如何使用 X509TrustManager 验证 android.net.http.SslCertificate？

Question

Android 的 WebViewClient 在遇到不受信任的证书时会调用 onReceivedSslError。但是，我在该调用中收到的SslError 对象没有任何公共方式可以访问底层X509Certificate 以根据现有TrustStoreManager 对其进行验证。查看源代码，我可以访问X509Certificate的编码字节：

public void onReceivedSslError(WebView view, SslErrorHandler handler,
        SslError error) {
    Bundle bundle = SslCertificate.saveState(error.getCertificate());
    X509Certificate x509Certificate;
    byte[] bytes = bundle.getByteArray("x509-certificate");
    if (bytes == null) {
        x509Certificate = null;
    } else {
        try {
            CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
            Certificate cert = certFactory.generateCertificate(new ByteArrayInputStream(bytes));
            x509Certificate = (X509Certificate) cert;
        } catch (CertificateException e) {
            x509Certificate = null;
        }
    }

    // Now I have an X509Certificate I can pass to an X509TrustManager for validation.
}

显然，这是私有 API 并且很脆弱，但我认为它相当可靠，因为它们无法更改捆绑格式。有没有更好的办法？

Answer 1

经过漫长的等待，似乎在我的feature request as issue 36984840 之后，SslCertificate 添加了一个名为getX509Certificate(): java.security.cert.X509Certificate 的方法。