如何在CertificateException中使用TrustManager？

Question

我把我的应用程序上传到了play商店，我收到了谷歌开发人员的一封电子邮件，我必须修改https代码中的句子。我正在使用TrustManager函数在https上进行数据提交。我的url中有一个有效的ssl证书，而且一切都很完美。但是我有一个最后期限来修改并向代码中添加一个CertificateException。

谷歌发送给我：

TrustManager

您可以找到有关TrustManager 在这篇谷歌帮助中心的文章中。的更多信息。

HostnameVerifier

您的应用程序正在使用HostnameVerifier接口的不安全实现。您可以找到有关如何解决在这篇谷歌帮助中心的文章中。问题的更多信息。

，这是我的代码：

public class HttpsTrustManager implements X509TrustManager{

    private static TrustManager[] trustManagers;
    private static final X509Certificate[] _AcceptedIssuers = new X509Certificate[]{};
    private X509Certificate[] x509Certificates;

    @Override
    public void checkClientTrusted(

            java.security.cert.X509Certificate[] x509Certificates, String s)
            throws CertificateException {

    }

    @Override
    public void checkServerTrusted(
            java.security.cert.X509Certificate[] x509Certificates, String s)
            throws CertificateException {

    }

    public boolean isClientTrusted(X509Certificate[] chain) {
        return true;
    }

    public boolean isServerTrusted(X509Certificate[] chain) {
        return true;
    }

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return _AcceptedIssuers;
    }

    public static void allowAllSSL() {
        HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {

            @Override
            public boolean verify(String arg0, SSLSession arg1) {
                return true;
            }

        });

        SSLContext context = null;
        if (trustManagers == null) {
            trustManagers = new TrustManager[]{new HttpsTrustManager()};
        }

        try {
            context = SSLContext.getInstance("TLS");
            context.init(null, trustManagers, new SecureRandom());
        } catch (NoSuchAlgorithmException e) {
            e.printStackTrace();
        } catch (KeyManagementException e) {
            e.printStackTrace();
        }

        HttpsURLConnection.setDefaultSSLSocketFactory(context
                .getSocketFactory());
    }
}

我希望你能帮助我。谢谢。

Answer 1

在您的代码中，您只需相信everything.which是不安全的。正如谷歌所言，你应该对证书进行判断，并提出一个例外。像这样，

@重写公共空checkServerTrusted( java.security.cert.X509 Certificate[] x509Certificates，String s)抛出CertificateException {

        // do some check here if the x509Certificates not valid just raise an CertificateException exception.

        // this will check the certificate          
        if(!checkTheHostName(x509Certificates[0]){
            throw new CertificateException("the certificate is invalid ...");
        }
}


private boolean checkTheHostName(Certificate certificate,String hostName){
    return OkHostnameVerifier.INSTANCE.verify("www.yourhostname.com",certificate)
}

the OkHostnameVerifier's code, just in 
https://android.googlesource.com/platform/external/okhttp/+/e82a796/src/main/java/com/squareup/okhttp/internal/tls/OkHostnameVerifier.java

和密码

 @Override
            public boolean verify(String hostName, SSLSession session) {
                // here you should check the hostName, through session
                // do not just return true here, cause it's not safe. like man-in-middle-attack
               Certificate[] certificates = session.getPeerCertificates();
               return verify(host, (X509Certificate) certificates[0]);
    
            }