java - 如何提示用户接受或拒绝 HTTPS 证书？

Question

我的 Android 应用程序使用 DefaultHttpClient API 向外部 HTTP 服务器发送请求。我在切换到 HTTPS 时遇到问题。

我的服务器使用自签名证书，默认情况下该证书显然不受信任。

当应用程序连接到服务器时，我想向用户显示服务器证书的指纹，并让他接受或拒绝该证书。

这可以通过 DefaultHttpClient 实现吗？如果是的话，我可以看一下显示它是如何完成的代码 fragment 吗？

我见过许多针对此问题和类似问题的假定解决方案，但没有一个对我有用。

Answer 1

我终于找到了一个可行的解决方案。这是 fragment :

public class MySocketFactory implements SocketFactory, LayeredSocketFactory {
private SSLContext mSslContext = null;

{
    try {
        mSslContext = SSLContext.getInstance("TLS");

        TrustManager trustManager = new X509TrustManager() {

            @Override
            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }

            @Override
            public void checkServerTrusted(X509Certificate[] chain, String authType)
                    throws CertificateException {
                // !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
                // NOTE : This is where we can calculate the certificate's fingerprint,
                // show it to the user and throw an exception in case he doesn't like it
            }

            @Override
            public void checkClientTrusted(X509Certificate[] chain, String authType)
                    throws CertificateException {
            }
        };

        mSslContext.init(null, new TrustManager[]{ trustManager }, new SecureRandom());
    } catch (Exception e) {
        e.printStackTrace();
    }
}

@Override
public Socket connectSocket(Socket socket, String host, int port,
        InetAddress localAddress, int localPort, HttpParams params)
                throws IOException, UnknownHostException, ConnectTimeoutException {

    int connTimeout = HttpConnectionParams.getConnectionTimeout(params);
    int soTimeout = HttpConnectionParams.getSoTimeout(params);

    SocketAddress socketAddress = new InetSocketAddress(localAddress, localPort);
    socket.bind(socketAddress);
    socket.connect(new InetSocketAddress(host, port), connTimeout);
    socket.setSoTimeout(soTimeout);

    return socket;
}

@Override
public Socket createSocket() throws IOException {
    return mSslContext.getSocketFactory().createSocket();
}

@Override
public boolean isSecure(Socket sock) throws IllegalArgumentException {
    return true;
}



@Override
public Socket createSocket(Socket socket, String host, int port,
        boolean autoClose) throws IOException, UnknownHostException {

    return mSslContext.getSocketFactory().createSocket(socket, host, port, autoClose);
}

}

然后你可以像这样实例化你的 DefaultHttpClient :

    HttpParams httpParameters = new BasicHttpParams();
    HttpConnectionParams.setConnectionTimeout(httpParameters, 5000);
    DefaultHttpClient result = new DefaultHttpClient(httpParameters);


    MySocketFactory mySocketFactory = new MySocketFactory();
    Scheme scheme = new Scheme("https", mySocketFactory, port);

    result.getConnectionManager().getSchemeRegistry().register(scheme);

我尝试了一下，确实有效!