java跳过去掉https证书验证

最新推荐文章于 2025-03-10 16:57:21 发布

玉米骑士

最新推荐文章于 2025-03-10 16:57:21 发布

阅读量3.4k

点赞数 4

文章标签： java https 安全

本文链接：https://blog.youkuaiyun.com/yumi520/article/details/108863324

版权

该博客内容展示了如何在JAVA中禁用HTTPS的证书验证，通过创建信任所有证书的TrustManager和全信任的主机名验证器，从而允许不验证服务器证书和主机名。这种方法在调试或测试环境中可能有用，但在生产环境中这样做会带来安全风险。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

JAVA去掉跳过https证书验证

ps：在请求前调用此方法即可

 public static void disableSslVerification() {
        try
        {
            // Create a trust manager that does not validate certificate chains
            TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() {
                @Override
                public void checkClientTrusted(java.security.cert.X509Certificate[] x509Certificates, String s) throws CertificateException {

                }

                @Override
                public void checkServerTrusted(java.security.cert.X509Certificate[] x509Certificates, String s) throws CertificateException {

                }

                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                    return null;
                }
            }
            };
            // Install the all-trusting trust manager
            SSLContext sc = SSLContext.getInstance("SSL");
            sc.init(null, trustAllCerts, new java.security.SecureRandom());
            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
            // Create all-trusting host name verifier
            HostnameVerifier allHostsValid = new HostnameVerifier() {
                public boolean verify(String hostname, SSLSession session) {
                    return true;
                }
            };
            // Install the all-trusting host verifier
            HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }