我使用 JSOUP 连接到许多 https 网站。我使用方法 Jsoup.connect(url) ,但它抛出异常:
javax.net.ssl.SSLHandshakeException: Certificate not valid or trusted.
因此我使用此代码来信任所有证书 ssl:
public static void enableSSLSocket() throws KeyManagementException, NoSuchAlgorithmException {
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return null;
}
public void checkClientTrusted( java.security.cert.X509Certificate[] certs, String authType ) { }
public void checkServerTrusted( java.security.cert.X509Certificate[] certs, String authType ) { }
}
};
// Install the all-trusting trust manager
try {
SSLContext sc = SSLContext.getInstance( "SSL" );
sc.init( null, trustAllCerts, new java.security.SecureRandom() );
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
HttpsURLConnection.setDefaultHostnameVerifier(
new HostnameVerifier() {
public boolean verify(String urlHostName, SSLSession session) {
return true;
}
});
}
catch ( Exception e ) {
//We can not recover from this exception.
e.printStackTrace();
}}
但是因为我使用上面的代码,所以 play store 上有 goole 警告。
Your app is using an unsafe implementation of the X509TrustManager interface with an Apache HTTP client, resulting in a security vulnerability. Please see this Google Help Center article for details, including the deadline for fixing the vulnerability.
如果我添加这段代码:
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
try {
chain[0].checkValidity();
} catch (Exception e) {
throw new CertificateException("Certificate not valid or trusted.");
}
}
警告消失了,但 JSOUP 不工作不再工作,但出现相同的异常。 那么有没有办法信任所有的ssl并绕过谷歌警告呢?提前谢谢你。
最佳答案
我找到了解决方案,希望有人需要它:
public static void trustSSLCertificate(final Activity mActivity, final DownloadPortalTask task){
try {
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
public boolean verify(String hostname, SSLSession session) {
return true;
}
});
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, new X509TrustManager[]{new X509TrustManager() {
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
}
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
try {
chain[0].checkValidity();
} catch (final Exception e) {
mActivity.runOnUiThread(new Runnable() {
@Override
public void run() {
AlertDialog.Builder builder = new AlertDialog.Builder(mActivity);
AlertDialog alertDialog = builder.create();
alertDialog.setCancelable(false);
String message = "There a problem with the security certificate for this web site.";
message += "\nDo you want to continue anyway?";
alertDialog.setTitle("SSL Certificate Error");
alertDialog.setMessage(message);
alertDialog.setButton(DialogInterface.BUTTON_POSITIVE, "OK", new DialogInterface.OnClickListener() {
@Override
public void onClick(DialogInterface dialog, int which) {
acceptSSL = true;
return;
}
});
alertDialog.setButton(DialogInterface.BUTTON_NEGATIVE, "Cancel", new DialogInterface.OnClickListener() {
@Override
public void onClick(DialogInterface dialog, int which) {
acceptSSL = true;
task.onInterruptedDownload();
}
});
alertDialog.show();
}
});
while( !acceptSSL){
try{
Thread.sleep(1000);
} catch( InterruptedException er) { }
}
}
}
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
}
}}, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
} catch (Exception e) { // should never happen
e.printStackTrace();
}
}
在调用 Jsoup 之前调用此方法。 Google Play 上的 SSL 警告也消失了。
关于android - 绕过 google play 的 SSL 警告,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/36913633/