在 Java 客户端接受服务器的自签名 ssl 证书 [英] Accept server's self-signed ssl certificate in Java client

问题描述

这看起来像是一个标准问题，但我在任何地方都找不到明确的方向.

It looks like a standard question, but I couldn't find clear directions anywhere.

我有 java 代码试图连接到可能带有自签名(或过期)证书的服务器.代码报如下错误:

I have java code trying to connect to a server with probably self-signed (or expired) certificate. The code reports the following error :

[HttpMethodDirector] I/O exception (javax.net.ssl.SSLHandshakeException) caught 
when processing request: sun.security.validator.ValidatorException: PKIX path 
building failed: sun.security.provider.certpath.SunCertPathBuilderException: 
unable to find valid certification path to requested target

据我所知，我必须使用 keytool 并告诉 java 允许此连接是可以的.

As I understand it, I have to use keytool and tell java that it's OK to allow this connection.

解决此问题的所有说明都假定我完全精通 keytool，例如

All instructions to fix this problem assume I'm fully proficient with keytool, such as

为服务器生成私钥并导入keystore

generate private key for server and import it into keystore

有大佬可以发详细的教程吗?

Is there anybody who could post detailed instructions?

我正在运行 unix，所以最好使用 bash 脚本.

I'm running unix, so bash script would be best.

不确定是否重要，但代码在 jboss 中执行.

Not sure if it's important, but code executed in jboss.

推荐答案

您在这里基本上有两个选择:将自签名证书添加到您的 JVM 信任库或将您的客户端配置为

You have basically two options here: add the self-signed certificate to your JVM truststore or configure your client to

从您的浏览器导出证书并将其导入您的 JVM 信任库(以建立信任链):

Export the certificate from your browser and import it in your JVM truststore (to establish a chain of trust):

<JAVA_HOME>\bin\keytool -import -v -trustcacerts
-alias server-alias -file server.cer
-keystore cacerts.jks -keypass changeit
-storepass changeit 

选项 2

禁用证书验证:

// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[] { 
    new X509TrustManager() {     
        public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
            return new X509Certificate[0];
        } 
        public void checkClientTrusted( 
            java.security.cert.X509Certificate[] certs, String authType) {
            } 
        public void checkServerTrusted( 
            java.security.cert.X509Certificate[] certs, String authType) {
        }
    } 
}; 

// Install the all-trusting trust manager
try {
    SSLContext sc = SSLContext.getInstance("SSL"); 
    sc.init(null, trustAllCerts, new java.security.SecureRandom()); 
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (GeneralSecurityException e) {
} 
// Now you can access an https URL without having the certificate in the truststore
try { 
    URL url = new URL("https://hostname/index.html"); 
} catch (MalformedURLException e) {
} 

请注意，我根本不推荐选项 #2.禁用信任管理器会破坏 SSL 的某些部分，并使您容易受到中间人攻击.首选选项 #1，或者更好的是，让服务器使用由知名 CA 签署的真实"证书.

Note that I do not recommend the Option #2 at all. Disabling the trust manager defeats some parts of SSL and makes you vulnerable to man in the middle attacks. Prefer Option #1 or, even better, have the server use a "real" certificate signed by a well known CA.

这篇关于在 Java 客户端接受服务器的自签名 ssl 证书的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！