我编写了使用 Dumb X509TrustManager和HostnameVerifier的Jersey RESTful客户端来信任我们实验室系统上的所有SSL证书,以便更轻松地处理自签名的证书。
ClientConfig config = new DefaultClientConfig();
SSLContext context = null;
try
{
context = SSLContext.getInstance("SSL");
context.init(null,
new TrustManager[] { new DumbX509TrustManager() },
null);
config.getProperties()
.put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES,
new HTTPSProperties(this.getHostnameVerifier(),
context));
webClient = Client.create(config);
}
....
我有办法使用CXF做类似的事情吗?
答案 0 :(得分:7)
这是来自CXF邮件列表。请注意,由于其他系统更新,我没有必要实现它,所以这是理论上的:
WebClient webClient = WebClient.create(this.serviceURL,
this.username,
this.password,
null); // Spring config file - we don't use this
if (trustAllCerts)
{
HTTPConduit conduit = WebClient.getConfig(webClient)
.getHttpConduit();
TLSClientParameters params =
conduit.getTlsClientParameters();
if (params == null)
{
params = new TLSClientParameters();
conduit.setTlsClientParameters(params);
}
params.setTrustManagers(new TrustManager[] { new
DumbX509TrustManager() });
params.setDisableCNCheck(true);
}
答案 1 :(得分:0)
要完成sdoca的答案,下面是一个带有哑巴X509信任管理器的实现:
import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.jaxrs.client.WebClient;
import org.apache.cxf.transport.http.HTTPConduit;
[...]
public class ApiClient {
private WebClient webClient;
[...]
public void init() {
webClient = createWebClient(URI).accept(MediaType.APPLICATION_JSON).type(MediaType.APPLICATION_JSON);
addX509TrustManager();
}
private void addX509TrustManager() {
Assert.notNull(webClient, "Client needs to be initialized");
HTTPConduit conduit = WebClient.getConfig(webClient).getHttpConduit();
TLSClientParameters params = conduit.getTlsClientParameters();
if (params == null) {
params = new TLSClientParameters();
conduit.setTlsClientParameters(params);
}
params.setTrustManagers(new TrustManager[] { new BlindTrustManager() });
params.setDisableCNCheck(true);
}
}
其中BlindTrustManager的定义如下:
import java.security.cert.X509Certificate;
import javax.net.ssl.X509TrustManager;
/**
* This dumb X509TrustManager trusts all certificate. TThis SHOULD NOT be used in Production.
*/
public class BlindTrustManager implements X509TrustManager {
@Override
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws java.security.cert.CertificateException {
}
@Override
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws java.security.cert.CertificateException {
}
@Override
public X509Certificate[] getAcceptedIssuers() {
return null;
}
}
检查此链接以获得更好的理解可能会很有用: