Question

自版本4.3.6起，Apache HttpClient中禁用了SSLv3，但我使用的是版本4.5。 developers wrote：

希望继续使用SSLv3的用户需要明确启用对它的支持。

我尝试在JVM级别设置支持的协议，但它没有工作。示例是在Scala中，但这与问题无关：

System.setProperty("https.protocols", "SSLv2Hello,SSLv3,TLSv1,TLSv1.1,TLSv1.2")

我的第二次尝试是：

val instance: CloseableHttpClient = {
  val trustStrategy = new TrustStrategy {
    override def isTrusted(x509Certificates: Array[X509Certificate], s: String) = true
  }
  val sslContext = new SSLContextBuilder().loadTrustMaterial(null, trustStrategy).build()
  val sslSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE)
  val socketFactoryRegistry =
    RegistryBuilder.create[ConnectionSocketFactory]()
        .register("http", PlainConnectionSocketFactory.getSocketFactory)
        .register("https", sslSocketFactory)
        .build()
  val connectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry)
  HttpClients.custom()
      .disableRedirectHandling()
      .setSSLContext(sslContext)
      .setConnectionManager(connectionManager)
      .build()
}

但它也没有用。

如何使用Apache HttpClient 4.5连接支持SSLv2Hello，SSLv3，TLSv1，TLSv1.1，TLSv1.2的主机？

Answer 1

默认情况下，HttpClient不会考虑系统属性。其中一个要么指示HttpClient构建器执行此操作

CloseableHttpClient client = HttpClients.createSystem();

或使用自定义协议设置手动配置连接套接字工厂

SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(
        SSLContext.getDefault(),
        new String[] { "SSLv2Hello","SSLv3","TLSv1","TLSv1.1","TLSv1.2"},
        null,
        SSLConnectionSocketFactory.getDefaultHostnameVerifier());
Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
        .register("http", PlainConnectionSocketFactory.getSocketFactory())
        .register("https", socketFactory)
        .build();

PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
CloseableHttpClient client = HttpClients.custom().setConnectionManager(cm).build();

修改

此代码段与评论中提到的网站一样正常

SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory( SSLContext.getDefault(), new String[] {"TLSv1"}, null, SSLConnectionSocketFactory.getDefaultHostnameVerifier()); Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create() .register("http", PlainConnectionSocketFactory.getSocketFactory()) .register("https", socketFactory) .build(); PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(socketFactoryRegistry); CloseableHttpClient client = HttpClients.custom().setConnectionManager(cm).build(); try (CloseableHttpResponse response = client.execute(new HttpGet("https://www.ethz.ch/de.html"))) { System.out.println(response.getStatusLine()); System.out.println(EntityUtils.toString(response.getEntity())); }

如何使用Apache HttpClient启用SSLv3？

1 个答案: