标签: x509trustmanager

可以说我有这样的东西(客户端代码):

TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {

        @Override
        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
            return null;
        }

        @Override
        public void checkClientTrusted(
                java.security.cert.X509Certificate[] certs, String authType) {
        }

        @Override
        public void checkServerTrusted(
                java.security.cert.X509Certificate[] certs, String authType) {
        }
    }
};

SSLContext sslc = SSLContext.getInstance("TLS");
sslc.init(null, trustAllCerts, null);

SocketFactory sf = sslc.getSocketFactory();
SSLSocket s = (SSLSocket) sf.createSocket("127.0.0.1", 9124);

这段代码功能齐全,但我真的无法弄清楚,如何根据我在pem文件中提供的一个具体CA证书来验证服务器的证书.

所有证书都由我的自签名CA签名,它是我需要验证的CA(仅针对此证书).

每个答案都表示赞赏.

编辑:

回应jglouie(非常感谢你这样做 - 不能投票给你答案).

我创立了解决方案:

new X509TrustManager() {

        @Override
        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
            return null;
        }

        @Override
        public void …

com.android.volley.NoConnectionError: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

我在 19 到 24 的 api 上的 logcat 中收到此错误，并且我的应用程序中没有从服务器加载数据我搜索了该错误并找到了解决方案

 @SuppressLint("TrulyRandom")
public static void handleSSLHandshake() {
    try {
        TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
            public X509Certificate[] getAcceptedIssuers() {
                return new X509Certificate[0];
            }

            @Override
            public void checkClientTrusted(X509Certificate[] certs, String authType) {
            }

            @Override
            public void checkServerTrusted(X509Certificate[] certs, String authType) {
            }
        }};

        SSLContext sc = SSLContext.getInstance("SSL");
        sc.init(null, trustAllCerts, new SecureRandom());
        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
            @Override
            public boolean verify(String arg0, SSLSession …

在 OkHttp3 中，不推荐使用以下内容[A]：

    sslSocketFactory(SSLSocketFactory sslSocketFactory) 

它被替换为[B]：

    sslSocketFactory(SSLSocketFactory sslSocketFactory, X509TrustManager trustManager).

以下是我的问题：

• 有什么用的X509TrustManager在[B] ？

• 在创建SSLSocketFactory对象时已经可以指定 TrustManager 时，使用[B]而不是[A]的优点是什么？

• 在https://square.github.io/okhttp/3.x/okhttp/okhttp3/OkHttpClient.Builder.html#sslSocketFactory-javax.net.ssl.SSLSocketFactory- 他们谈到在使用[B]时避免反射，有人可以解释？

sslContext.init(KeyManager[] arg0, TrustManager[] arg1, SecureRandom arg2).

public SSLSocketFactory getSSLSocketFactory() {
  SSLContext sslContext = SSLContext.getInstance("TLS");
  sslContext.init(getKeyManager(), getTrustManager(), new SecureRandom());
  return sslContext.getSocketFactory();
}

sslSocketFactory(SSLSocketFactory sslSocketFactory, X509TrustManager trustManager) 

OkHttpClient okClient = …