在OkHttp中信任/白名单证书（找不到证书路径的信任锚）

Question

我遇到了Android4设备的一个问题，它在连接到服务器时收到以下异常：

但出于某种原因，我不明白它在Android4版本中开始失败了。

我尝试了信任所有证书的解决方案[LINK]，它起作用了，但这显然存在安全问题，比如将您的应用程序暴露于“中间人”攻击

final TrustManager[] trustAllCerts = new TrustManager[]{
        new X509TrustManager() {
            @Override
            public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
            }

            @Override
            public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
            }

            @Override
            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                return new java.security.cert.X509Certificate[]{};
            }
        }
};
final SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
okHttpBuilder.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0]);

如何实现具有默认行为但仅将服务器的证书白名单的TrustManager。

openssl s_client -showcerts -servername www.serverdomain.com -connect www.serverdomain.com:443

在证书链给了我两个证书的格式：

-----BEGIN CERTIFICATE-----
....
-----END CERTIFICATE-----

用获得的url和证书替换了示例中的url和证书，但它仍然不起作用，有什么想法吗？

Answer 1

您需要将ur certificat存储到原始文件夹中，然后：

CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream instream = context.getResources().openRawResource(R.raw.gtux_cert);
Certificate ca;
try {
    ca = cf.generateCertificate(instream);
} finally {
    caInput.close();
}

KeyStore kStore = KeyStore.getInstance(KeyStore.getDefaultType());
kStore.load(null, null);
kStore.setCertificateEntry("ca", ca);

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm(););
tmf.init(kStore);

SSLContext context = SSLContext.getInstance("TLS");
context.init(null, tmf.getTrustManagers(), null);

okHttpClient.setSslSocketFactory(context.getSocketFactory());

此处提供更多信息：安全SSL