java - Android Java SSL 套接字 - AllowAllHostNameVerifier

Question

首先我想说我正在探索 SSL socket 的世界并且网上没有那么多资料，我已经浏览了 StackOverflow 上的大部分主题，但我仍然对 TrustManager 的概念感到困惑， keystore 、主机名 validator ... 所以我必须编写一个 Java 客户端(单向 SSL)以使用 SSL 连接某些服务器。 我正在制作三种行为，Android 的原生行为(我相信如果证书不受信任，它不会处理握手)。 一个朴素的，带有一个带有空 checkServerTrusted 函数的自定义 TrustManager。 现在我想使用 HostNameVerfier 来允许所有主机名。 但老实说，我有点迷路了，我已经搜索了好几天，但互联网上没有关于 android ssl 的好资料。 到目前为止，这是我的代码:

Naive custom TrustManager (empty checkServerTrusted)

SSLContext sslContext = SSLContext.getInstance("SSL");
TrustManager trustManagerNaive =    new X509TrustManager(){
        @Override
        public void checkClientTrusted(
                X509Certificate[] chain,
                String authType)
                throws CertificateException {
            // TODO Auto-generated method stub
        }

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            // TODO Auto-generated method stub
            return null;
        }

        @Override
        public void checkServerTrusted(
                X509Certificate[] chain,
                String authType)
                throws CertificateException {
            // TODO Auto-generated method stub
        }
    };

sslContext.init(null, new TrustManager[]{trustManagerNaive}, null);

SSLSocketFactory socketFactory = (SSLSocketFactory)sslContext.getSocketFactory();
SSLSocket socket = (SSLSocket)socketFactory.createSocket(host, Integer.parseInt(port_number_et.getText().toString()));

//Native Android behavior (does not accept any untrusted certificate)
SSLSocketFactory socketFactory = (SSLSocketFactory)SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket)socketFactory.createSocket(host, Integer.parseInt(port_number_et.getText().toString()));                      

Answer 1

这是一个带有“不可信”证书的运行示例:

KeyStore keyStore = KeyStore.getInstance("BKS");
InputStream in = getContext().getAssets().open(Constants.KEYSTORE_FILENAME);
keyStore.load(in, Constants.KEYSTORE_PASSWORD);
in.close();

SSLSocketFactory socketFactory = new SSLSocketFactory(keyStore);
socketFactory.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
SchemeRegistry registry = new SchemeRegistry();
registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
registry.register(new Scheme("https", socketFactory, 443));
BasicHttpParams basicHttpParams = new BasicHttpParams();
HttpProtocolParams.setVersion(basicHttpParams, HttpVersion.HTTP_1_1);
HttpProtocolParams.setContentCharset(basicHttpParams, HTTP.UTF_8);
ThreadSafeClientConnManager ccm = new ThreadSafeClientConnManager(basicHttpParams, registry);

httpClient = new DefaultHttpClient(ccm, basicHttpParams);

一些解释:

• 使用不受信任的证书创建 keystore
• 加载 keystore 并在 SSLSocketFactory 中设置它
• 将 hostnameVerifier 设置为 ALLOW_ALL_HOSTNAME_VERIFIER(因为证书不受信任)

然后您可以使用此 httpClient 进行 http 或 https 请求，如下所示:

httpClient.execute(httpGet, new BasicHttpContext());