那些遇到过的问题

需要帮助识别和修复 SSLPeerUnverifiedException

abi*_*964 4 java ssl

我正在尝试向 TLS 服务器发布默认和自定义密钥库。在执行执行时获得 CloseableHttpClient 实例后

CloseableHttpResponse response1 = client.execute(postMethod);
Run Code Online (Sandbox Code Playgroud)

这给了我javax.net.ssl.SSLPeerUnverifiedException: Certificate for <hostname.domain.com> doesn't match any of the subject alternative names: []上面一行的例外。

下面是我准备客户端实例的类

public class ClientelUtil {

    public static CloseableHttpClient getHttpClient(String scheme,SSLContext sslContext) {
        HttpClientBuilder clientBuilder = HttpClients.custom();
        CloseableHttpClient client = null;
        if ("https".equalsIgnoreCase(scheme)) {
            SSLConnectionSocketFactory sFactory = new SSLConnectionSocketFactory(sslContext);
            final Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory>create()
                    .register("http", new PlainConnectionSocketFactory()).register("https", sFactory).build();

            final PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(registry);

            clientBuilder = HttpClients.custom().setSSLSocketFactory(sFactory)
                    .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE)
                    .setConnectionManager(cm);
        }
        client = clientBuilder.build();
        return client;

    }

    public static CloseableHttpClient getHttpClient(String scheme) {
        return getHttpClient(scheme, getSSLContext());

    }

    public static CloseableHttpClient getHttpClientWithoutTLSValidation(String scheme) {
        return getHttpClient(scheme, getSSLContextWithoutValidation());

    }

    public static SSLContext getSSLContextWithoutValidation() {
        SSLContext sslContext=null;
        try {
            sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() {
                public boolean isTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {
                    return true;
                }
            }).build();
        } catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
            e.printStackTrace();
        }
        return sslContext;
    }

    public static SSLContext getSSLContext() {
        SSLContext sslContext=null;
        try {
            JKSInfo jksInfo = JKSUtil.getTrustStoreInfo();
            sslContext = HttpSSLUtil.getSSLContext(jksInfo.getJksPath(), jksInfo.getJksPassword());
        } catch (HttpSSLException e) {
            e.printStackTrace();
        }
        return sslContext;
    }

}
Run Code Online (Sandbox Code Playgroud)

这是我在我的程序中使用上述课程的地方

public String post(String host,int port,Map<String,String> data) {

    CloseableHttpClient client = null;
    String response = null;
    String protocol = HTTP;
    try{
        if( isServerSSLEnabled() ){ //returns a boolean tru or false. In this case it is true
            protocol = HTTPS;
        }
        client = ClientelUtil.getHttpClient(protocol);
        //RequestConfig requestConfig = RequestConfig.custom().setCircularRedirectsAllowed(true).build();
        URIBuilder builder = new URIBuilder()
                    .setScheme(protocol)
                    .setHost(host).setPort(port)
                    .setPath(CONNECT_URI);

        URI uri = builder.build();

        HttpPost postMethod = new HttpPost(uri);
        //postMethod.setConfig(requestConfig);
        logger.debug("Sending request on host [" + host +"], port ["+ port+"], Protocol ["+ protocol + "] connectURI ["+CONNECT_URI+"]");


        addRequestHeaders(postMethod);
        ArrayList<NameValuePair> postParameters = new ArrayList<NameValuePair>();
        try {
            for(Map.Entry<String,String> entry : data.entrySet()) {
                postParameters.add(new BasicNameValuePair(entry.getKey(),entry.getValue()));
            }
            postMethod.setEntity(new UrlEncodedFormEntity(postParameters));
            CloseableHttpResponse response1 = client.execute(postMethod);       // <-- SSLPeerUnverifiedException at this point
            response = EntityUtils.toString(response1.getEntity());
        } catch (IOException e) {
            logger.error("Error while running the scenario on node host [" + host+"]",e);
        } finally{
            postMethod.releaseConnection();
        }
    } catch (URISyntaxException e1) {
        e1.printStackTrace();
    }finally {
        if(client!=null)
            try {
                client.close();
            } catch (IOException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
    }
    return response;
}
Run Code Online (Sandbox Code Playgroud)

我为此使用了 apache http 客户端 4.5，请帮助确定这里出了什么问题。

CN=FQDN在getSSLContext我NoopHostnameVerifier.INSTANCE用来创建的方法中使用的密钥库中也需要HttpClientBuilder？

