证书处理：apache httpclient 4.0.1 和 4.1.2 之间的区别？答案

【问题标题】：Certificate handling: Difference between apache httpclient 4.0.1 and 4.1.2?证书处理：apache httpclient 4.0.1 和 4.1.2 之间的区别？
【发布时间】：2011-12-10 21:52:41
【问题描述】：

我尝试连接到使用证书的服务器。我在连接之前调用此代码以确保接受所有证书。这在使用 apache httpclient 4.0.1 时效果很好。但最近我更新到 4.1.2，现在我收到以下错误。

import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

public class CertificateAcceptor {

    public void initializeTrustManager() {
        try {
            SSLContext context = SSLContext.getInstance("SSL");
            context.init(null, trustAllCerts, new SecureRandom());
            HttpsURLConnection.setDefaultSSLSocketFactory(context.getSocketFactory());
            System.out.println("Certificate");
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (KeyManagementException e) {
            e.printStackTrace();
        }
    }

    TrustManager[] trustAllCerts = new TrustManager[] {
            new X509TrustManager() {
                   public X509Certificate[] getAcceptedIssuers() {
                       return null;
                   }

                @Override
                public void checkClientTrusted(X509Certificate[] chain,
                        String authType) throws CertificateException {
                    // TODO Auto-generated method stub

                }

                @Override
                public void checkServerTrusted(X509Certificate[] chain,
                        String authType) throws CertificateException {
                    // TODO Auto-generated method stub

                }

            }
            };


}

但我总是收到此错误消息：

javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
    at com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(Unknown Source)
    at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:397)
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:573)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754)..
...

这可能是什么原因？

【问题讨论】：

您问题中关于SSLContext 的示例显然使用了javax.net.ssl.HttpsURLConnection，并且与Apache HttpClient 4.0.1 或4.1.2 无关。链接是什么？ Apache HttpClient 时SSLContext 是怎么设置的？

标签： java ssl httpclient

【解决方案1】：

4.1 之前的 Apache HttpClient 错误地从 javax.net.ssl.HttpsURLConnection 获取默认 SSL 设置。从 4.1 版开始不再是这种情况。

请使用 HttpClient 原生 API 为 HTTPS 连接配置 SSL 上下文。

【讨论】：