如何在使用TLSv1.2的Apache HttpClient中忽略"localhost“？

Question

我测试了Apache (HTTPS & TLS)的几个语法结构，以便忽略“HttpClinet”配置中通常使用的自签名证书的证书链。有一个自定义的HttpClient可以很好地用于TLSv1.1，但观察服务器跟踪，它不会触发TLSv1.2的使用，而TLSv1.2是所需的安全算法。

您可以在下面找到使用TLSv1.2配置HttpClient的尝试。

欢迎对其他建设的建议。"localhost“场景仍然是开发点对点例程的常用机制。如果有一个可配置的例程，它只接受用于本地主机访问的自签名证书，那就更好了。

TLSv1.1示例和使用自定义HttpClient (适用于TLSv1.1，但不适用于TLSv1.2)：

HttpClient client = HttpClients.custom().setSSLHostnameVerifier(new NoopHostnameVerifier()).setSslcontext(new SSLContextBuilder().loadTrustMaterial(null, (x509Certificates, s) -> true).build()).build();

服务器日志：

*** Finished
verify_data:  { 251, 245, 220, 174, 235, 125, 248, 119, 220, 80, 38, 1 }
***
Thread-7, WRITE: TLSv1 Handshake, length = 48
%% Cached server session: [Session-23, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA]
Thread-7, WRITE: TLSv1 Application Data, length = 108
Thread-7, WRITE: TLSv1 Application Data, length = 1
Thread-7, WRITE: TLSv1 Application Data, length = 19

客户端-正常

Debug HTTP response: HttpResponseProxy{HTTP/1.1 200 OK [Date: Tue, 21 Feb 2017 21:16:02 GMT, Access-control-allow-origin: *, Content-length: 20] ResponseEntityProxy{[Content-Length: 20,Chunked: false]}}
*** end of debug ***
Service HTTP Response Code : 200
contentLength is: 20
serviceResponse : This is the response

使用TLSv1.2和代码进行测试

  SSLContext sslContext = SSLContexts.custom().build();
     SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext,
          new String[]{"TLSv1.2"}, null, SSLConnectionSocketFactory.getDefaultHostnameVerifier());
     HttpClient client = HttpClients.custom().setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).setConnectionManager(clientConnectionManager).build();

(*) SSLContext类已弃用

服务器日志：

-Djavax.net.debug=ssl
or 
System.setProperty("javax.net.debug", "ssl");

JsseJCE:  Using MAC HmacSHA256 from provider TBD via init 
MAC:  Using MessageDigest HmacSHA256 from provider IBMJCE version 1.8
*** Finished
verify_data:  { 69, 241, 3, 42, 44, 222, 21, 174, 250, 83, 244, 25 }
***
Thread-7, WRITE: TLSv1.2 Handshake, length = 80
%% Cached server session: [Session-21, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256]
Thread-7, READ: TLSv1.2 Alert, length = 64
Thread-7, RECV TLSv1.2 ALERT:  warning, close_notify

客户端出错：

sh ./runit.sh 
javax.net.ssl.SSLPeerUnverifiedException: Host name 'localhost' does not match the certificate subject provided by the peer (CN=My Name, OU=RED, O=RED Brazil, L=MYCITY, ST=SP, C=BR)

Answer 1

以下构造使用localhost证书管理与TLSv1.2的连接：

 // solution for localhost certificates and TLSv1.2
 // copied from: http://stackoverflow.com/questions/34655031/javax-net-ssl-sslpeerunverifiedexception-host-name-does-not-match-the-certifica/34657512
 // thanks  

      final SSLConnectionSocketFactory sslsf;
        try {
                sslsf = new SSLConnectionSocketFactory(SSLContext.getDefault(),
                    NoopHostnameVerifier.INSTANCE);
        } catch (NoSuchAlgorithmException e) {
             throw new RuntimeException(e);
        }

      final Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory>create()
              .register("http", new PlainConnectionSocketFactory())
            .register("https", sslsf)
            .build();

      // HttpClient client; 
      final PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(registry);
        cm.setMaxTotal(100);
        HttpClient client = HttpClients.custom()
                .setSSLSocketFactory(sslsf)
                .setConnectionManager(cm)
                .build();
      // end of solution for localhost bypass