java - 在没有证书的情况下发出 HTTPS 请求在桌面上不起作用

Question

我必须访问 Https API。它工作与Postman以及Android Asynchronous Http Client配合得很好。图书馆。

但是当我在桌面 java 应用程序上尝试它时，它只是说:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.servlet.ServletException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target com.sun.jersey.spi.container.servlet.WebComponent.service(WebComponent.java:420) com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:558) com.sun.jersey.spi.container.servlet.ServletContainer.service(ServletContainer.java:733) javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)

我的非工作桌面代码:

HttpURLConnection con;
            String response;
            try {
                con = (HttpURLConnection) new URL(LOGIN_URL).openConnection();
                con.setDoOutput(true);
                con.setRequestMethod("GET");
                OutputStream os = con.getOutputStream(); //throws error
                os.flush();
                return "200";
            } catch (Exception e) {
                e.printStackTrace();
                return e.toString();
            }

我的Android工作代码:

AsyncHttpClient client = new AsyncHttpClient();
            RequestParams rp = new RequestParams();
            client.get("LOGIN_URL", rp, new AsyncHttpResponseHandler() {

                @Override
                public void onSuccess(int statusCode, Header[] headers, byte[] response) {
                    
                    return new String(response); //works
                }

            });

所以，我的问题是:如果可以让它在 Android 上运行，为什么不使用 Apache HttpComponents 或 HttpURLConnection 方法？

是否有任何库可以让我无需安装任何证书就可以像在 Android 上一样工作？出于多种原因，我只想信任网络服务而不需要它。

Answer 1

您需要将根链添加到 CA 证书文件中，以便 java 可以验证自签名证书。

Postman 信任您在浏览器中明确信任的证书。

要更新您的 CA 证书文件，您需要找到它，因为您可能已经安装了 JDK，您要查找的文件很可能位于 JDK 的 JRE 文件夹中。 ./jdk1.8/jre/lib/security/cacerts

要将证书添加到您的信任存储区，请使用 keytool(如果 java 位于您的环境路径上)，首先运行此命令，其中 example.der 是您的证书。我鼓励您也给它一个更好的别名。

keytool -import -alias example -keystore/path/to/cacerts -file example.der

系统将提示您输入密码 javas 默认值为 changeit 输入密码，并在询问您是否信任该证书时输入 yes。

添加证书后，您可以再次使用 keytool 列出 keystore 中的所有证书，系统将再次提示您输入密码。

keytool -list -v -keystore/path/to/cacerts

当我运行这个命令时，我得到了一个列表；您应该能够找到别名为 example 的证书。这恰好是我列表中的第一个。

Alias name: digicertglobalrootca [jdk]
Creation date: 26 Aug. 2016
Entry type: trustedCertEntry

Owner: CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Issuer: CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US
Serial number: 83be056904246b1a1756ac95991c74a
Valid from: Fri Nov 10 10:00:00 AEST 2006 until: Mon Nov 10 10:00:00 AEST 2031
Certificate fingerprints:
     SHA1: A8:98:5D:3A:65:E5:E5:C4:B2:D7:D6:6D:40:C6:DD:2F:B1:9C:54:36
     SHA256: 43:48:A0:E9:44:4C:78:CB:26:5E:05:8D:5E:89:44:B4:D8:4F:96:62:BD:26:DB:25:7F:89:34:A4:43:C7:01:61
Signature algorithm name: SHA1withRSA
Subject Public Key Algorithm: 2048-bit RSA key
Version: 3

您已更新您的问题以包含您想要忽略证书...

Please don't ignore certificate errors. Deal with them instead. Ignoring certificate errors opens the connection to potential MITM attacks. It's tempting to say it's only for test code, it won't end up in production, but we all know what happens when the deadline approaches: the code doesn't show any error when tested -> we can ship it as it is.

现在我知道你无论如何都要这么做 - 所以here是一些相关代码。

// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
            return null;
        }
        public void checkClientTrusted(
            java.security.cert.X509Certificate[] certs, String authType) {
        }
        public void checkServerTrusted(
            java.security.cert.X509Certificate[] certs, String authType) {
        }
    }
};

// Install the all-trusting trust manager
try {
    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new java.security.SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
}

// Now you can access an https URL without having the certificate in the truststore
try {
    URL url = new URL("https://hostname/index.html");
} catch (MalformedURLException e) {
}