我正在尝试连接到一个没有域名,只能通过IP地址访问的服务器。我之前尝试使用volley库来完成它,但是经过一天的研究,我无法弄清为什么SSL握手不起作用。切换到Okhttp后,我收到了警告:
javax.net.ssl.SSLPeerUnverifiedException:未验证主机名185.101.92.193: 证书:sha256 / QMgPlAslWrBi1dd / P17AKxJCniO2RfHQ5MufVO5Xji4 = DN:1.2.840.113549.1.9.1 =#1619626c61636b6a61636b34323636323440676d61696c2e636f6d,CN = 185.101.92.193,O = Internet Widgits Pty Ltd,L = Berlin,ST = Berlin,C = DE subjectAltNames:[]
现在这个问题已经在github上得到解决:https://github.com/square/okhttp/issues/1467 我用以下代码“解决”了这个问题(请看下面的HostnameVerifier):
现在这似乎是个不好的做法,我的实际问题是:如果像这样实现HostnameVerifier可能会出现什么安全问题,并且我该如何以更复杂的方式解决这个问题?
javax.net.ssl.SSLPeerUnverifiedException:未验证主机名185.101.92.193: 证书:sha256 / QMgPlAslWrBi1dd / P17AKxJCniO2RfHQ5MufVO5Xji4 = DN:1.2.840.113549.1.9.1 =#1619626c61636b6a61636b34323636323440676d61696c2e636f6d,CN = 185.101.92.193,O = Internet Widgits Pty Ltd,L = Berlin,ST = Berlin,C = DE subjectAltNames:[]
现在这个问题已经在github上得到解决:https://github.com/square/okhttp/issues/1467 我用以下代码“解决”了这个问题(请看下面的HostnameVerifier):
// loading CAs from an InputStream
try {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
InputStream cert = context.getResources().openRawResource(R.raw.servercert);
Certificate ca;
try {
ca = cf.generateCertificate(cert);
} finally {
cert.close();
}
// creating a KeyStore containing our trusted CAs
String keyStoreType = KeyStore.getDefaultType();
KeyStore keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);
// creating a TrustManager that trusts the CAs in our KeyStore
String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
tmf.init(keyStore);
// creating an SSLSocketFactory that uses our TrustManager
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, tmf.getTrustManagers(), null);
client = new OkHttpClient.Builder().sslSocketFactory(sslContext.getSocketFactory())
.hostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String s, SSLSession sslSession) {
if(s.equals(myIPAddress)){
return true;
}else{
return false;
}
}
})
.build();
}catch (Exception e){
e.printStackTrace();
}
现在这似乎是个不好的做法,我的实际问题是:如果像这样实现HostnameVerifier可能会出现什么安全问题,并且我该如何以更复杂的方式解决这个问题?