问题:
项目中Android https或http请求地址重定向为HTTPS的地址,相信很多人都遇到了这个异常(无终端认证):
javax.net.ssl.SSLPeerUnverifiedException: No peer certificate
解决过程:1.没遇到过的问题,搜索吧,少年
log里出现这个异常,作者第一次遇到,不知道啥意思。看下字面意思,是ssl协议中没有终端认证。SSL?
作者没用到ssl协议呀,只是通过httpClient请求一个重定向https的地址。
恩恩,一个不错的帖子,给出了个解决方案。照着来试下。添加个继承SSLSocketFactory的
自定义类。并在初始化httpclient支持https时,注册进去。看下面代码:
- public class HttpClientHelper {
-
- private static HttpClient httpClient;
-
- private HttpClientHelper() {
- }
-
- public static synchronized HttpClient getHttpClient() {
-
- if (null == httpClient) {
- // 初始化工作
- try {
- KeyStore trustStore = KeyStore.getInstance(KeyStore
- .getDefaultType());
- trustStore.load(null, null);
- SSLSocketFactory sf = new SSLSocketFactoryEx(trustStore);
- sf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); //允许所有主机的验证
-
- HttpParams params = new BasicHttpParams();
-
- HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1);
- HttpProtocolParams.setContentCharset(params,
- HTTP.DEFAULT_CONTENT_CHARSET);
- HttpProtocolParams.setUseExpectContinue(params, true);
-
- // 设置连接管理器的超时
- ConnManagerParams.setTimeout(params, 10000);
- // 设置连接超时
- HttpConnectionParams.setConnectionTimeout(params, 10000);
- // 设置socket超时
- HttpConnectionParams.setSoTimeout(params, 10000);
-
- // 设置http https支持
- SchemeRegistry schReg = new SchemeRegistry();
- schReg.register(new Scheme("http", PlainSocketFactory
- .getSocketFactory(), 80));
- schReg.register(new Scheme("https", sf, 443));
-
- ClientConnectionManager conManager = new ThreadSafeClientConnManager(
- params, schReg);
-
- httpClient = new DefaultHttpClient(conManager, params);
- } catch (Exception e) {
- e.printStackTrace();
- return new DefaultHttpClient();
- }
- }
- return httpClient;
- }
-
- }
-
- class SSLSocketFactoryEx extends SSLSocketFactory {
-
- SSLContext sslContext = SSLContext.getInstance("TLS");
-
- public SSLSocketFactoryEx(KeyStore truststore)
- throws NoSuchAlgorithmException, KeyManagementException,
- KeyStoreException, UnrecoverableKeyException {
- super(truststore);
-
- TrustManager tm = new X509TrustManager() {
-
- @Override
- public java.security.cert.X509Certificate[] getAcceptedIssuers() {
- return null;
- }
-
- @Override
- public void checkClientTrusted(
- java.security.cert.X509Certificate[] chain, String authType)
- throws java.security.cert.CertificateException {
-
- }
-
- @Override
- public void checkServerTrusted(
- java.security.cert.X509Certificate[] chain, String authType)
- throws java.security.cert.CertificateException {
-
- }
- };
-
- sslContext.init(null, new TrustManager[] { tm }, null);
- }
-
- @Override
- public Socket createSocket(Socket socket, String host, int port,
- boolean autoClose) throws IOException, UnknownHostException {
- return sslContext.getSocketFactory().createSocket(socket, host, port,
- autoClose);
- }
-
- @Override
