javax net ssl SSLHandshakeException的解决办法

最新推荐文章于 2024-09-12 09:46:57 发布

阿拉里

最新推荐文章于 2024-09-12 09:46:57 发布

阅读量7.5k

点赞数

本文链接：https://blog.csdn.net/qq_44884577/article/details/89133584

版权

首先给大家分享一个巨牛巨牛的人工智能教程，是我无意中发现的。教程不仅零基础，通俗易懂，而且非常风趣幽默，还时不时有内涵段子，像看小说一样，哈哈～我正在学习中，觉得太牛了，所以分享给大家！点这里可以跳转到教程

在SOAP协议的连接过程中，出现如下错误：

Caused by: BaseConnection$BasicConnectionException: failed to connect: HTTP 传输错误: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed:     ... 33 moreCaused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target    ... 34 moreCaused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)    at sun.security.validator.Validator.validate(Validator.java:260)    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)    ... 62 moreCaused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target    ... 68 more
  
  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

显然，这是证书导致的连接失败，首先测试了一下网上精简版的解决方案：

static {    HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> hostname.equals("192.168.101.33"));}
  
  1
2
3

结果依旧失败，依照网上的说法，在使用IP地址进行SSH连接时，证书中必须要有主题的替代名称，如下：

Unlike some browsers, Java follows the HTTPS specification strictly when it comes to the server identity verification (RFC 2818, Section 3.1) and IP addresses.When using a host name, it's possible to fall back to the Common Name in the Subject DN of the server certificate, instead of using the Subject Alternative Name.When using an IP address, there must be a Subject Alternative Name entry (of type IP address, not DNS name) in the certificate.
  
  1
2
3
4
5

听起来很复杂，但是证书真能解决此问题，在此不进行测试说明，而是采用放弃证书的一种解决办法，如下：

//  直接通过主机认证HostnameVerifier hv = new HostnameVerifier() {    public boolean verify(String urlHostName, SSLSession session) {        return true;    }};//  配置认证管理器javax.net.ssl.TrustManager[] trustAllCerts = {new TrustAllTrustManager()};SSLContext sc = SSLContext.getInstance("SSL");SSLSessionContext sslsc = sc.getServerSessionContext();sslsc.setSessionTimeout(0);sc.init(null, trustAllCerts, null);HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());//  激活主机认证HttpsURLConnection.setDefaultHostnameVerifier(hv);
  
  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

TrustAllTrustManager的实现如下：

public class TrustAllTrustManager implements javax.net.ssl.TrustManager, javax.net.ssl.X509TrustManager {    public java.security.cert.X509Certificate[] getAcceptedIssuers() {        return null;    }    public boolean isServerTrusted(java.security.cert.X509Certificate[] certs) {        return true;    }    public boolean isClientTrusted(java.security.cert.X509Certificate[] certs) {        return true;    }    public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType)            throws java.security.cert.CertificateException {        return;    }    public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType)            throws java.security.cert.CertificateException {        return;    }}
  
  1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25