Question

我正在使用com.loopj.android:android-async-http:1.4.9来请求服务器。它工作正常，直到我的服务器中需要SSL / TLS。所以我需要修改我的AsyncHTTPClient以在所有网址中使用HTTPS。

我检查了类似的how to make HTTPS calls using AsyncHttpClient?，但没有提供明确的问题解决方案。由于图书馆本身的警告，所接受的解决方案也不安全：

警告！这省略了每个设备上的SSL证书验证，使用谨慎。

所以我继续检查其他解决方案。我最终遵循了https://developer.android.com/training/articles/security-ssl.html的建议。因此，我有类似的东西：

// Load CAs from an InputStream
// (could be from a resource or ByteArrayInputStream or ...)
CertificateFactory cf = CertificateFactory.getInstance("X.509");
// From https://www.washington.edu/itconnect/security/ca/load-der.crt
InputStream caInput = new BufferedInputStream(new FileInputStream("load-der.crt"));
Certificate ca;
try {
    ca = cf.generateCertificate(caInput);
    System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
} finally {
    caInput.close();
}

// Create a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);

// Create a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(keyStore);

// Create an SSLContext that uses our TrustManager
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, tmf.getTrustManagers(), null);

// Get SocketFactory from our SSLContext
//
//      !!!PROBLEM IS HERE!!!
//   
javax.net.ssl.SSLSocketFactory socketFactory = context.getSocketFactory();

正如您在最后一行中看到的那样，它从SSLSocketFactory包中提供javax.net.ssl。但是AsyncHTTPClient实例需要

asyncHTTPClient.setSSLSocketFactory(cz.msebera.android.httpclient.conn.ssl.SSLSocketFactory)

修改

我的服务器正在使用自签名证书。

Answer 1

我假设您的服务器上有自签名证书，我没有使用com.loopj.android:android-async-http:1.4.9执行此操作的代码，但我可以为您提供使用URLConnection和从资源文件夹中加载crt文件（my.server.net.crt）。：

  public static HttpsURLConnection connectSelfSignedHttps(Context ctx, String surl) throws CertificateException, IOException, KeyStoreException, NoSuchAlgorithmException, KeyManagementException {

    // Load CAs from an InputStream
    // (could be from a resource or ByteArrayInputStream or ...)
    CertificateFactory cf = CertificateFactory.getInstance("X.509");

    // 
    InputStream caInput = new BufferedInputStream(ctx.getApplicationContext().getAssets().open("my.server.net.crt"));
    Certificate ca;
    try {
      ca = cf.generateCertificate(caInput);
      //System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
    } finally {
      caInput.close();
    }

    // Create a KeyStore containing our trusted CAs
    String keyStoreType = KeyStore.getDefaultType();
    KeyStore keyStore = KeyStore.getInstance(keyStoreType);
    keyStore.load(null, null);
    keyStore.setCertificateEntry("ca", ca);

    // Create a TrustManager that trusts the CAs in our KeyStore
    String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
    tmf.init(keyStore);

    // Create an SSLContext that uses our TrustManager
    SSLContext context = SSLContext.getInstance("TLS");
    context.init(null, tmf.getTrustManagers(), null);

    // Tell the URLConnection to use a SocketFactory from our SSLContext
    URL url = new URL(surl);
    HttpsURLConnection urlConnection =
        (HttpsURLConnection)url.openConnection();
    urlConnection.setSSLSocketFactory(context.getSocketFactory());

    return urlConnection;
  }

Answer 2

正如您所见here，setSSLFactory需要SSLFactory的对象，因此您可以创建自己的MySSLFactory课程。在下面的示例中，我将其重命名为MyCustomSSLFactory。 SSL Validaton 的代码位于checkServerTrusted的{{1}}方法中。如果需要，您可以根据需要进行修改。

