JAVA如何自動下載SSL證書并導入到本地

更新時間：2023年07月29日 09:23:07 作者：假大叔

這篇文章主要介紹了JAVA如何自動下載SSL證書并導入到本地問題，具有很好的參考價值，希望對大家有所幫助。如有錯誤或未考慮完全的地方，望不吝賜教

前言

基于https的訪問很多情況下是需要證書認證。

解決辦法不外乎幾個。

忽略SSL證書
導入ssl證書

第一種

可以用下面這行代碼

以下這行代碼是全局性的，表示當前程序所有請求都不會驗證SSL的可靠性，慎用。

另外使用OKHTTP的話，在構建的時候，對SSLSocketFactory和HostnameVerifier設置相同的屬性即可。

// 全局關閉SSL認證
DisableSSLCertificateCheckUtil.disableChecks();

工具類 DisableSSLCertificateCheckUtil.java

package com.ygsoft.hzc.tool;
import javax.net.ssl.*;
import java.io.IOException;
import java.net.URL;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
public final class DisableSSLCertificateCheckUtil {
    /**
     * Prevent instantiation of utility class.
     */
    private DisableSSLCertificateCheckUtil() {
    }
    /**
     * Disable trust checks for SSL connections.
     */
    public static void disableChecks() {
        try {
            new URL("https://0.0.0.0/").getContent();
        } catch (IOException e) {
            // This invocation will always fail, but it will register the
            // default SSL provider to the URL class.
        }
        try {
            SSLContext sslc;
            sslc = SSLContext.getInstance("TLS");
            TrustManager[] trustManagerArray = {new X509TrustManager() {
                @Override
                public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                }
                @Override
                public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                }
                @Override
                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }
            }};
            sslc.init(null, trustManagerArray, null);
            HttpsURLConnection.setDefaultSSLSocketFactory(sslc.getSocketFactory());
            HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
                @Override
                public boolean verify(String s, SSLSession sslSession) {
                    return true;
                }
            });
        } catch (Exception e) {
            e.printStackTrace();
            throw new IllegalArgumentException("證書校驗異常！");
        }
    }
}

第二種

在這里我貼出一個自己寫的證書導入工具類，復制粘貼即可用。

默認是443端口，根據需要可自己修改ssl的端口

邏輯

發(fā)起請求之前先檢查證書是否已經存在硬盤并導入到系統(tǒng)，如果沒有，那么主動下載并導入到系統(tǒng)。

代碼片段

URL urlnormal = new URL(fullUrl);
//加載證書
if(urlnormal.getProtocol().equals("https")){
	String sslpath = FileUtil.getCertPath()+urlnormal.getHost().replaceAll("[.]", "");
	//如果不存在ssl證書，那么創(chuàng)建導入一個證書
	if(!new File(sslpath).exists()){
		SSLCertUtil.importCert(urlnormal.getHost(), null);
	}
	System.setProperty("javax.net.ssl.trustStore", sslpath);				
}
// 發(fā)情HTTP 請求
......
.....

