Java的HttpClient如何去支持无证书访问https
项目里需要访问其他接口,通过http/https协议。我们一般是用HttpClient类来实现具体的http/https协议接口的调用。
// Init a HttpClient
HttpClient client = new HttpClient();
String url=http://www.xxx.com/xxx;
// Init a HttpMethod
HttpMethod get = new GetMethod(url);
get.setDoAuthentication(true);
get.getParams().setParameter(HttpMethodParams.RETRY_HANDLER, new DefaultHttpMethodRetryHandler(1, false));
// Call http interface
try {
client.executeMethod(get);
// Handle the response from http interface
InputStream in = get.getResponseBodyAsStream();
SAXReader reader = new SAXReader();
Document doc = reader.read(in);
} finally {
// Release the http connection
get.releaseConnection();
}
以上代码在通过普通的http协议是没有问题的,但如果是https协议的话,就会有证书文件的要求了。一般情况下,是这样去做的。
// Init a HttpClient
HttpClient client = new HttpClient();
String url=https://www.xxx.com/xxx;
if (url.startsWith("https:")) {
System.setProperty("javax.net.ssl.trustStore", "/.sis.cer");
System.setProperty("javax.net.ssl.trustStorePassword", "public");
}
......
于是,这里就需要事先生成一个.sis.cer的文件,生成这个文件的方法一般是先通过浏览器访问https://,导出证书文件,再用JAVA keytool command 生成证书
# $JAVA_HOME/bin/keytool -import -file sis.cer -keystore .sis.cer
但这样做,一比较麻烦,二来证书也有有效期,过了有效期之后,又需要重新生成一次证书。如果能够避开生成证书文件的方式来使用https的话,就比较好了。
还好,在最近的项目里,我们终于找到了方法。
// Init a HttpClient
HttpClient client = new HttpClient();
String url=https://www.xxx.com/xxx;
if (url.startsWith("https:")) {
this.supportSSL(url, client);
}
......
这里用到了supportSSL(url, client)这个方法,看看这个方法是如何实现的。
private void supportSSL(String url, HttpClient client) {
if(StringUtils.isBlank(url)) {
return;
}
String siteUrl = StringUtils.lowerCase(url);
if (!(siteUrl.startsWith("https"))) {
return;
}
try {
setSSLProtocol(siteUrl, client);
} catch (Exception e) {
logger.error("setProtocol error ", e);
}
Security.setProperty( "ssl.SocketFactory.provider",
"com.tool.util.DummySSLSocketFactory");
}
private static void setSSLProtocol(String strUrl, HttpClient client) throws Exception {
URL url = new URL(strUrl);
String host = url.getHost();
int port = url.getPort();
if (port <= 0) {
port = 443;
}
ProtocolSocketFactory factory = new SSLSocketFactory();
Protocol authhttps = new Protocol("https", factory, port);
Protocol.registerProtocol("https", authhttps);
// set https protocol
client.getHostConfiguration().setHost(host, port, authhttps);
}
在supportSSL方法里,调用了Security.setProperty( "ssl.SocketFactory.provider",
"com.tool.util.DummySSLSocketFactory");
那么这个com.tool.util.DummySSLSocketFactory是这样的:
http://hi.baidu.com/lettoo/blog/item/72c83238f5f9fa2897ddd8e7.html
项目里需要访问其他接口,通过http/https协议。我们一般是用HttpClient类来实现具体的http/https协议接口的调用。
// Init a HttpClient
HttpClient client = new HttpClient();
String url=http://www.xxx.com/xxx;
// Init a HttpMethod
HttpMethod get = new GetMethod(url);
get.setDoAuthentication(true);
get.getParams().setParameter(HttpMethodParams.RETRY_HANDLER, new DefaultHttpMethodRetryHandler(1, false));
// Call http interface
try {
client.executeMethod(get);
// Handle the response from http interface
InputStream in = get.getResponseBodyAsStream();
SAXReader reader = new SAXReader();
Document doc = reader.read(in);
} finally {
// Release the http connection
get.releaseConnection();
}
以上代码在通过普通的http协议是没有问题的,但如果是https协议的话,就会有证书文件的要求了。一般情况下,是这样去做的。
// Init a HttpClient
HttpClient client = new HttpClient();
String url=https://www.xxx.com/xxx;
if (url.startsWith("https:")) {
System.setProperty("javax.net.ssl.trustStore", "/.sis.cer");
System.setProperty("javax.net.ssl.trustStorePassword", "public");
}
......
于是,这里就需要事先生成一个.sis.cer的文件,生成这个文件的方法一般是先通过浏览器访问https://,导出证书文件,再用JAVA keytool command 生成证书
# $JAVA_HOME/bin/keytool -import -file sis.cer -keystore .sis.cer
但这样做,一比较麻烦,二来证书也有有效期,过了有效期之后,又需要重新生成一次证书。如果能够避开生成证书文件的方式来使用https的话,就比较好了。
还好,在最近的项目里,我们终于找到了方法。
// Init a HttpClient
HttpClient client = new HttpClient();
String url=https://www.xxx.com/xxx;
if (url.startsWith("https:")) {
this.supportSSL(url, client);
}
......
这里用到了supportSSL(url, client)这个方法,看看这个方法是如何实现的。
private void supportSSL(String url, HttpClient client) {
if(StringUtils.isBlank(url)) {
return;
}
String siteUrl = StringUtils.lowerCase(url);
if (!(siteUrl.startsWith("https"))) {
return;
}
try {
setSSLProtocol(siteUrl, client);
} catch (Exception e) {
logger.error("setProtocol error ", e);
}
Security.setProperty( "ssl.SocketFactory.provider",
"com.tool.util.DummySSLSocketFactory");
}
private static void setSSLProtocol(String strUrl, HttpClient client) throws Exception {
URL url = new URL(strUrl);
String host = url.getHost();
int port = url.getPort();
if (port <= 0) {
port = 443;
}
ProtocolSocketFactory factory = new SSLSocketFactory();
Protocol authhttps = new Protocol("https", factory, port);
Protocol.registerProtocol("https", authhttps);
// set https protocol
client.getHostConfiguration().setHost(host, port, authhttps);
}
在supportSSL方法里,调用了Security.setProperty( "ssl.SocketFactory.provider",
"com.tool.util.DummySSLSocketFactory");
那么这个com.tool.util.DummySSLSocketFactory是这样的:
http://hi.baidu.com/lettoo/blog/item/72c83238f5f9fa2897ddd8e7.html