解决HttpClient中HTTPS请求证书域名和请求域名不匹配时报错的问题

问题描述

使用HttpClient（版本4.5）进行HTTPS请求时，如果目标主机和证书域名不一致时(比如在测试或开发环境中使用生产的证书或生成证书时未指定)会报错：

javax.net.ssl.SSLPeerUnverifiedException: Certificate for <> doesn't match any of the subject alternative names: []
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.verifyHostname(SSLConnectionSocketFactory.java:467)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:397)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:359)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)
    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)
    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)
    at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
    at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)
    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)

解决办法

1. 最好的解决办法当然是搞清楚为什么证书域名不匹配，是不是服务方给了你一个假证书。一般情况下，在生产环境上肯定是一致的，否则你的网站会被浏览器拦截。

2. 为了开发调试顺利进行，我这里在代码层面绕过了SSL域名验证：

SSLContext sslcontext = sslContext(keyStorePath, keyStorePassword);
        Registry socketFactoryRegistry = RegistryBuilder.create()
                .register("http", PlainConnectionSocketFactory.INSTANCE)
                // 正常的SSL连接会验证码所有证书信息
                // .register("https", new SSLConnectionSocketFactory(sslcontext)).build();
                //  只忽略域名验证码
                .register("https", new SSLConnectionSocketFactory(sslcontext, NoopHostnameVerifier.INSTANCE)).build();

这里的 NoopHostnameVerifier.INSTANCE该主机名验证器本质上会关闭主机名验证。它接受任何有效的和符合目标主机的SSL会话。

具体的示例代码：

public static ClientResponse postSSL(String url, String resquestBody, String keyStorePath,
            String keyStorePassword) {
        SSLContext sslcontext = sslContext(keyStorePath, keyStorePassword);
        Registry socketFactoryRegistry = RegistryBuilder.create()
                .register("http", PlainConnectionSocketFactory.INSTANCE)
                // 正常的SSL连接会验证码所有证书信息
                // .register("https", new SSLConnectionSocketFactory(sslcontext)).build();
                //  只忽略域名验证码
                .register("https", new SSLConnectionSocketFactory(sslcontext, NoopHostnameVerifier.INSTANCE)).build();
            
        HttpClientConnectionManager connManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
        HttpClients.custom().setConnectionManager(connManager);

        ClientResponse rsp = null;
        try ( // 创建post方式请求对象
                CloseableHttpClient client = HttpClients.custom().
                setConnectionManager(connManager).build();) {
            // 设置连接超时时间
            RequestConfig requestConfig = RequestConfig.custom().setConnectionRequestTimeout(CONNECTION_REQUEST_TIMEOUT)
                    .setConnectTimeout(CONNECT_TIME_OUT).setSocketTimeout(SOCKET_TIME_OUT).build();
            // 创建httpclient对象
            HttpPost httpPost = new HttpPost(url);
            httpPost.setConfig(requestConfig);
            // 2 直接是拼接好的key=value或者json字符串等
            httpPost.setEntity(new StringEntity(resquestBody, Const.CHARSET_UTF8));
            // 执行请求操作，并拿到结果
            CloseableHttpResponse response = client.execute(httpPost);
            rsp = new ClientResponse();
            // 获取响应头
            Header[] rspHeaders = response.getAllHeaders();
            if (ArrayUtils.isNotEmpty(rspHeaders)) {
                Map tmp = new HashMap<>();
                for (Header header : rspHeaders) {
                    tmp.put(header.getName(), header.getValue());
                }
            }
            // 响应码
            rsp.setResponseCode(response.getStatusLine().getStatusCode());
            // 获取结果实体
            HttpEntity entity = response.getEntity();
            if (entity != null) {
                /*
                 * 按指定编码转换结果实体为String类型。 如果这行报错 connection
                 * reset，那么有可能是链路不通或者post的url过长。
                 */
                String body = EntityUtils.toString(entity, Const.CHARSET_UTF8);
                rsp.setResponseContent(body);
            }
            // 关闭流
            EntityUtils.consume(entity);
            // 释放链接
            response.close();
            // 关闭客户端
            client.close();
        } catch (Exception e) {
            LOGGER.error("请求出错", e);
        }
        return rsp;
    }

    /**
     * 设置信任自签名证书
     * 
     * @param keyStorePath
     *            密钥库路径
     * @param keyStorepass
     *            密钥库密码
     * @return
     */
    public static SSLContext sslContext(String keyStorePath, String keyStorepass) {
        SSLContext sc = null;
        FileInputStream instream = null;
        KeyStore trustStore = null;
        try {
            trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            // 加载密钥库
            instream = new FileInputStream(new File(keyStorePath));
            trustStore.load(instream, keyStorepass.toCharArray());
            // 相信自己的CA和所有自签名的证书
            sc = SSLContexts.custom().loadTrustMaterial(trustStore, new TrustSelfSignedStrategy()).build();
        } catch (Exception e) {
            LOGGER.error("HTTPS请求初始化SSL异常", e);
        } finally {
            CloseUtil.close(instream);
        }
        return sc;
    }