java - 忽略过期的ssl证书

Question

URL myUrl = new URL("https://www.....");

SSL网站证书已过期.如何避免它并使URL()工作？

Answer 1

您应该构建一个TrustManager包装默认信任管理器,捕获CertificiateExpiredException并忽略它.

注意:如本答案所详述,这是否安全非常依赖于实现.特别是,在正确检查其他所有内容之后,它依赖于最后完成的日期验证.

这些方面的东西应该有效:

TrustManagerFactory tmf = TrustManagerFactory.getInstance(
    TrustManagerFactory.getDefaultAlgorithm());
// Initialise the TMF as you normally would, for example:
tmf.init((KeyStore)null); 

TrustManager[] trustManagers = tmf.getTrustManagers();
final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];

TrustManager[] wrappedTrustManagers = new TrustManager[]{
   new X509TrustManager() {
       public java.security.cert.X509Certificate[] getAcceptedIssuers() {
          return origTrustmanager.getAcceptedIssuers();
       }

       public void checkClientTrusted(X509Certificate[] certs, String authType) {
           origTrustmanager.checkClientTrusted(certs, authType);
       }

       public void checkServerTrusted(X509Certificate[] certs, String authType) {
           try {
               origTrustmanager.checkServerTrusted(certs, authType);
           } catch (CertificateExpiredException e) {}
       }
   }
};

SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, wrappedTrustManagers, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

CertificateException当证书出现问题时,信任管理员会抛出s(详见子类).具体到你想要捕捉/忽略的内容.您可能需要检查您确实需要验证的所有内容,或者您​​必须手动验证它.任何比这更放松的事情(特别是,没有做任何事情,因此不会抛出任何异常)将完全忽略证书验证和验证,这与使用匿名密码套件或忽略身份验证大致相同.这会破坏使用SSL/TLS的安全目的(而不是在到期日稍微灵活一点).