如何使Unirest（java）忽略证书错误

我正在使用Unirest（java版本）来发出GET和POST请求。但是我在访问SSL加密站点时遇到问题，因为我的程序在公司网络后面，网络管理员为我设置了防火墙映射。 例如， foobar.com映射到56.1.89.12:4444 。 但是当我向地址发出请求时，我会收到以下ssl证书错误：

 com.mashape.unirest.http.exceptions.UnirestException: javax.net.ssl.SSLException: hostname in certificate didn't match:  !=  at com.mashape.unirest.http.HttpClientHelper.request(HttpClientHelper.java:131) at com.mashape.unirest.request.BaseRequest.asString(BaseRequest.java:52) 

我看到Unirest已经提前配置使用自定义httpclient 。所以我使用

 Unirest.setHttpClient(MyHttpClient.makeClient()); HttpResponse res = null; try { res = Unirest.get(urlstr).asString(); } catch (UnirestException e) { e.printStackTrace(); } String jsonstr = res.getBody(); 

makeClient方法是：

 public static HttpClient makeClient(){ SSLContextBuilder builder = new SSLContextBuilder(); CloseableHttpClient httpclient = null; try { // builder.loadTrustMaterial(null, new TrustSelfSignedStrategy()); builder.loadTrustMaterial(null, new TrustStrategy(){ public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException { return true; } }); SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory( builder.build()); httpclient = HttpClients.custom().setSSLSocketFactory( sslsf).build(); System.out.println("custom httpclient called"); System.out.println(httpclient); } catch (NoSuchAlgorithmException e) { e.printStackTrace(); } catch (KeyStoreException e) { e.printStackTrace(); } catch (KeyManagementException e) { e.printStackTrace(); } return httpclient; } 

主要思想来自于Apache HttpClient 4.3中的忽略SSL证书

但仍然没有用。任何建议？

Answer 1

  SSLContext sslcontext = SSLContexts.custom() .loadTrustMaterial(null, new TrustSelfSignedStrategy()) .build(); SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext,SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); CloseableHttpClient httpclient = HttpClients.custom() .setSSLSocketFactory(sslsf) .build(); Unirest.setHttpClient(httpclient); 

这对我有用

Answer 2

这就是我最终解决了我的问题：

 public static HttpClient makeClient(){ SchemeRegistry schemeRegistry = new SchemeRegistry(); schemeRegistry.register(new Scheme("http", 80, PlainSocketFactory.getSocketFactory())); try { schemeRegistry.register(new Scheme("https", 443, new MockSSLSocketFactory())); } catch (KeyManagementException e) { e.printStackTrace(); } catch (UnrecoverableKeyException e) { e.printStackTrace(); } catch (NoSuchAlgorithmException e) { e.printStackTrace(); } catch (KeyStoreException e) { e.printStackTrace(); } ClientConnectionManager cm = new SingleClientConnManager(schemeRegistry); DefaultHttpClient httpclient = new DefaultHttpClient(cm); return httpclient; } 

我已经刮了一整天，我希望这可以帮助别人。

Answer 3

证书错误解决方案是几个地方的组合

• https://github.com/Mashape/unirest-java/issues/70 ，我开始了。
• http://literatejava.com/networks/ignore-ssl-certificate-errors-apache-httpclient-4-4/非常好的解释。
• http://www.baeldung.com/httpclient-ssl ，所有版本的解决方案。

和一个相对完整的例子。

 import java.security.KeyManagementException; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import javax.net.ssl.SSLContext; import javax.security.cert.CertificateException; import javax.security.cert.X509Certificate; import org.apache.http.client.HttpClient; import org.apache.http.conn.ssl.NoopHostnameVerifier; import org.apache.http.conn.ssl.TrustSelfSignedStrategy; import org.apache.http.impl.client.HttpClients; import org.apache.http.ssl.SSLContextBuilder; import com.mashape.unirest.http.HttpResponse; import com.mashape.unirest.http.JsonNode; import com.mashape.unirest.http.Unirest; import com.mashape.unirest.http.exceptions.UnirestException; public class XXX { private static HttpClient unsafeHttpClient; static { try { SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustSelfSignedStrategy() { public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException { return true; } }).build(); unsafeHttpClient = HttpClients.custom().setSSLContext(sslContext) .setSSLHostnameVerifier(new NoopHostnameVerifier()).build(); } catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) { e.printStackTrace(); } } public static HttpClient getClient() { return unsafeHttpClient; } public static void main(String[] args) { try { HttpClient creepyClient = RestUnirestClient.getClient(); Unirest.setHttpClient(creepyClient); HttpResponse response = Unirest.get("https://httpbin.org/get?show_env=1").asJson(); System.out.println(response.getBody().toString()); } catch (UnirestException e) { e.printStackTrace(); } } } 

Answer 4

不幸的是，Unirest没有本地方式来配置SSL，因此提供自定义HttpClient实例看起来是唯一的选择。 这是一个解决方案，它不使用已弃用的类（如’DefaultHttpClient’）并使用自签名证书：

 protected void prepareHttpsClient() { HttpClientBuilder clientBuilder = HttpClientBuilder.create(); try { String certificateStorage = <>; String certificatePassword = <>; SSLContext sslContext = SSLContexts.custom().loadTrustMaterial( new File(certificateStorage), certificatePassword.toCharArray(), new TrustSelfSignedStrategy()).build(); SSLConnectionSocketFactory sslFactory = new SSLConnectionSocketFactory(sslContext, new String[]{"TLSv1"}, null, SSLConnectionSocketFactory.getDefaultHostnameVerifier()); clientBuilder.setSSLSocketFactory(sslFactory); } catch (Exception e) { throw new IllegalArgumentException("Error configuring server certificates.", e); } HttpClient httpClient = clientBuilder.build(); Unirest.setHttpClient(httpClient); }