适用于 Android 的自签名证书和 loopj

Question

我正在尝试使用 loopj 发出 async HTTP 请求。效果很好，除非我尝试使用自签名证书访问 https 站点。我明白了

javax.net.ssl.SSLPeerUnverifiedException: No peer certificate.

我猜默认的 ssl 选项可以使用setSSLSocketFactory(SSLSocketFactory sslSocketFactory) 方法覆盖，但我不知道该怎么做，或者它可能根本不是正确的方法。

请建议我该如何解决这个问题？

Answer 1

在Https 和certificate 的帮助下，我在HttpsUrlConnection 和Portecle 两个文档的帮助下成功地做到了。

Answer 2

您的操作几乎与此处对 HttpClient 的说明完全相同，只是稍微简单一点 - Trusting all certificates using HttpClient over HTTPS

创建自定义类：

import java.io.IOException;
import java.net.Socket;
import java.net.UnknownHostException;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

import org.apache.http.conn.ssl.SSLSocketFactory;
public class MySSLSocketFactory extends SSLSocketFactory {
    SSLContext sslContext = SSLContext.getInstance("TLS");

    public MySSLSocketFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
        super(truststore);

        TrustManager tm = new X509TrustManager() {
            public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            }

            public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            }

            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };

        sslContext.init(null, new TrustManager[] { tm }, null);
    }

    @Override
    public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException, UnknownHostException {
        return sslContext.getSocketFactory().createSocket(socket, host, port, autoClose);
    }

    @Override
    public Socket createSocket() throws IOException {
        return sslContext.getSocketFactory().createSocket();
    }
}

然后当你创建你的客户端实例时：

try {
      KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
      trustStore.load(null, null);
      sf = new MySSLSocketFactory(trustStore);
      sf.setHostnameVerifier(MySSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
      client.setSSLSocketFactory(sf);   
    }
    catch (Exception e) {   
    }

Answer 3

您可以使用构造函数 AsyncHttpClient(boolean fixNoHttpResponseException, int httpPort, int httpsPort)。从版本 loopj 库 1.4.4 和更大。例如

mClient = new AsyncHttpClient(true, 80, 443);

并且您会在详细日志中收到警告消息给 logcat。

Beware! Using the fix is insecure, as it doesn't verify SSL certificates.

Answer 4

更简单的方法是在loopj中使用内置的MySSLSocketFactory，所以你不必创建另一个类

try {
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        trustStore.load(null, null);
        MySSLSocketFactory sf = new MySSLSocketFactory(trustStore);
        sf.setHostnameVerifier(MySSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
        client.setSSLSocketFactory(sf);
}
catch (Exception e) {}

Answer 5

正如许多地方所解释的那样，在很多层面上，绕过证书验证是错误的。不要那样做！

您应该做的是从您的证书创建.bks 文件（为此，您需要Bouncy Castle）：

keytool -importcert -v -trustcacerts -file "path/to/certfile/certfile.crt" -alias IntermediateCA -keystore "outputname.bks" -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath "path/to/bouncycastle/bcprov-jdk15on-154.jar" -storetype BKS -storepass atleastsix

接下来将您新创建的outputname.bks 放入res/raw 文件夹中。

创建辅助函数（可以在自己的类中或任何你喜欢的）：

private static SSLSocketFactory getSocketFactory(Context ctx) {
        try {
            // Get an instance of the Bouncy Castle KeyStore format
            KeyStore trusted = KeyStore.getInstance("BKS");
            // Get the raw resource, which contains the keystore with
            // your trusted certificates (root and any intermediate certs)
            InputStream in = ctx.getResources().openRawResource(R.raw.outputname); //name of your keystore file here
            try {
                // Initialize the keystore with the provided trusted certificates
                // Provide the password of the keystore
                trusted.load(in, "atleastsix".toCharArray());
            } finally {
                in.close();
            }
            // Pass the keystore to the SSLSocketFactory. The factory is responsible
            // for the verification of the server certificate.
            SSLSocketFactory sf = new SSLSocketFactory(trusted);
            // Hostname verification from certificate
            // http://hc.apache.org/httpcomponents-client-ga/tutorial/html/connmgmt.html#d4e506
            sf.setHostnameVerifier(SSLSocketFactory.STRICT_HOSTNAME_VERIFIER); // This can be changed to less stricter verifiers, according to need
            return sf;
        } catch (Exception e) {
            throw new AssertionError(e);
        }
    }

最后但同样重要的是，设置您的 AsyncHttpClient 以使用新的套接字工厂：

AsyncHttpClient client = new AsyncHttpClient();
client.setSSLSocketFactory(getSocketFactory(context));

Answer 6

不要 NUKE 所有 SSL 证书。信任所有证书是一种不好的做法！！！

• 只接受您的 SSL 证书。

看看我的解决方案。此 Gist 中的一些内容可以帮助您了解如何执行此操作。

OBS.：我正在使用 Android Volley。

https://gist.github.com/ivanlmj/f11fb50d35fa1f2b9698bfb06aedcbcd