【发布时间】：2020-05-29 17:30:44
【问题描述】：
我正在尝试在我的应用程序中进行 SSL Pinning，并按照https://developer.android.com/training/articles/security-ssl 上的说明进行操作，并在我的服务器https://coursescraper.tookmund.com/ 上使用https://www.digitalocean.com/community/tutorials/how-to-create-a-self-signed-ssl-certificate-for-nginx-in-ubuntu-16-04 生成我自己的证书
但是，当我尝试连接到我的服务器时出现异常：
javax.net.ssl.SSLPeerUnverifiedException: Hostname coursescraper.tookmund.com not verified:
certificate: sha1/Uax3JSsdPAGgCg5XyWPR8mhrjRU=
DN: CN=coursescraper.tookmund.com
subjectAltNames: []
然后我按照https://developer.android.com/training/articles/security-config 的规定向我的应用程序添加了网络安全配置
这允许我删除所有 SSLContext 内容，但仍会产生完全相同的错误。
我试图关闭主机名验证器只是为了看看会发生什么，但我得到了同样的错误，但没有在日志中看到 VERIFY，所以甚至不涉及主机名验证器：
// TODO: FIX THIS!!! THIS IS BAD!!!
connection.setDefaultHostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String s, SSLSession sslSession) {
Log.v("VERIFY", s);
return true;
}
});
当我将应用程序中的证书文件切换到另一个证书时，我得到了 SSLHandshakeException：
javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
因此，固定似乎可以正常工作，只是我的证书有问题。
Common Name 是域名，从错误中可以看出，所以我不确定自己做错了什么。
使用 curl 连接可以正常工作：
$ curl -v --cacert school/mobilesecCSCI420/nginx-selfsigned.crt https://coursescraper.tookmund.com
* Expire in 0 ms for 6 (transfer 0x558aada3ef50)
* Expire in 1 ms for 1 (transfer 0x558aada3ef50)
...
* Expire in 50 ms for 1 (transfer 0x558aada3ef50)
* Trying 54.165.223.53...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x558aada3ef50)
* Connected to coursescraper.tookmund.com (54.165.223.53) port 443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: school/mobilesecCSCI420/nginx-selfsigned.crt
CApath: /etc/ssl/certs
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use h2
* Server certificate:
* subject: CN=coursescraper.tookmund.com
* start date: Feb 13 05:51:45 2020 GMT
* expire date: Feb 12 05:51:45 2021 GMT
* common name: coursescraper.tookmund.com (matched)
* issuer: CN=coursescraper.tookmund.com
* SSL certificate verify ok.
* Using HTTP2, server supports multi-use
* Connection state changed (HTTP/2 confirmed)
* Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
* Using Stream ID: 1 (easy handle 0x558aada3ef50)
> GET / HTTP/2
> Host: coursescraper.tookmund.com
> User-Agent: curl/7.64.0
> Accept: */*
>
* Connection state changed (MAX_CONCURRENT_STREAMS == 128)!
< HTTP/2 200
< server: nginx/1.10.3
< date: Thu, 13 Feb 2020 16:35:28 GMT
< content-type: text/html
< content-length: 691
< last-modified: Sun, 09 Feb 2020 21:13:06 GMT
< etag: "5e4075e2-2b3"
< accept-ranges: bytes
<
<!DOCTYPE html>
<html>
...
【问题讨论】：
标签： android nginx https ssl-certificate self-signed