告訴任意SSLSocketFactories信任所有證書？

Question

我有一個實用程序SSLSocketFactory類，它基本上允許您切換，如果您想要信任所有證書和/或由於JDK錯誤而導致Deffie Hellman轉向。我最近添加了提供自己的SSLSocketFactory的選項，但似乎忘記了一些東西

通過在創建套接字時簡單添加一些代碼來禁用Diffie Hellman很容易在工廠上完成。然而信任所有證書，我用不同的一個

public UtilSSLSocketFactory trustAllCertificates() { 
      if (trustingAllCertificates) 
        //Already doing this, no need to do it again 
        return this; 
      trustingAllCertificates = true; 
      try { 
        TrustManager[] tm = new TrustManager[]{new TrustingX509TrustManager()}; 
        SSLContext context = SSLContext.getInstance("SSL"); 
        context.init(new KeyManager[0], tm, new SecureRandom()); 
        wrappedFactory = (SSLSocketFactory) context.getSocketFactory(); 
      } catch (Exception e) { 
        throw new RuntimeException("Can't recreate socket factory that trusts all certificates", e); 
      } 
      return this; 
    } 

更換工廠有沒有辦法告訴任意SSLSocketFactory的信任所有證書，而無需更換呢？

Answer 1

除了這個事實，盲目信任所有證書通常是一個壞主意（如果你想用SSL/TLS來保護通信），你使用的模式看起來很奇怪。

SSLContext是SSLSocketFactory的工廠，該工廠又是SSLSocket的工廠。

如果需要，您可以使用SSLContext.setDefault(...)來設置默認的SSLContext（從Java 6開始）：這會影響默認SSLSocketFactory，但可能不是更具體的。

你不能改變由現有的SSLSocketFactory實例SSLContext。

除非您現有的SSLSocketFactory與默認實現有特定設置（例如在返回之前在創建的套接字上調整的東西）不同，否則您嘗試執行的操作似乎不符合預期的設計模式。

Answer 2

任意SSLSocketFactory的信任所有證書，而不必更換 它

號您有設置自定義的「信任所有證書」經理，否則一個正在使用的默認「諮詢「Java JDK安裝中的默認信任庫cacerts。

但是從安全的角度來看，如果你要沒有服務器認證，你還不如用普通TCP去避免SSL的開銷，因爲你實際上並沒有在所有的方式，你是以下任何安全性。

Answer 3

試試這個代碼....其工作代碼，使用這個類在代碼中像這樣的

HttpClient client = MySSLSocketFactory.getNewHttpClient(); 

下面是代碼

import java.io.IOException; 
import java.net.Socket; 
import java.net.UnknownHostException; 
import java.security.KeyManagementException; 
import java.security.KeyStore; 
import java.security.KeyStoreException; 
import java.security.NoSuchAlgorithmException; 
import java.security.UnrecoverableKeyException; 
import java.security.cert.CertificateException; 
import java.security.cert.X509Certificate; 

import javax.net.ssl.SSLContext; 
import javax.net.ssl.TrustManager; 
import javax.net.ssl.X509TrustManager; 

import org.apache.http.HttpVersion; 
import org.apache.http.client.HttpClient; 
import org.apache.http.conn.ClientConnectionManager; 
import org.apache.http.conn.scheme.PlainSocketFactory; 
import org.apache.http.conn.scheme.Scheme; 
import org.apache.http.conn.scheme.SchemeRegistry; 
import org.apache.http.conn.ssl.SSLSocketFactory; 
import org.apache.http.impl.client.DefaultHttpClient; 
import org.apache.http.impl.conn.tsccm.ThreadSafeClientConnManager; 
import org.apache.http.params.BasicHttpParams; 
import org.apache.http.params.HttpParams; 
import org.apache.http.params.HttpProtocolParams; 
import org.apache.http.protocol.HTTP; 

public class MySSLSocketFactory extends SSLSocketFactory { 
    SSLContext sslContext = SSLContext.getInstance("TLS"); 

    public MySSLSocketFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException { 
     super(truststore); 

     TrustManager tm = new X509TrustManager() { 
      public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { 
      } 

      public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { 
      } 

      public X509Certificate[] getAcceptedIssuers() { 
       return null; 
      } 
     }; 

     sslContext.init(null, new TrustManager[] { tm }, null); 
    } 

    @Override 
    public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException, UnknownHostException { 
     return sslContext.getSocketFactory().createSocket(socket, host, port, autoClose); 
    } 

    @Override 
    public Socket createSocket() throws IOException { 
     return sslContext.getSocketFactory().createSocket(); 
    } 


public static HttpClient getNewHttpClient() { 
    try { 
     KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType()); 
     trustStore.load(null, null); 

     SSLSocketFactory sf = new MySSLSocketFactory(trustStore); 
     sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 

     HttpParams params = new BasicHttpParams(); 
     HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1); 
     HttpProtocolParams.setContentCharset(params, HTTP.UTF_8); 

     SchemeRegistry registry = new SchemeRegistry(); 
     registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80)); 
     registry.register(new Scheme("https", sf, 443)); 

     ClientConnectionManager ccm = new ThreadSafeClientConnManager(params, registry); 

     return new DefaultHttpClient(ccm, params); 
    } catch (Exception e) { 
     return new DefaultHttpClient(); 
    } 
} 

}