java - 忽略过期的ssl证书

Question

URL myUrl = new URL("https://www....."); 

网站的SSL证书已过期。如何避免它，并使URL（）工作？

Answer 1

你应该建立一个TrustManager换行默认的信任管理器，捕捉CertificiateExpiredException并忽略它。

注意：如this answer所述，这是否安全取决于实施。特别是，它依赖于最后完成的日期验证，在正确检查了其他所有内容之后。

东西沿着这些路线应该工作：

TrustManagerFactory tmf = TrustManagerFactory.getInstance(
    TrustManagerFactory.getDefaultAlgorithm()); 
// Initialise the TMF as you normally would, for example: 
tmf.init((KeyStore)null); 

TrustManager[] trustManagers = tmf.getTrustManagers(); 
final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0]; 

TrustManager[] wrappedTrustManagers = new TrustManager[]{ 
    new X509TrustManager() { 
     public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
      return origTrustmanager.getAcceptedIssuers(); 
     } 

     public void checkClientTrusted(X509Certificate[] certs, String authType) { 
      origTrustmanager.checkClientTrusted(certs, authType); 
     } 

     public void checkServerTrusted(X509Certificate[] certs, String authType) { 
      try { 
       origTrustmanager.checkServerTrusted(certs, authType); 
      } catch (CertificateExpiredException e) {} 
     } 
    } 
}; 

SSLContext sc = SSLContext.getInstance("TLS"); 
sc.init(null, wrappedTrustManagers, null); 
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); 

信托经理抛出CertificateException S（详见子类），什么是错用证书。具体说明你想要捕捉/忽略的内容。在你捕获的东西可能被抛出之前，你真正要验证的所有东西都必须被检查，否则你也必须手动验证它。比这更轻松的任何事情（尤其是没有做任何事情，因此不会抛出任何异常）将完全忽略证书验证和验证，这与使用匿名密码套件或忽略验证大致相同。这将破坏使用SSL/TLS的安全性目的（而不是仅在有效期限内更灵活）。

Answer 2

您必须创建一个将忽略过期证书的自定义X509验证程序。事实上，不会执行检查。从这里取

代码：http://exampledepot.com/egs/javax.net.ssl/TrustAll.html

// Create a trust manager that does not validate certificate chains 
TrustManager[] trustAllCerts = new TrustManager[]{ 
    new X509TrustManager() { 
     public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
      return null; 
     } 
     public void checkClientTrusted(
      java.security.cert.X509Certificate[] certs, String authType) { 
     } 
     public void checkServerTrusted(
      java.security.cert.X509Certificate[] certs, String authType) { 
     } 
    } 
}; 

// Install the all-trusting trust manager 
try { 
    SSLContext sc = SSLContext.getInstance("SSL"); 
    sc.init(null, trustAllCerts, new java.security.SecureRandom()); 
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); 
} catch (Exception e) { 
} 

// Now you can access an https URL without having the certificate in the truststore 
// It should work with expired certificate as well 
try { 
    URL myUrl = new URL("https://www....."); 
} catch (MalformedURLException e) { 
} 

Answer 3

我写了一个自定义的TrustManager来解决这个问题，你可以在https://gist.github.com/divergentdave/9a68d820e3610513bd4fcdc4ae5f91a1看到它。此TrustManager将有问题的X509Certificate包装在另一个类中，以禁用到期检查，同时保留所有其他验证。 （即匹配主机名，链接到受信任的CA，签名有效等）