本文介紹了如何為okHttp相互TLS連接添加SSL證書？的處理方法，對大家解決問題具有一定的參考價值，需要的朋友們下面隨著小編來一起學習吧！
問題描述
我已經有一個.pem和一個.key文件，我不想在本地安裝/導入它，只告訴我的客戶端使用它們，可以嗎？它不是自簽名證書
基本上，在我的卷發中，我正在做這樣的事情：
curl --key mykey.key --cert mycert.pem https://someurl.com/my-endpoint
我已檢查此答案
How to make https request with ssl certificate in Retrofit
這也https://github.com/square/okhttp/blob/master/samples/guide/src/main/java/okhttp3/recipes/CustomTrust.java(但可能沒有意義，因為我沒有獲得所需類型的對象)
基本上我有我的okHttpClient
val okHttpClient = OkHttpClient.Builder()
.sslSocketFactory(?, ?) //here I tried to call sslSocketFactory, trustManager following the example from the CustomTrust.java
.build()
有什么解決方案嗎？
我也檢查了此文檔，但仍然沒有完成SSL部分，也沒有完成示例
https://square.github.io/okhttp/https/#customizing-trusted-certificates-kt-java
所以我嘗試這樣做(基于okhttp示例)
private fun trustedCertificatesInputStream(): InputStream {
val comodoRsaCertificationAuthority = (""
+ "-----BEGIN CERTIFICATE-----
" +
"-----END CERTIFICATE-----")
return Buffer()
.writeUtf8(comodoRsaCertificationAuthority)
.inputStream()
}
val loggingInterceptor = HttpLoggingInterceptor().apply {
level = HttpLoggingInterceptor.Level.BODY
}
fun createClient() : OkHttpClient {
val trustManager: X509TrustManager
val sslSocketFactory: SSLSocketFactory
try {
trustManager = trustManagerForCertificates(trustedCertificatesInputStream())
val sslContext = SSLContext.getInstance("TLS")
sslContext.init(null, arrayOf<TrustManager>(trustManager), null)
sslSocketFactory = sslContext.socketFactory
} catch (e: GeneralSecurityException) {
throw RuntimeException(e)
}
return OkHttpClient.Builder()
.sslSocketFactory(sslSocketFactory, trustManager)
.connectTimeout(45, TimeUnit.SECONDS)
.readTimeout(45, TimeUnit.SECONDS)
.protocols(listOf(Protocol.HTTP_1_1))
.addInterceptor(loggingInterceptor)
.build()
}
@Throws(GeneralSecurityException::class)
private fun trustManagerForCertificates(input: InputStream): X509TrustManager {
val certificateFactory: CertificateFactory = CertificateFactory.getInstance("X.509")
val certificates: Collection<Certificate?> = certificateFactory.generateCertificates(input)
val password = "password".toCharArray() // Any password will work.
val keyStore = newEmptyKeyStore(password)
for ((index, certificate) in certificates.withIndex()) {
val certificateAlias = index.toString()
keyStore.setCertificateEntry(certificateAlias, certificate)
}
// Use it to build an X509 trust manager.
val keyManagerFactory: KeyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm())
keyManagerFactory.init(keyStore, password)
val trustManagerFactory: TrustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
trustManagerFactory.init(keyStore)
val trustManagers: Array<TrustManager> = trustManagerFactory.getTrustManagers()
return trustManagers[0]!! as X509TrustManager
}
@Throws(GeneralSecurityException::class)
private fun newEmptyKeyStore(password: CharArray): KeyStore {
return try {
val keyStore = KeyStore.getInstance(KeyStore.getDefaultType())
val inputStream: InputStream? = null // By convention, 'null' creates an empty key store.
keyStore.load(inputStream, password)
keyStore
} catch (e: IOException) {
throw AssertionError(e)
}
}
我得到一個錯誤
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
搜索錯誤似乎應該在本地安裝SSL，但我應該避免這樣做，因為我無法在服務器中以這種方式安裝它，有什么方法可以讓它工作嗎？
TLS
我假定您要配置推薦答案相互身份驗證，這就是它們密鑰的用途？
查看okhttp-tls，其中包含將證書和私鑰轉換為相應Java對象的API。
這篇關于如何為okHttp相互TLS連接添加SSL證書？的文章就介紹到這了，希望我們推薦的答案對大家有所幫助，
