如何让Jersey忽略ssl证书错误？

4 回答

• 1

  请注意，信任所有证书是 extremely risky . 这样做时要小心 .

  以下一块与yukuan's answer中所示的一块没什么不同 . 但是，以下解决方案仅使用JAX-RS Client API . 理论上，它也应该与其他JAX-RS实现一起使用：

  TrustManager[] trustManager = new X509TrustManager[] { new X509TrustManager() {
  
      @Override
      public X509Certificate[] getAcceptedIssuers() {
          return null;
      }
  
      @Override
      public void checkClientTrusted(X509Certificate[] certs, String authType) {
  
      }
  
      @Override
      public void checkServerTrusted(X509Certificate[] certs, String authType) {
  
      }
  }};
  
  SSLContext sslContext = SSLContext.getInstance("SSL");
  sslContext.init(null, trustManager, null);
  
  Client client = ClientBuilder.newBuilder().sslContext(sslContext).build();
  

  ---

  注1：在撰写本文时，上述标准解决方案不适用于RESTEasy . RESTEasy将来自Apache HttpComponents项目的HTTP调用委托给HttpClient . 要使用RESTEasy信任所有证书，必须自定义HttpClient . 有关详细信息，请查看此答案 .

  注意2：您可能会发现https://badssl.com是一个有用的资源，用于测试客户端是否存在错误的SSL配置 .

  回复于 2024-04-26T04:00:09+08:00
• 0

  package com.xxxxxxx.rest;
  
  import java.security.KeyManagementException;
  import java.security.NoSuchAlgorithmException;
  import java.security.cert.X509Certificate;
  import java.util.Properties;
  
  import javax.net.ssl.SSLContext;
  import javax.net.ssl.TrustManager;
  import javax.net.ssl.X509TrustManager;
  import javax.ws.rs.client.Client;
  import javax.ws.rs.client.ClientBuilder;
  
  import org.glassfish.jersey.client.JerseyClientBuilder;
  
  public class RestClient {
  
      private Client client;
  
      public RestClient(Properties properties) {
          super();
          ClientBuilder clientBuilder = new JerseyClientBuilder();
          SSLContext sslContext = null;
          TrustManager[] trustAllCerts = new X509TrustManager[] { new X509TrustManager() {
              @Override
              public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                  return null;
              }
  
              @Override
              public void checkClientTrusted(X509Certificate[] certs, String authType) {
              }
  
              @Override
              public void checkServerTrusted(X509Certificate[] certs, String authType) {
              }
          } };
          try {
              sslContext = SSLContext.getInstance("SSL");
              sslContext.init(null, trustAllCerts, null);
          } catch (NoSuchAlgorithmException | KeyManagementException e) {
          }
          clientBuilder.sslContext(sslContext);
          client = clientBuilder.build();
      }
  
      public <T> T execRequest(String uri, Class<T> type) {
          return client.target(uri).request().get(type);
      }
  }
  

  回复于 2024-04-26T04:00:09+08:00
• 1

  而不是试图忽略错误，最好首先避免它 . 添加代码作为变通方法是有风险的，因为轶事经验表明代码最终将最终投入 生产环境 .

  出于开发目的，您应该创建一个合适的信任库，以便您的开发证书受信任 . this related question的已接受答案记录了如何为此类方案创建此类信任存储 . 如果你手头有服务器证书，几乎可以肯定，你可以避免浏览器步骤并编写所有脚本 .

  理想情况下，如果无法找到证书（例如，您不会意外地将开发证书配置部署到 生产环境 计算机），这会陷入无法失败的进程 .

  回复于 2024-04-26T04:00:09+08:00
• 0

  你可以尝试这样的事情：

  // Create a trust manager that does not validate certificate chains
      TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() {
          public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; }
          public void checkClientTrusted(X509Certificate[] certs, String authType) { }
          public void checkServerTrusted(X509Certificate[] certs, String authType) { }
      }};
  
      // Install the all-trusting trust manager
      SSLContext sc;
      try {
          sc = SSLContext.getInstance("SSL");
          sc.init(null, trustAllCerts, new java.security.SecureRandom());
          HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
      } catch (Exception e) {
          e.printStackTrace();
      }
  
      // Create all-trusting host name verifier
      HostnameVerifier allHostsValid = new HostnameVerifier() {
          public boolean verify(String hostname, SSLSession session) {
              return true;
          }
      };
      // Install the all-trusting host verifier
      HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
  

  回复于 2024-04-26T04:00:09+08:00