android證書https
❶ android 怎麼信任https
因為最近公司的open api伺服器訪問協議換成了https，所以 android 在使用okhttp 走https 訪問的時候遇到了證書信任的問題，
在這里把我走過的彎路記下來，一如既往的話不多說，上碼：
OkHttpClient sClient = new OkHttpClient();
// 設置超時時間
sClient.setConnectTimeout(8000, TimeUnit.MILLISECONDS);
sClient.setReadTimeout(8000, TimeUnit.MILLISECONDS);
// 注冊攔截器
sClient.interceptors().add(new BaseInterceptor(context));
第一種方式：
sClient.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
運行結果：
javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
11-26 11:17:57.264 17106-17268/com.dooioo.addressbook W/System.err: at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:410)
11-26 11:17:57.264 17106-17268/com.dooioo.addressbook W/System.err: at com.squareup.okhttp.Connection.connectTls(Connection.java:235)
11-26 11:17:57.264 17106-17268/com.dooioo.addressbook W/System.err: at com.squareup.okhttp.Connection.connectSocket(Connection.java:199)
11-26 11:17:57.264 17106-1726
❷ android okhttp https請求
忽略SSL證書的方法
//獲取TrustManager
private static TrustManager[] getTrustManager() {
//不校檢證書鏈
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) {
//不校檢客戶端證書
}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) {
//不校檢伺服器證書
}
@Override
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[]{};
//OKhttp3.0以前返回null,3.0以後返回new X509Certificate[]{};
}
}
};
return trustAllCerts;
}
//獲取這個SSLSocketFactory
//通過這個類我們可以獲得SSLSocketFactory，這個東西就是用來管理證書和信任證書的
public static SSLSocketFactory getSSLSocketFactory() {
try {
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, getTrustManager(), new SecureRandom());
return sslContext.getSocketFactory();
} catch (Exception e) {
throw new RuntimeException(e);
}
}
//獲取HostnameVerifier
public static HostnameVerifier getHostnameVerifier() {
HostnameVerifier hostnameVerifier = new HostnameVerifier() {
@Override
public boolean verify(String s, SSLSession sslSession) {
//未真正校檢伺服器端證書域名
return true;
}
};
return hostnameVerifier;
}
public OkHttpClient getOkHttpClient() {
if (mOkHttpClient == null) {
mOkHttpClient = new OkHttpClient.Builder()
.connectTimeout(15, TimeUnit.SECONDS)
.sslSocketFactory(new SSLSocketClient().getSSLSocketFactory())//配置
.hostnameVerifier(new SSLSocketClient().getHostnameVerifier())//配置
// .readTimeout(10, TimeUnit.SECONDS)
.build();
}
return mOkHttpClient;
}
原文鏈接： Android https請求證書處理
❸ android https自簽名證書和機構頒發證書的區別
1、https自簽名證書，免費，可自己生成，不受瀏覽器信任，沒有第三方監管，容易被仿造，存在安全風險。
2、證書頒發機構，權威、合法第三方證書頒發管理機構CA，需要准入許可證，頒發的SSL證書安全可行，提供長期的技術支持和售後服務，提供高額的保險。
3、關於證書頒發機構的介紹：http://www.wosign.com/CA/index.html