Android 2.3：HttpClient SSL证书问题：中间证书缺少BasicConstraints

Question

我在使用 this method 解决使用 HttpClient 4 遇到的“javax.net.ssl.SSLPeerUnverifiedException：无对等证书”异常时遇到了问题。然而，这导致了以下 javax.net.ssl.SSLHandshakeException ：java.security.cert.CertPathValidatorException：

System.err  W  javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Intermediate certificate lacks BasicCon
               straints
System.err  W   at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:477)
System.err  W   at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl$SSLInputStream.<init>(OpenSSLSocketImpl.java:750)
System.err  W   at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.getInputStream(OpenSSLSocketImpl.java:692)
System.err  W   at org.apache.http.impl.io.SocketInputBuffer.<init>(SocketInputBuffer.java:93)
System.err  W   at org.apache.http.impl.SocketHttpClientConnection.createSessionInputBuffer(SocketHttpClientConnection.java:83)
System.err  W   at org.apache.http.impl.conn.DefaultClientConnection.createSessionInputBuffer(DefaultClientConnection.java:170)
System.err  W   at org.apache.http.impl.SocketHttpClientConnection.bind(SocketHttpClientConnection.java:106)
System.err  W   at org.apache.http.impl.conn.DefaultClientConnection.openCompleted(DefaultClientConnection.java:129)
System.err  W   at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:171)
System.err  W   at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164)
System.err  W   at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119)
System.err  W   at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:359)
System.err  W   at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555)
System.err  W   at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487)
System.err  W   at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465)
System.err  W   at com.example.activities.AuthTest.onCreate(AuthTest.java:69)
System.err  W   at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1047)
System.err  W   at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:1722)
System.err  W   at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:1784)
System.err  W   at android.app.ActivityThread.access$1500(ActivityThread.java:123)
System.err  W   at android.app.ActivityThread$H.handleMessage(ActivityThread.java:939)
System.err  W   at android.os.Handler.dispatchMessage(Handler.java:99)
System.err  W   at android.os.Looper.loop(Looper.java:130)
System.err  W   at android.app.ActivityThread.main(ActivityThread.java:3835)
System.err  W   at java.lang.reflect.Method.invokeNative(Native Method)
System.err  W   at java.lang.reflect.Method.invoke(Method.java:507)
System.err  W   at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:847)
System.err  W   at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:605)
System.err  W   at dalvik.system.NativeStart.main(Native Method)
System.err  W  Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Intermediate certificate
                lacks BasicConstraints
System.err  W   at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:161)
System.err  W   at com.example.models.EasyX509TrustManager.checkServerTrusted(EasyX509TrustManager.java:80)
System.err  W   at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.verifyCertificateChain(OpenSSLSocketImpl.java:664)
System.err  W   at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
System.err  W   at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:474)
System.err  W   ... 28 more
System.err  W  Caused by: java.security.cert.CertPathValidatorException: Intermediate certificate lacks BasicConstraints
System.err  W   at org.bouncycastle.jce.provider.RFC3280CertPathUtilities.prepareNextCertK(RFC3280CertPathUtilities.java:2127)
System.err  W   at org.bouncycastle.jce.provider.PKIXCertPathValidatorSpi.engineValidate(PKIXCertPathValidatorSpi.java:384)
System.err  W   at java.security.cert.CertPathValidator.validate(CertPathValidator.java:197)
System.err  W   at org.apache.harmony.xnet.provider.jsse.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:156)
System.err  W   ... 32 more

我通过注释掉 EasyX509TrustManager.java 中的以下 else 块来解决 那个：

public void checkServerTrusted( X509Certificate[] certificates, String authType )
    throws CertificateException
{
    if ( ( certificates != null ) && ( certificates.length == 1 ) )
    {
        certificates[0].checkValidity();
    }
    //else
    //{
    //    standardTrustManager.checkServerTrusted( certificates, authType );
    //}
}

瞧！ 一切正常。问题是我真的不知道“中间证书缺少 BasicCosntraints”异常是什么意思，或者如果注释掉 else 块会引入我可能信任无效证书的安全风险。

原来的 SSLPeerUnverifiedException 在 Android 2.1 或 2.2 上都没有发生，所以这似乎只是 Android 2.3+ 上的问题。

有人可以帮我理解该异常的确切含义吗？如果这是一个安全风险，我将如何着手解决这个问题？

Answer 1

基本约束指定一个证书是否可以颁发其他证书（它是证书颁发机构吗；从技术上讲，它的公钥可以签署其他证书），以及它颁发的证书是否可以反过来颁发其他证书（链长可以是谁）。因此，如果有人伪造它，您可以使用/信任由最初不应该颁发证书的人颁发的证书。注释掉checkServerTrusted 是不好：你基本上是在说：我不在乎这是谁的证书，只要它没有损坏也没有过期。这种方式违背了目的，因为任何人都可以颁发有效的证书。

可能 2.1 和 2.2 不关心检查约束，而 2.3 开始这样做，这就是您收到错误的原因。您可以发布指向这些证书的链接吗？

所有血腥细节都在RFC 3280。