Android SSL HostName未经过验证 [英] Android SSL HostName Was Not Verified

问题描述

我有一个自签名服务器硬编码端口52428.即使我覆盖HostNameVerifier始终返回true，我的客户端应用仍然会收到主机名未经验证。当我将主机名从IP地址更改为DNS时，弹出另一个错误，显示无法解析主机：没有与主机名关联的地址

I have a self signed server hardcoded port 52428. My client app keeps getting "Hostname Was Not Verified" even when I override the HostNameVerifier to always return true. When I changed the hostname from IP Address to DNS, another error pops up that says "Unable to resolve host: No Address associated with hostname"

这是我的代码：

private class SSLConnect extends AsyncTask<Void, Void, String> {
    @Override
    protected String doInBackground(Void... values) {
        //String https_url = "https://www.google.com/";
        //String https_url = "https://192.168.0.106:52428/webserveradmin/preferences";
        String https_url = "https://home-pc:52428/webserveradmin/preferences/";
        String response;

        try {
            TrustManager[] tm = new TrustManager[]{
                new X509TrustManager() {
                    @Override
                    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {

                    }

                    @Override
                    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {

                    }

                    @Override
                    public X509Certificate[] getAcceptedIssuers() {
                        //return new X509Certificate[0];
                        return null;
                    }
                }
            };

            URL url;
            try {
                url = new URL(https_url);
            }
            catch (MalformedURLException e) {
                return "Error URL: " + e.getMessage();
            }

            HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
            try {
                conn.setDefaultHostnameVerifier(new NullHostNameVerifier());
                SSLContext sc = SSLContext.getInstance("SSL");
                sc.init(null, tm, new SecureRandom());
                conn.setSSLSocketFactory(sc.getSocketFactory());
                conn.setRequestMethod("GET");
                conn.setRequestProperty("Authorization", "Basic " + Base64.encode("sa:sa".getBytes(), Base64.DEFAULT));
                conn.connect();

                InputStream in = conn.getInputStream();
                BufferedReader r = new BufferedReader(new InputStreamReader(in));
                StringBuilder sb = new StringBuilder();
                String line;
                while ((line = r.readLine()) != null) {
                    sb.append(line);
                }
                response = sb.toString();

            } catch (GeneralSecurityException e) {
                return "Error Security: " + e.getMessage();
            }
        }
        catch(Exception e){
            return "Error SSL: " + e.getMessage();
        }
        return response;
    }

    @Override
    protected void onProgressUpdate(Void... values) {

    }

    @Override
    protected void onPostExecute(String result) {
        Toast.makeText(ctxt, result, Toast.LENGTH_LONG).show();
    }
}

public class NullHostNameVerifier implements HostnameVerifier{
    @Override
    public boolean verify(String hostname, SSLSession session) {
        return true;
    }
}

推荐答案

hostname verifier只关心验证主机名，而不关心验证信任链。但是，对于自签名证书，您没有信任链，导致本地信任的证书。

The hostname verifier cares about verifying the hostname only, not the trust chain. But with self-signed certificates you don't have a trust chain leading to a locally trusted certificate.

除此之外，只需禁用证书检查即可非常糟糕的想法，因为通过这种方式，您不仅可以接受自签名证书，还可以接受任何证书，因此您可以接受中间人攻击。另请参见 ******** VU中的SSL漏洞＃582497 。
要正确使用证书/公钥固定。有关更详细的说明以及示例代码，请参阅 OWSAP 。

Apart from that, just disabling the certificate checking is a very bad idea, because this way you will not only accept your self-signed certificate but instead any certificates and thus you will be open to man-in-the-middle attacks. See also SSL Vulnerability in ******** VU#582497. To do it correctly use instead certificate/public key pinning. For a more detailed explanation and also sample code see OWSAP.

这篇关于Android SSL HostName未经过验证的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！