谢谢

更新

我创建了一个新的信任库文件Common Name (e.g. server FQDN or YOUR name) []:作为我的主机名，之后上面的代码就可以工作了（现在我使用主机名来访问我的服务器代码而不是上面我的问题中提到的hostname.domain.com）。

现在我的问题是，以防万一CN| Common Name信任库文件中不存在是否可以使用上述代码中的一些修改进行验证？请建议。再次感谢。

更新

发布完整的堆栈跟踪。在主机名验证程序的情况下返回 true 是否是一个好习惯，以便它忽略主机名验证并在生产中没有提供 CN 或 SAN 的情况下工作（请告诉我何时可以使用它，否则）？

javax.net.ssl.SSLPeerUnverifiedException: Certificate for <hostname.domain.com> doesn't match any of the subject alternative names: []
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.verifyHostname(SSLConnectionSocketFactory.java:467)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:397)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:359)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)
    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)
    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)
    at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
    at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)
    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
    at com.code.app.myapp.utils.HttpUtil.post(HttpUtil.java:102)
    at com.code.app.myapp2.RequestDispatcher.dispatchRequest(RequestDispatcher.java:61)
    at com.code.app.chain.commands.FetchDiagnosticsInfo.executeOperation(FetchDiagnosticsInfo.java:82)
    at com.informatica.tools.ui.isomorphic.DSCommand.execute(DSCommand.java:45)
    at com.code.app.chain.commands.BaseDSCommand.execute(BaseDSCommand.java:59)
    at com.informatica.tools.ui.isomorphic.RPCCommand.execute(RPCCommand.java:43)
    at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:166)
    at com.informatica.tools.ui.isomorphic.RPCController.execute(RPCController.java:97)
    at com.code.app.ui.IsomorphicController.execute(IsomorphicController.java:115)
    at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:166)
    at org.apache.struts.chain.commands.ExecuteCommand.execute(ExecuteCommand.java:70)
    at org.apache.struts.chain.commands.ActionCommandBase.execute(ActionCommandBase.java:51)
    at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:166)
    at org.apache.commons.chain.generic.LookupCommand.execute(LookupCommand.java:175)
    at org.apache.commons.chain.impl.ChainBase.execute(ChainBase.java:166)
    at org.apache.struts.chain.ComposableRequestProcessor.process(ComposableRequestProcessor.java:283)
    at org.apache.struts.action.ActionServlet.process(ActionServlet.java:1913)
    at org.apache.struts.action.ActionServlet.doPost(ActionServlet.java:462)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:650)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at com.code.app.ui.security.UserIdentifierFilter.doFilter(UserIdentifierFilter.java:352)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at com.code.app.ui.i18n.InfEncodingFilter.doFilter(InfEncodingFilter.java:156)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at com.code.app.config.InfSessionTimeoutManagerFilter.doFilter(InfSessionTimeoutManagerFilter.java:79)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at com.code.app.ui.security.ResponseHeaderFilter.doFilter(ResponseHeaderFilter.java:26)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:110)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:615)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:445)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1115)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:637)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)
Run Code Online (Sandbox Code Playgroud)

use*_*421 5

这是服务器证书或 DNS 映射的问题，而不是您的代码。您连接到的服务器名称不存在于它提供的 SSL 证书中。

您不应该寻找不安全的解决方法，例如空 HTTPS 主机名验证程序。

归档时间：

查看次数：

4306 次

最近记录：

8 年，5 月 前
相关归档
Java:静态vs内部类 355
如何从Jackson中的自定义反序列化器调用默认反序列化器 92
ProcessBuilder:转发stdout和stderr启动进程而不阻塞主线程 88
在哪里可以找到多种语言的正则表达式的单元测试？ 77
抛出RuntimeException的方法是否应该在方法签名中指明它？ 74
"final int i"如何在Java for循环中工作？ 60
卷曲错误：无法路由到主机 7
Rails:设计宝石是否安全？ 6
在AWS ELB应用程序负载平衡器中启用HSTS 6
如何在eclipse中将服务器证书添加到java应用程序中 2
难疑归档
如何测试空的JavaScript对象？ 2730
在Git中只提交文件的一部分 2629
C++ 11引入了标准化的内存模型.这是什么意思？它将如何影响C++编程？ 1810
为什么++ [[]] [+ []] + [+ []]返回字符串"10"？ 1613
Git如何处理符号链接？ 1515
类型检查:typeof,GetType还是？ 1435
如何获取所有Git分支 1371
为什么在允许某些Unicode字符的注释中执行Java代码？ 1326
如何使用AngularJS在浏览器控制台中访问$ scope变量？ 1220
哪个MySQL数据类型用于存储布尔值 1168