httpclient繞過證書驗證進行HTTPS請求

 

 

        http請求是我們常用的一種web應用的應用層協議，但是由於它的不安全性，現在正在逐漸向https協議過渡。https協議是在http的基礎上進行了隧道加密，加密方式有SSL和TLS兩種。當server用https協議進行數據交換后，client請求server時會對server的證書進行校驗，如果server端證書為四大證書機構頒發的證書或者其授權機構頒發的證書，則允許進一步請求，否則會警告證書不受信任。更多信息可參考https://www.cnblogs.com/handsomeBoys/p/6556336.html

        當用httpclient進行請求https，會提示找不到有效的證書（unable to find valid certification path to requested target）

        出現這種情況就是server端的證書不被信任，可以通過重寫一個類繼承DefaultHttpClient類,代碼如下：

import org.apache.http.conn.ClientConnectionManager;
import org.apache.http.conn.scheme.Scheme;
import org.apache.http.conn.scheme.SchemeRegistry;
import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.impl.client.DefaultHttpClient;

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

public class SSLClient extends DefaultHttpClient {
    public SSLClient() throws Exception{
        super();
        SSLContext ctx = SSLContext.getInstance("TLS");
        X509TrustManager tm = new X509TrustManager() {
            @Override
            public void checkClientTrusted(X509Certificate[] chain,
                                           String authType) throws CertificateException {
            }
            @Override
            public void checkServerTrusted(X509Certificate[] chain,
                                           String authType) throws CertificateException {
            }
            @Override
            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };
        ctx.init(null, new TrustManager[]{tm}, null);
        SSLSocketFactory ssf = new SSLSocketFactory(ctx,SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
        ClientConnectionManager ccm = this.getConnectionManager();
        SchemeRegistry sr = ccm.getSchemeRegistry();
        sr.register(new Scheme("https", 443, ssf));
    }
}

        然后在進行https請求創建HttpClient對象時用這個類的構造器創建對象就可以實現https請求，例如：

import org.apache.http.Header;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.impl.client.CloseableHttpClient;

public class RestApi {

    public static String getCsrf(){
        String csrfToken = "";
        try {
            CloseableHttpClient client = new SSLClient();
            String url = "https://10.67.19.186";
            HttpGet get = new HttpGet(url);
            HttpResponse response = client.execute(get);
            Header setCookidHeader = response.getFirstHeader("Set-Cookie");
            csrfToken = setCookidHeader.getValue().split(";")[0].split("=")[1];
        } catch (Exception e) {
            e.printStackTrace();
        }
        return csrfToken;
    }