X509TrustManager

现在，您可以通过将自定义import java.io.BufferedInputStream; import java.io.IOException; import java.io.InputStream; import java.net.Socket; import java.security.KeyManagementException; import java.security.KeyStore; import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.security.UnrecoverableKeyException; import java.security.cert.Certificate; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.security.cert.X509Certificate; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; import cz.msebera.android.httpclient.HttpVersion; import cz.msebera.android.httpclient.conn.ClientConnectionManager; import cz.msebera.android.httpclient.conn.scheme.PlainSocketFactory; import cz.msebera.android.httpclient.conn.scheme.Scheme; import cz.msebera.android.httpclient.conn.scheme.SchemeRegistry; import cz.msebera.android.httpclient.conn.ssl.SSLSocketFactory; import cz.msebera.android.httpclient.impl.client.DefaultHttpClient; import cz.msebera.android.httpclient.impl.conn.tsccm.ThreadSafeClientConnManager; import cz.msebera.android.httpclient.params.BasicHttpParams; import cz.msebera.android.httpclient.params.HttpParams; import cz.msebera.android.httpclient.params.HttpProtocolParams; import cz.msebera.android.httpclient.protocol.HTTP; /** * Created by prerak on 15/03/2017. */ public class MyCustomSSLFactory extends SSLSocketFactory { final SSLContext sslContext = SSLContext.getInstance("TLS"); /** * Creates a new SSL Socket Factory with the given KeyStore. * * @param truststore A KeyStore to create the SSL Socket Factory in context of * @throws NoSuchAlgorithmException NoSuchAlgorithmException * @throws KeyManagementException KeyManagementException * @throws KeyStoreException KeyStoreException * @throws UnrecoverableKeyException UnrecoverableKeyException */ public MyCustomSSLFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException { super(truststore); X509TrustManager tm = new X509TrustManager() { public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException { } public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException { try { chain[0].checkValidity(); } catch (Exception e) { throw new CertificateException("Certificate not valid or trusted."); } } public X509Certificate[] getAcceptedIssuers() { return null; } }; sslContext.init(null, new TrustManager[]{tm}, null); } /** * Gets a KeyStore containing the Certificate * * @param cert InputStream of the Certificate * @return KeyStore */ public static KeyStore getKeystoreOfCA(InputStream cert) { // Load CAs from an InputStream InputStream caInput = null; Certificate ca = null; try { CertificateFactory cf = CertificateFactory.getInstance("X.509"); caInput = new BufferedInputStream(cert); ca = cf.generateCertificate(caInput); } catch (CertificateException e1) { e1.printStackTrace(); } finally { try { if (caInput != null) { caInput.close(); } } catch (IOException e) { e.printStackTrace(); } } // Create a KeyStore containing our trusted CAs String keyStoreType = KeyStore.getDefaultType(); KeyStore keyStore = null; try { keyStore = KeyStore.getInstance(keyStoreType); keyStore.load(null, null); keyStore.setCertificateEntry("ca", ca); } catch (Exception e) { e.printStackTrace(); } return keyStore; } /** * Gets a Default KeyStore * * @return KeyStore */ public static KeyStore getKeystore() { KeyStore trustStore = null; try { trustStore = KeyStore.getInstance(KeyStore.getDefaultType()); trustStore.load(null, null); } catch (Throwable t) { t.printStackTrace(); } return trustStore; } /** * Returns a SSlSocketFactory which trusts all certificates * * @return SSLSocketFactory */ public static SSLSocketFactory getFixedSocketFactory() { SSLSocketFactory socketFactory; try { socketFactory = new MyCustomSSLFactory(getKeystore()); socketFactory.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); } catch (Throwable t) { t.printStackTrace(); socketFactory = SSLSocketFactory.getSocketFactory(); } return socketFactory; } /** * Gets a DefaultHttpClient which trusts a set of certificates specified by the KeyStore * * @param keyStore custom provided KeyStore instance * @return DefaultHttpClient */ public static DefaultHttpClient getNewHttpClient(KeyStore keyStore) { try { SSLSocketFactory sf = new MyCustomSSLFactory(keyStore); SchemeRegistry registry = new SchemeRegistry(); registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80)); registry.register(new Scheme("https", sf, 443)); HttpParams params = new BasicHttpParams(); HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1); HttpProtocolParams.setContentCharset(params, HTTP.UTF_8); ClientConnectionManager ccm = new ThreadSafeClientConnManager(params, registry); return new DefaultHttpClient(ccm, params); } catch (Exception e) { return new DefaultHttpClient(); } } @Override public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException { return sslContext.getSocketFactory().createSocket(socket, host, port, autoClose); } @Override public Socket createSocket() throws IOException { return sslContext.getSocketFactory().createSocket(); } /** * Makes HttpsURLConnection trusts a set of certificates specified by the KeyStore */ public void fixHttpsURLConnection() { HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory()); } }传递给MyCustomSSLSocketFactory来初始化KeyStore对象。

MyCustomSSLFactory socketFactory = new MyCustomSSLFactory(keyStore);

现在您可以将套接字工厂设置为：

asyncHTTPClient.setSSLSocketFactory(socketFactory);

Answer 3

你可以使用@ Prerak的解决方案。看起来该解决方案有效。这是我自己的版本。它与@ Prerak类似，但是构造函数更短：

public CustomSSLSocketFactory(KeyStore truststore) throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException, UnrecoverableKeyException {
    super(truststore);

    // Create a TrustManager that trusts the CAs in our KeyStore
    String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
    tmf.init(truststore);

    // Create an SSLContext that uses our TrustManager
    sslContext.init(null, tmf.getTrustManagers(), null);
}

设置AsyncHttpClient以使用HTTPS

3 个答案: