java - 带有 netty 服务器 (SSLSocket) 的 Android 客户端

Question

我创建了一个非常简单的 Netty 安全聊天服务器，如教程所述，并开始使用:

SelfSignedCertificate ssc = new SelfSignedCertificate();

SslContext sslCtx = SslContext.newServerContext(ssc.certificate(), ssc.privateKey());`

之后，我创建了一个简单的 SSLSocket 来与它从 Android 手机进行通信。我通过另一个线程执行连接并将其配置如下:

protected SSLSocket getConnection(String ip, int port) throws IOException {
    try {
        KeyStore trustStore = KeyStore.getInstance("BKS");
        InputStream trustStoreStream = context.getResources().openRawResource(R.raw.server);
        trustStore.load(trustStoreStream, "myPassword".toCharArray());

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustManagerFactory.getTrustManagers(), null);

        SSLSocketFactory factory = sslContext.getSocketFactory();
        SSLSocket socket = (SSLSocket) factory.createSocket(ip, port);
        socket.setEnabledCipherSuites(SSLUtils.getCipherSuitesWhiteList(socket.getEnabledCipherSuites()));
        return socket;
    } catch (GeneralSecurityException e) {
        throw new IOException(e.getMessage());
    }
}

这样，我做了一个

sslsocket = getConnection(SERVERIP, SERVERPORT);

out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(sslsocket.getOutputStream())));

恰好在“out = ...”这一行抛出以下异常:

01-12 14:43:16.002: W/System.err(9979): javax.net.ssl.SSLHandshakeException: ?java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. 01-12 14:43:16.002: W/System.err(9979): at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:409) 01-12 14:43:16.012: W/System.err(9979): at com.android.org.conscrypt.OpenSSLSocketImpl$SSLOutputStream.(OpenSSLSocketImpl.java:706) 01-12 14:43:16.012: W/System.err(9979): at com.android.org.conscrypt.OpenSSLSocketImpl.getOutputStream(OpenSSLSocketImpl.java:643) 01-12 14:43:16.012: W/System.err(9979): at com.mypath.connector.TCPClient.run(TCPClient.java:106) 01-12 14:43:16.012: W/System.err(9979): at com.mypath.SplashActivity$connectTask.doInBackground(SplashActivity.java:48) 01-12 14:43:16.012: W/System.err(9979): at com.mypath.SplashActivity$connectTask.doInBackground(SplashActivity.java:1) 01-12 14:43:16.012: W/System.err(9979): at android.os.AsyncTask$2.call(AsyncTask.java:288) 01-12 14:43:16.012: W/System.err(9979): at java.util.concurrent.FutureTask.run(FutureTask.java:237) 01-12 14:43:16.012: W/System.err(9979): at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:231) 01-12 14:43:16.012: W/System.err(9979): at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112) 01-12 14:43:16.012: W/System.err(9979): at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587) 01-12 14:43:16.012: W/System.err(9979): at java.lang.Thread.run(Thread.java:841) 01-12 14:43:16.012: W/System.err(9979): Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. 01-12 14:43:16.012: W/System.err(9979): at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:282) 01-12 14:43:16.012: W/System.err(9979): at com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:202) 01-12 14:43:16.012: W/System.err(9979): at com.android.org.conscrypt.OpenSSLSocketImpl.verifyCertificateChain(OpenSSLSocketImpl.java:611) 01-12 14:43:16.012: W/System.err(9979): at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method) 01-12 14:43:16.012: W/System.err(9979): at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:405) 01-12 14:43:16.012: W/System.err(9979): ... 11 more 01-12 14:43:16.012: W/System.err(9979): Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. 01-12 14:43:16.012: W/System.err(9979): ... 16 more

有人知道我做错了什么吗？

Answer 1

出于开发目的，您可以对所有 TrustManager 使用信任。这种“解决方案”根本不安全。

 TrustManager tm = new X509TrustManager() {
            public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            }

            public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            }

            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };

最佳解决方案是: Trusting all certificates using HttpClient over HTTPS