如何使用Spring RestTemplate禁用SSL证书检查?

我正在尝试编写一个集成测试,其中我们的测试使用Simple启动一个嵌入式HTTPS服务器。我使用创建了自签名证书,keytool并能够使用浏览器(特别是Chrome浏览器)访问服务器,并且收到有关自签名证书的警告。

但是,当我尝试使用Spring RestTemplate进行连接时,出现ResourceAccessException:

org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://localhost:8088":sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:557)

at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:502)

at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:444)

at net.initech.DummySslServer.shouldConnect(DummySslServer.java:119)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:47)

at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)

at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:44)

at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)

at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)

at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)

at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:271)

at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:70)

at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:50)

at org.junit.runners.ParentRunner$3.run(ParentRunner.java:238)

at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:63)

at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:236)

at org.junit.runners.ParentRunner.access$000(ParentRunner.java:53)

at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:229)

at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)

at org.junit.internal.runners.statements.RunAfters.evaluate(RunAfters.java:27)

at org.junit.runners.ParentRunner.run(ParentRunner.java:309)

at org.junit.runner.JUnitCore.run(JUnitCore.java:160)

at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:74)

at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:211)

at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:67)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at com.intellij.rt.execution.application.AppMain.main(AppMain.java:134)

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)

at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1917)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:301)

at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:295)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1369)

at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:156)

at sun.security.ssl.Handshaker.processLoop(Handshaker.java:925)

at sun.security.ssl.Handshaker.process_record(Handshaker.java:860)

at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1043)

at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343)

at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1371)

at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1355)

at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)

at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)

at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)

at org.springframework.http.client.SimpleBufferingClientHttpRequest.executeInternal(SimpleBufferingClientHttpRequest.java:78)

at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48)

at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:52)

at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:541)

... 33 more

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)

at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)

at sun.security.validator.Validator.validate(Validator.java:260)

at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)

at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)

at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)

at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1351)

... 47 more

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145)

at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)

at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)

... 53 more

从其他问题和博客 文章中,我已经看到了HostnameVerifier用类似以下内容代替的建议

private static final HostnameVerifier PROMISCUOUS_VERIFIER = ( s, sslSession ) -> true;

而且我已经在全球范围内和RestTemplate本身设置了它:

HttpsURLConnection.setDefaultHostnameVerifier( PROMISCUOUS_VERIFIER );

…及其RestTemplate本身:

final RestTemplate restTemplate = new RestTemplate();

restTemplate.setRequestFactory( new SimpleClientHttpRequestFactory() {

@Override

protected void prepareConnection(HttpURLConnection connection, String httpMethod) throws IOException {

if(connection instanceof HttpsURLConnection ){

((HttpsURLConnection) connection).setHostnameVerifier(PROMISCUOUS_VERIFIER);

}

super.prepareConnection(connection, httpMethod);

}

});

但是,我仍然遇到上述错误。我该如何解决?

  1. 不能在单元测试之外本地安装证书,因为那样将需要在每台开发机和构建服务器上手动安装证书,并且会导致大量繁琐的手续。
  2. 我们需要SSL,因为我们正在测试位于其顶部的库,RestTemplate并且我们对其进行了正确配置。

    我正在使用Java 8(但可以使用7)和Spring 4.0.3。

回答:

我希望我仍然有指向该方向的资源链接,但这是最终为我工作的代码。通过查看X509TrustManager的JavaDoc,看起来TrustManager工作方式是在成功验证后不返回任何内容,否则抛出异常。因此,使用null实现时,它将被视为成功验证。然后,你删除所有其他实现。

import javax.net.ssl.*;

import java.security.*;

import java.security.cert.X509Certificate;

public final class SSLUtil{

private static final TrustManager[] UNQUESTIONING_TRUST_MANAGER = new TrustManager[]{

new X509TrustManager() {

public java.security.cert.X509Certificate[] getAcceptedIssuers(){

return null;

}

public void checkClientTrusted( X509Certificate[] certs, String authType ){}

public void checkServerTrusted( X509Certificate[] certs, String authType ){}

}

};

public static void turnOffSslChecking() throws NoSuchAlgorithmException, KeyManagementException {

// Install the all-trusting trust manager

final SSLContext sc = SSLContext.getInstance("SSL");

sc.init( null, UNQUESTIONING_TRUST_MANAGER, null );

HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

}

public static void turnOnSslChecking() throws KeyManagementException, NoSuchAlgorithmException {

// Return it to the initial state (discovered by reflection, now hardcoded)

SSLContext.getInstance("SSL").init( null, null, null );

}

private SSLUtil(){

throw new UnsupportedOperationException( "Do not instantiate libraries.");

}

}

以上是 如何使用Spring RestTemplate禁用SSL证书检查? 的全部内容, 来源链接: utcz.com/qa/433984.html

回到顶部