Java忽略证书验证

Question

我正在尝试创建一些连接到自签名HTTPS服务器的示例Java项目.我似乎无法让Java停止尝试验证证书.我不想相信这个证书,我只想完全忽略所有证书验证; 这个服务器在我的网络中,我希望能够运行一些测试应用程序而不必担心证书是否有效.

java -Dcom.sun.net.ssl.checkRevocation=false HelloWorld
org.apache.axis2.AxisFault: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:  sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

该-Dcom.sun.net.ssl.checkRevocation =假没有帮助.我还尝试添加以下代码:

public static void DisableCertificateValidation() {
  TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
      public X509Certificate[] getAcceptedIssuers() { return null; }
      public void checkClientTrusted(X509Certificate[] certs, String authType) { }
      public void checkServerTrusted(X509Certificate[] certs, String authType) { }
    }
  };
  try {
    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new java.security.SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
  } catch (Exception e) {
  }
}

但仍然有同样的问题.这里发生了什么？

Answer 1

org.apache.axis2.AxisFault表示您正在使用Axis 2,而Axis 2不用于HttpsURLConnection建立HTTP(S)连接,而是Apache HttpClient(据我所知3.x),因此HttpsURLConnection.setDefaultSSLSocketFactory(...)不会产生影响.

您可以查看有关为Axis 2 设置的答案SSLContext,更具体地说,请参阅此文档:http://axis.apache.org/axis2/java/core/docs/http-transport.html#httpsupport

(或者,您可以通过设置默认值SSLContext来实现SSLContext.setDefault(...),在Java 6中引入.在实际应用程序中,禁用证书验证的默认SSL上下文显然不是一个好主意.)