在Network.HTTP.Conduit中禁用SSL/TLS证书验证

Question

我使用版本为2.0+的http-conduit库从http:// URL获取内容：

import Network.HTTP.Conduit
myurl = ... -- Your URL goes here
main = do content <- simpleHttp myurl
          print $ content

运行此程序时，我遇到了以下错误：

*** Exception: TlsException (HandshakeFailed (Error_Protocol
      ("certificate rejected: certificate is not allowed to sign another certificate",
        True,CertificateUnknown)))

根据错误信息可以看出，问题在于Network.HTTP.Conduit无法适当地验证服务器证书（在本例中，证书链似乎存在问题）

我该如何更改上面的代码以忽略证书错误（即根本不验证证书）？

- Uli Köhler

Answer 1

simpleHttp本身不支持此功能。 您需要创建一个具有修改的ManagerSettings的管理器，然后使用它来获取URL。

请注意，此代码仅适用于http-conduits版本2.0+--库版本1具有类似但不同的API用于此目的。

import Network.HTTP.Conduit
import Network.Connection
import qualified Data.ByteString.Lazy.Char8 as LB

myurl = ... -- Your URL goes here

-- | Get a new Manager that doesn't verify SSL certificates
noSSLVerifyManager :: IO Manager
noSSLVerifyManager = let tlsSettings = TLSSettingsSimple {
                            -- This is where we disable certificate verification
                            settingDisableCertificateValidation = True,
                            settingDisableSession=False,
                            settingUseServerName=True}
                     in newManager $ mkManagerSettings tlsSettings Nothing

-- | Download like with simpleHttp, but using an existing manager for the task
simpleHttpWithManager :: Manager -> String -> IO LB.ByteString
simpleHttpWithManager manager url = do url' <- parseUrl url
                                       fmap responseBody $ httpLbs url' manager

main = do manager <- noSSLVerifyManager
          content <- simpleHttpWithManager manager myurl
          print $ content

请注意，仅在绝对必要的情况下禁用SSL证书验证，因为它使您容易受到中间人攻击的威胁。

- Uli Köhler