自签名证书时的 Android 应用程序 SSL 问题

Question

我的应用程序需要连接到我自己的服务器，所以我将我服务器的自签名证书添加到 KeyStore。它与我的服务器配合得很好，但问题是现在我的应用程序不接受所有其他证书!例如，如果我尝试连接到 https://maps.googleapis.com/我得到一个丢失的证书异常。我该如何解决这个问题？

这是我信任我的证书的方式:

public static void setSelfSignedCertSSLContext(AssetManager assets)
        throws Exception {
    // Load self-signed cert from an InputStream
    CertificateFactory cf = CertificateFactory.getInstance("X.509");
    InputStream caInput = assets.open("selfSigned.cer");
    Certificate ca;
    try {
        ca = cf.generateCertificate(caInput);
        Log.d(LOG_TAG, "ca=" + ((X509Certificate) ca).getSubjectDN());
    } finally {
        caInput.close();
    }

    // Create a KeyStore containing our trusted CAs
    String keyStoreType = KeyStore.getDefaultType();
    KeyStore keyStore = KeyStore.getInstance(keyStoreType);
    keyStore.load(null, null);
    keyStore.setCertificateEntry("ca", ca);

    // Create a TrustManager that trusts the CAs in our KeyStore
    String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
    tmf.init(keyStore);

    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory
            .getDefaultAlgorithm());
    kmf.init(keyStore, "changeit".toCharArray());

    // Create an SSLContext that uses our TrustManager
    SSLContext context = SSLContext.getInstance("TLS");
    SSLContext.setDefault(context);

    context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);
    HttpsURLConnection.setDefaultSSLSocketFactory(context
            .getSocketFactory());

    HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
        public boolean verify(String string, SSLSession ssls) {
            return true;
        }
    });

    Log.d(LOG_TAG, "SSLContext set successfully");
}

这是我尝试连接到 google 时遇到的异常:

06-29 23:27:59.181: E/AdapterClass(16358): javax.net.ssl.SSLHandshakeException: 
java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

Answer 1

您需要创建自定义 TrustManager，它具有本地(来自您的 KeyStore)TrustManager 和默认 TrustManager。当其中一个找不到证书时，另一个应该可以工作。

例如

public class MyTrustManager implements X509TrustManager {

    private X509TrustManager defaultTrustManager;
    private X509TrustManager localTrustManager;

    private X509Certificate[] acceptedIssuers;

    public MyTrustManager(KeyStore localKeyStore) { 
      // init defaultTrustManager using the system defaults
      // init localTrustManager using localKeyStore
    }

    public void checkServerTrusted(X509Certificate[] chain, String authType)
            throws CertificateException {
        try {
            defaultTrustManager.checkServerTrusted(chain, authType);
        } catch (CertificateException ce) {
            localTrustManager.checkServerTrusted(chain, authType);
        }
    }

    //...
}

来源:http://nelenkov.blogspot.com/2011/12/using-custom-certificate-trust-store-on.html

@edit

或者按照@CommonsWare 的建议，您可以使用他的 CWAC-Security 库。看起来很棒，但我还没有用过。