Websocket安全错误：未验证主机名

Question

我正在esp32上实现一个websocket服务器，并且在android studio Simulator上运行的应用程序上使用okhttp lib。

我正在使用由openssl命令生成的自分配证书：openssl req-newkey rsa：2048-nodes-keyout prvtkey.pem-x509-days 3650-out cacert.pem-subj“/cn=esp32 HTTPS服务器示例”

我不确定问题是出在Android/Java还是okhttp库中。

我怎么解决这个问题，已经在想量产版了？

// This solved temporarily the problem.
// I would like to generate the private key and certificate using openSsl in the right way.
// and using the hostnameVerifier correctly too.


HostnameVerifier hostnameVerifier = new HostnameVerifier()
{
    @Override
    public boolean verify(String hostname, SSLSession session)
    {
        //return true;
        
        if( hostname.equals("192.168.0.8") )
        {
            return true;
        }
        else
        {
            return false;
        }
    }
};


private final OkHttpClient client = new OkHttpClient.Builder()
                                                    .connectTimeout(5, TimeUnit.SECONDS)
                                                  //.writeTimeout(10, TimeUnit.SECONDS)
                                                  //.readTimeout(30, TimeUnit.SECONDS)
                                                    .pingInterval(25,TimeUnit.SECONDS)   
                                                    .pingInterval(25,TimeUnit.SECONDS) 
                                                    .hostnameVerifier(hostnameVerifier)
                                                    .build(); 

Answer 1

通过在主机名验证器中返回true，您可以有效地禁用任何安全性。因此，您可以只使用addInsecureHost方法来允许这些请求。请不要在你的生产应用程序中使用这个。

参见https://github.com/square/okhttp/blob/482f88300f78c3419b04379fc26c3683c10d6a9d/samples/guide/src/main/java/okhttp3/recipes/kt/devserver.kt#l40

  val clientCertificates = HandshakeCertificates.Builder()
      .addPlatformTrustedCertificates()
      .addInsecureHost("192.168.0.8")
      .build()

  val client = OkHttpClient.Builder()
      .sslSocketFactory(clientCertificates.sslSocketFactory(), clientCertificates.trustManager)
      .build()