SSLSocketFactory忽略服务器证书

Question

我需要创建一个javax.net.ssl.SSLSocketFactory，它可以建立TLS连接，但忽略服务器证书的验证。不是HTTP协议。我知道这样做不对，但我需要它。我不想也不喜欢。

我做了一个可以工作的实现，但是验证了服务器证书(假设是)实现如下：

/**
     * Provide a quick method to construct a SSLSocketFactory which is a TCP socket using TLS/SSL
     * @param trustStore location of the trust store
     * @param keyStore location of the key store
     * @param trustStorePassword password to access the trust store
     * @param keyStorePassword password to access the key store
     * @return the SSLSocketFactory to create secure sockets with the provided certificates infrastructure
     * @exception java.lang.Exception in case of something wrong happens
     * */
    static public SSLSocketFactory getSocketFactory ( final String trustStore, final String keyStore, final String trustStorePassword, final String keyStorePassword) throws Exception
    {

        // todo check if the CA needs or can use the password
        final FileInputStream trustStoreStream = new FileInputStream(trustStore);
        final FileInputStream keyStoreStream = new FileInputStream(keyStore);
        // CA certificate is used to authenticate server
        final KeyStore caKs = KeyStore.getInstance("JKS");
        caKs.load(trustStoreStream, trustStorePassword.toCharArray());
        final TrustManagerFactory tmf = TrustManagerFactory.getInstance("PKIX");
        tmf.init(caKs);

        trustStoreStream.close();

        // client key and certificates are sent to server so it can authenticate us
        final KeyStore ks = KeyStore.getInstance("JKS");
        ks.load(keyStoreStream, keyStorePassword.toCharArray());
        final KeyManagerFactory kmf = KeyManagerFactory.getInstance("PKIX");
        kmf.init(ks, keyStorePassword.toCharArray());

        keyStoreStream.close();

        // finally, create SSL socket factory
        final SSLContext context = SSLContext.getInstance("TLSv1.2");
        context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

        return context.getSocketFactory();
    }

Answer 1

我使用黑客来阻止证书的验证，但是它对每个SSL连接都是这样做的：

公共类SSLHack {私有静态最终日志= Logger.getLogger(SSLHack.class)；

public static void disableSslVerification() {
    try {
        // Create a trust manager that does not validate certificate chains
        TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }

            public void checkClientTrusted(X509Certificate[] certs,
                    String authType) {
            }

            public void checkServerTrusted(X509Certificate[] certs,
                    String authType) {
            }
        } };

        // Install the all-trusting trust manager
        SSLContext sc = SSLContext.getInstance("SSL");
        sc.init(null, trustAllCerts, new java.security.SecureRandom());
        HttpsURLConnection
                .setDefaultSSLSocketFactory(sc.getSocketFactory());

        // Create all-trusting host name verifier
        HostnameVerifier allHostsValid = new HostnameVerifier() {
            public boolean verify(String hostname, SSLSession session) {
                return true;
            }
        };

        // Install the all-trusting host verifier
        HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
    } catch (NoSuchAlgorithmException e) {
        LOG.error(e.getMessage(), e);
    } catch (KeyManagementException e) {
        LOG.error(e.getMessage(), e);
    }
}