信任所有证书：探索Java中PKIX路径构建失败解决方案的奥秘

后端

2023-11-28 09:18:44

解决PKIX路径构建失败：建立对所有证书的信任

概述

在使用Java进行HTTPS连接时，"PKIX路径构建失败"错误可能令人沮丧，阻止您访问受SSL保护的网站。本文深入探讨了PKIX路径构建失败的原因，并提供了一个一步步的指南，帮助您通过信任所有证书来解决此问题。

探索PKIX路径构建失败的原因

PKIX（公共密钥基础设施X.509）路径构建失败错误通常是以下原因造成的：

证书颁发机构（CA）的证书未安装在信任库中 ：Java无法验证证书，因为颁发证书的CA的证书未安装在您的信任库中。
证书已过期或被吊销 ：如果连接网站的证书已过期或被吊销，Java也无法验证证书。
服务器使用自签名证书 ：如果连接网站使用的是自签名证书，Java将无法验证证书。

信任所有证书：一步步的指南

您可以通过信任所有证书来解决PKIX路径构建失败问题。这是一种简单而有效的方法，允许您连接到任何受SSL保护的网站或服务，而无需担心证书验证问题。

生成Java密钥库

keytool -genkey -alias selfsigned -keyalg RSA -keystore my-keystore.jks -storepass password -validity 365

导入CA证书到密钥库

keytool -import -alias cacert -file cacert.pem -keystore my-keystore.jks -storepass password

创建TrustManager

import java.security.cert.X509Certificate;

public class TrustAllCertificatesTrustManager implements X509TrustManager {

    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) {}

    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) {}

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return null;
    }
}

创建SSLContext

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;

public class SSLContextCreator {

    public static SSLContext createSSLContext() throws Exception {
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("SunX509");
        trustManagerFactory.init(null);
        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustManagers, null);
        return sslContext;
    }
}

配置HTTPS连接

import java.net.HttpURLConnection;
import java.net.URL;

public class HTTPSConnectionConfigurator {

    public static HttpURLConnection configureHTTPSConnection(String url) throws Exception {
        SSLContext sslContext = SSLContextCreator.createSSLContext();
        URL urlObject = new URL(url);
        HttpURLConnection connection = (HttpURLConnection) urlObject.openConnection();
        connection.setSSLSocketFactory(sslContext.getSocketFactory());
        connection.setHostnameVerifier((hostname, session) -> true);
        return connection;
    }
}

使用HTTPS连接

import java.io.BufferedReader;
import java.io.InputStreamReader;

public class HTTPSRequester {

    public static String sendRequest(String url) throws Exception {
        HttpURLConnection connection = HTTPSConnectionConfigurator.configureHTTPSConnection(url);
        connection.setRequestMethod("GET");
        connection.connect();
        BufferedReader reader = new BufferedReader(new InputStreamReader(connection.getInputStream()));
        StringBuilder response = new StringBuilder();
        String line;
        while ((line = reader.readLine()) != null) {
            response.append(line);
        }
        reader.close();
        return response.toString();
    }
}