正确使用OkHttp验证https

短命女 2022-04-15 00:52 1170阅读 0赞

okhttp针对这块提供了：[https://github.com/square/okhttp/tree/master/okhttp-tls。使用这个就能做https的验证，不过这个模块是最近才出来的，示例也很少。网上有很多针对https的验证，主要有两种。第一种就是忽略所有的https认证，第二种就是使用X509Certificate加载证书。第一种就不说了，肯定不安全。第二种我按照文档示例调整了下：][https_github.com_square_okhttp_tree_master_okhttp-tls_https_https_https_X509Certificate]

@Test
        public void testCertificates() throws Exception {
            // 加载证书信息
            try (InputStream inStream = new Buffer().writeUtf8(cer).inputStream()) {
                CertificateFactory cf = CertificateFactory.getInstance("X.509");
                X509Certificate cert = (X509Certificate) cf.generateCertificate(inStream);
    
                // 添加信任的证书信息
                HandshakeCertificates clientCertificates = new HandshakeCertificates.Builder()
                        .addTrustedCertificate(cert)
                        .addPlatformTrustedCertificates()
                        .build();
    
                // 设置SSL
                OkHttpClient client = new OkHttpClient.Builder()
                        .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager())
                        // 需要对主机验证
                        .hostnameVerifier((s, sslSession) -> true)
                        .build();
    
                ResponseBody responseBody = responseBody("https://res.xxxx.com/ygb/idcard/12792186/DC94D3A99C39C.jpg",
                        client);
            }
        }

官方文档中主要是围绕着HandshakeCertificate，我在示例中没有使用。

其实有的https地址不做认证也是可以访问的。

[https_github.com_square_okhttp_tree_master_okhttp-tls_https_https_https_X509Certificate]: https://github.com/square/okhttp/tree/master/okhttp-tls%E3%80%82%E4%BD%BF%E7%94%A8%E8%BF%99%E4%B8%AA%E5%B0%B1%E8%83%BD%E5%81%9Ahttps%E7%9A%84%E9%AA%8C%E8%AF%81%EF%BC%8C%E4%B8%8D%E8%BF%87%E8%BF%99%E4%B8%AA%E6%A8%A1%E5%9D%97%E6%98%AF%E6%9C%80%E8%BF%91%E6%89%8D%E5%87%BA%E6%9D%A5%E7%9A%84%EF%BC%8C%E7%A4%BA%E4%BE%8B%E4%B9%9F%E5%BE%88%E5%B0%91%E3%80%82%E7%BD%91%E4%B8%8A%E6%9C%89%E5%BE%88%E5%A4%9A%E9%92%88%E5%AF%B9https%E7%9A%84%E9%AA%8C%E8%AF%81%EF%BC%8C%E4%B8%BB%E8%A6%81%E6%9C%89%E4%B8%A4%E7%A7%8D%E3%80%82%E7%AC%AC%E4%B8%80%E7%A7%8D%E5%B0%B1%E6%98%AF%E5%BF%BD%E7%95%A5%E6%89%80%E6%9C%89%E7%9A%84https%E8%AE%A4%E8%AF%81%EF%BC%8C%E7%AC%AC%E4%BA%8C%E7%A7%8D%E5%B0%B1%E6%98%AF%E4%BD%BF%E7%94%A8X509Certificate%E5%8A%A0%E8%BD%BD%E8%AF%81%E4%B9%A6%E3%80%82%E7%AC%AC%E4%B8%80%E7%A7%8D%E5%B0%B1%E4%B8%8D%E8%AF%B4%E4%BA%86%EF%BC%8C%E8%82%AF%E5%AE%9A%E4%B8%8D%E5%AE%89%E5%85%A8%E3%80%82%E7%AC%AC%E4%BA%8C%E7%A7%8D%E6%88%91%E6%8C%89%E7%85%A7%E6%96%87%E6%A1%A3%E7%A4%BA%E4%BE%8B%E8%B0%83%E6%95%B4%E4%BA%86%E4%B8%8B%EF%BC%9A