工具類 SSLCertUtil .java

package com.hzc.tool;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLException;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
/**
 * 自動導入證書.
 * @author huangzongcheng
 * 2017.06.13
 */
public class SSLCertUtil {  
	private static final String TAG = SSLCertUtil.class.getSimpleName();
	public static void main(String[] args) {
		try {
			importCert("www.kuaidi100.com",null);
		} catch (Exception e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
	}
	/**
	 * 淇濆瓨瀵煎叆SSL璇佷功
	 * @param url
	 * @param pwd
	 * @throws Exception
	 */
    public static void importCert(String url,String pwd) throws Exception {  
    	LogUtil.d(TAG, "http url format = xxx.com[:port] ");
    	LogUtil.d(TAG, String.format("getting %s info",url));
    	//瑙ｆ瀽鍦板潃錛屽垎紱葷鍙?
	    String[] urlformat = url.split(":");  
        String host = urlformat[0];  
        int port = (urlformat.length == 1) ? 443 : Integer.parseInt(urlformat[1]);  
        String p = StringUtil.isEmpty(pwd) ? "changeit" : pwd;  
        char[] passphrase = p.toCharArray();  
        String certName = host.replaceAll("[.]", "");
	    File file = new File(certName);  
	    if (file.isFile() == false) {  
	        char SEP = File.separatorChar;  
	        File dir = new File(System.getProperty("java.home") + SEP + "lib" + SEP + "security");  
	        file = new File(dir, certName);  
	        if (file.isFile() == false) {  
	        	file = new File(dir, "cacerts");  
	        }  
	    }  
	    LogUtil.d(TAG,String.format("loading keystore %s", file));
	    InputStream in = new FileInputStream(file);  
	    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());  
	    ks.load(in, passphrase);  
	    in.close();  
	    SSLContext context = SSLContext.getInstance("TLS");  
	    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());  
	    tmf.init(ks);  
	    X509TrustManager defaultTrustManager = (X509TrustManager)tmf.getTrustManagers()[0];  
	    SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);  
	    context.init(null, new TrustManager[] {tm}, null);  
	    SSLSocketFactory factory = context.getSocketFactory();  
	    LogUtil.d(TAG,String.format("opening connection to %s:%d", host,port));
	    SSLSocket socket = (SSLSocket)factory.createSocket(host, port);  
	    socket.setSoTimeout(10000);  
	    try {  
	        LogUtil.d(TAG,"Starting SSL handshake");
	        socket.startHandshake();  
	        socket.close();  
	        LogUtil.d(TAG,"No errors, certificate is already trusted");  
	    } catch (SSLException e) {  
	        System.out.println();  
	        e.printStackTrace(System.out);  
	    }  
	    X509Certificate[] chain = tm.chain;  
	    if (chain == null) {  
	        LogUtil.d(TAG,"Could not obtain server certificate chain");  
	        return;  
	    }  
	    LogUtil.d(TAG,"Server sent " + chain.length + " certificate(s):");
	    MessageDigest sha1 = MessageDigest.getInstance("SHA1");  
	    MessageDigest md5 = MessageDigest.getInstance("MD5");  
	    for (int i = 0; i < chain.length; i++) {  
	        X509Certificate cert = chain[i];
	        System.out.println (" " + (i + 1) + " Subject " + cert.getSubjectDN());  
	        System.out.println("   Issuer  " + cert.getIssuerDN());  
	        sha1.update(cert.getEncoded());  
	        System.out.println("   sha1    " + toHexString(sha1.digest()));  
	        md5.update(cert.getEncoded());  
	        System.out.println("   md5     " + toHexString(md5.digest()));  
	        System.out.println();  
	    }  
	    int k = 0; 
	    X509Certificate cert = chain[k];  
	    String alias = host.replaceAll("[.]", "");  
	    ks.setCertificateEntry(alias, cert);  
	    OutputStream out = new FileOutputStream(FileUtil.getCertPath()+certName);  
	    ks.store(out, passphrase);  
	    out.close();  
	    System.out.println(cert);  
	    System.out.println("Added certificate to keystore "+certName+" using alias '"+ alias + "'");  
    }  
    private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();  
    private static String toHexString(byte[] bytes) {  
	    StringBuilder sb = new StringBuilder(bytes.length * 3);  
	    for (int b : bytes) {  
	        b &= 0xff;  
	        sb.append(HEXDIGITS[b >> 4]);  
	        sb.append(HEXDIGITS[b & 15]);  
	        sb.append(' ');  
	    }  
	    return sb.toString();  
    }  
    private static class SavingTrustManager implements X509TrustManager {  
	    private final X509TrustManager tm;  
	    private X509Certificate[] chain;  
	    SavingTrustManager(X509TrustManager tm) {  
	        this.tm = tm;  
	    }  
	    public X509Certificate[] getAcceptedIssuers() {  
	        throw new UnsupportedOperationException();  
	    }  
	    public void checkClientTrusted(X509Certificate[] chain, String authType)  
	        throws CertificateException {  
	        throw new UnsupportedOperationException();  
	    }  
	    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {  
	        this.chain = chain;  
	        tm.checkServerTrusted(chain, authType);  
	    }  
    }  
}