- public Socket createSocket() throws IOException {
- return sslContext.getSocketFactory().createSocket();
- }
- }
复制代码
ok,run下,狂乱的点到测试按钮,深吸口气,盯着eclipse中的logat。咦?神奇的竟然没有报之前的 javax.net.ssl.SSLPeerUnverifiedException: No peer certificate的异常了。服务端的数据正常返回了。 ,狂喜中... 2.了解并分析问题狂喜中,得分析这问题诶。不然老大来问,啥情况?楞半天不知道咋说( 作者就经常这样,所以吸取教训。所以的弄懂出现的问题,学习+汇报工作)。 思来想去,就是作者请求的是一个重定向https的地址。好吧,那就学习下https(之前被老大深深的教过,http就是request/response)。继续搜索吧,少年。下面总结下学习到的https知识。2.1 https HTTPS:超文本安全传输协议,和HTTP相比,多了一个SSL/TSL的认证过程,端口为443。(鄙视下之前说的)
作者没用到ssl协议呀,只是通过httpClient请求一个重定向https的地址
1.peer终端发送一个request,https服务端把支持的加密算法等以证书的形式返回一个身份信息(包含ca颁发机构和加密公钥等)。2.获取证书之后,验证证书合法性。3.随机产生一个密钥,并以证书当中的公钥加密。4.request https服务端,把用公钥加密过的密钥传送给https服务端。5.https服务端用自己的密钥解密,获取随机值。6.之后双方传送数据都用此密钥加密后通信。看下面一张网上的得来的https的时序图: 2.2分析下出现问题的原因 好吧,大概的流程知道了。定位已经非常清楚了。在第2步验证证书时,无法验证。为啥无法验证呢?没有添加信任。详细参考下http://www.cnblogs.com/P_Chou/ar ... -certification.html讲的非常清楚https-ssl的认证过程,膜拜下该作者 这样想来,上面提供的解决方案就是添加默认信任全部证书。以此来通过接下来的通信。3.解决问题但是,这样问题是解决了。但是觉得还是不带靠谱(信任全部证书 有点危险)。继续噼噼啪啪的网上搜索一番。又找到了一种解决方案,其过程大致这样的:1.浏览器访问https地址,保存提示的证书到本地,放到android项目中的assets目录。2.导入证书,代码如下。3.把证书添加为信任。
- String requestHTTPSPage(String mUrl) {
- InputStream ins = null;
- String result = "";
- try {
- ins = context.getAssets().open("app_pay.cer"); //下载的证书放到项目中的assets目录中
- CertificateFactory cerFactory = CertificateFactory
- .getInstance("X.509");
- Certificate cer = cerFactory.generateCertificate(ins);
- KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");
- keyStore.load(null, null);
- keyStore.setCertificateEntry("trust", cer);
-
- SSLSocketFactory socketFactory = new SSLSocketFactory(keyStore);
- Scheme sch = new Scheme("https", socketFactory, 443);
- HttpClient mHttpClient = new DefaultHttpClient();
- mHttpClient.getConnectionManager().getSchemeRegistry()
- .register(sch);
-
- BufferedReader reader = null;
- try {
- Log.d(TAG, "executeGet is in,murl:" + mUrl);
- HttpGet request = new HttpGet();
- request.setURI(new URI(mUrl));
- HttpResponse response = mHttpClient.execute(request);
- if (response.getStatusLine().getStatusCode() != 200) {
- request.abort();
- return result;
- }
-
- reader = new BufferedReader(new InputStreamReader(response
- .getEntity().getContent()));
- StringBuffer buffer = new StringBuffer();
- String line = null;
- while ((line = reader.readLine()) != null) {
- buffer.append(line);
- }
- result = buffer.toString();
- Log.d(TAG, "mUrl=" + mUrl + "\nresult = " + result);
- } catch (Exception e) {
- e.printStackTrace();
- } finally {
- if (reader != null) {
- reader.close();
- }
- }
- } catch (Exception e) {
- // TODO: handle exception
- } finally {
- try {
- if (ins != null)
- ins.close();
- } catch (IOException e) {
- e.printStackTrace();
- }
- }
- return result;
- }
复制代码
接着,验证下呗。吼吼,稀里糊涂的又可以了。感动的泪流满面。 最后总结:2种方法都解决了作者遇到的问题,这里记录下。以防下次遇到,希望能给遇到相同问题朋友有所参考帮助。 |