netss SSL处理程序在badssl.com上未正确失败

我正在开发一个使用Netty来管理其SSL / TLS连接的应用程序 . 我正在尝试测试它正确处理各种证书错误，我使用badssl.com .

但是，当我尝试连接到badssl.com时，会抛出异常（为了简洁和清晰起见，编辑和删除了完整的callstack跟踪）：

An exceptionCaught() event was fired, and it reached at the tail of the pipeline. It usually means the last handler in the pipeline did not handle the exception.
    io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: Handshake failed
    at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:442)
    at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:248)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:372)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:358)
    at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:350)
    at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1334)

...
    Caused by: javax.net.ssl.SSLHandshakeException: Handshake failed
        at com.android.org.conscrypt.OpenSSLEngineImpl.unwrap(OpenSSLEngineImpl.java:436)
        at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:1006)
        at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1094)

...

    Caused by: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
        at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:318)
        at com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:219)
...
    Caused by: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
        at com.android.org.conscrypt.TrustManagerImpl.checkTrusted(TrustManagerImpl.java:318) 
        at com.android.org.conscrypt.TrustManagerImpl.checkServerTrusted(TrustManagerImpl.java:219) 
        at com.android.org.conscrypt.Platform.checkServerTrusted(Platform.java:113)

以下带有未识别的CA，自签名证书或缺少中间CA的guide for Android developers links Trust anchor for certification path not found. 例外 . 但这不是badssl.com的情况 - 手机的浏览器识别证书，我甚至可以成功使用HTTPSUrlConnection来联系它 .

当我使用InsecureTrustManagerFactory.INSTANCE初始化我的安全Netty连接成功，但这不是一个长期的解决方案 .

以下是相关的代码片段：Initialize SslContext

sslContext = SslContextBuilder
            .forClient()
            .sslProvider(SslProvider.JDK)
            // TODO p0: Ensure all the versions we support have this algorithm installed
            //.trustManager(InsecureTrustManagerFactory.INSTANCE)
            .build();

添加SSL处理程序：

ChannelPipeline pipeline = ch.pipeline();
pipeline.addLast(sslContext.newHandler(ch.alloc(), host.getHostName(), host.getPort()));

验证后写入HTTP请求：

ChannelFuture future = bootstrap.connect(host).addListener(new ChannelFutureListener() {
                @Override
                public void operationComplete(ChannelFuture future) throws Exception {
                    String request = "GET https://badssl.com/\n" +
                            "Host: +" + host.getHostName() + "\n" +
                            "Accept: text/html,application/xhtml+xml,application/xml;"
                            + "DNT: 1\n\n";

                    future.channel().writeAndFlush(Unpooled.copiedBuffer(
                            request, Charset.forName("ASCII")));
                }

这里发生了什么？为什么badssl.com不被认可？我还尝试了一些具有已知错误证书的域，其中连接似乎错误地成功 . SSL客户端的唯一示例是SecureChatClient，它使用InsecureTrustManager .

我正在使用Netty 4.1，我的测试手机是带有Android 5.0的LG G3 .