
本文旨在解决Java REST客户端在使用`HttpURLConnection`调用HTTPS服务时遇到的`SSLHandshakeException`,特别是“No subject alternative names present”错误。文章将详细指导如何利用Apache HttpClient库,通过配置自定义SSL上下文来信任自签名或非标准证书,并禁用主机名验证,从而成功建立安全连接,克服原生API在严格证书校验下的限制。
当Java应用程序通过HTTPS协议连接外部服务时,会执行SSL/TLS握手过程以建立加密通道。此过程中,客户端会验证服务器提供的SSL证书。javax.net.ssl.SSLHandshakeException,特别是其内部的java.security.cert.CertificateException: No subject alternative names present错误,通常发生在以下场景:
原生HttpURLConnection在处理这些非标准或特定场景的证书时,缺乏灵活的配置选项,导致开发者难以绕过严格的校验机制。
为了解决上述问题,推荐使用功能更强大、配置更灵活的Apache HttpClient库。它允许开发者自定义SSL上下文,从而实现信任策略和主机名验证行为的定制。
立即学习“Java免费学习笔记(深入)”;
首先,确保项目中包含了Apache HttpClient的相关依赖。在Maven项目中,可以添加如下依赖:
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpclient</artifactId>
<version>4.5.13</version> <!-- 请使用最新稳定版本 -->
</dependency>
<dependency>
<groupId>org.apache.httpcomponents</groupId>
<artifactId>httpcore</artifactId>
<version>4.4.13</version> <!-- 与httpclient版本匹配 -->
</dependency>以下代码示例展示了如何使用Apache HttpClient配置一个能够信任自签名证书并禁用主机名验证的REST客户端:
import org.apache.http.auth.AuthenticationException;
import org.apache.http.auth.UsernamePasswordCredentials;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.config.Registry;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.conn.socket.ConnectionSocketFactory;
import org.apache.http.conn.socket.PlainConnectionSocketFactory;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.entity.StringEntity;
import org.apache.http.impl.auth.BasicScheme;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import org.apache.http.ssl.SSLContextBuilder;
import org.apache.http.protocol.HTTP; // For HTTP.UTF_8
import javax.net.ssl.SSLContext;
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.security.KeyManagementException;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
public class RestClientWithCustomSSL {
public static void main(String[] args) throws NoSuchAlgorithmException, KeyStoreException, KeyManagementException, AuthenticationException, ClientProtocolException, IOException {
String requestBody = "{\"key\": \"value\"}"; // 示例JSON请求体
String targetUrl = "https://xxx.xx.xxx.xx:port/restService"; // 目标URL
String username = "USERNAME";
String password = "PASSWORD";
// 1. 构建SSLContext,信任所有自签名证书
SSLContext sslContext = SSLContextBuilder.create()
.loadTrustMaterial(null, new TrustSelfSignedStrategy()) // 信任自签名证书策略
.build();
// 2. 创建SSLConnectionSocketFactory,禁用主机名验证
SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(
sslContext,
NoopHostnameVerifier.INSTANCE // 禁用主机名验证
);
// 3. 注册HTTP和HTTPS连接工厂
Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
.register("http", PlainConnectionSocketFactory.getSocketFactory())
.register("https", sslConnectionSocketFactory)
.build();
// 4. 使用连接管理器创建HttpClient
PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
cm.setMaxTotal(100); // 设置最大连接数
cm.setDefaultMaxPerRoute(20); // 设置每个路由的最大连接数
CloseableHttpClient client = HttpClients.custom()
.setSSLSocketFactory(sslConnectionSocketFactory) // 应用自定义的SSL Socket Factory
.setConnectionManager(cm)
.build();
try {
// 5. 创建POST请求
HttpPost request = new HttpPost(targetUrl);
// 6. 添加Basic认证头
UsernamePasswordCredentials creds = new UsernamePasswordCredentials(username, password);
request.addHeader(new BasicScheme().authenticate(creds, request, null));
// 7. 设置请求体和内容类型
StringEntity entity = new StringEntity(requestBody, HTTP.UTF_8);
request.setEntity(entity);
request.setHeader("Content-type", "application/json");
// 8. 执行请求并处理响应
CloseableHttpResponse response = client.execute(request);
try {
System.out.println("Response Status Line: " + response.getStatusLine());
BufferedReader rd = new BufferedReader(new InputStreamReader(response.getEntity().getContent()));
String line = "";
StringBuilder result = new StringBuilder();
while ((line = rd.readLine()) != null) {
result.append(line);
}
System.out.println("Response Body:\n" + result.toString());
} finally {
response.close();
}
} finally {
client.close(); // 关闭HttpClient
}
}
}虽然上述方法能够有效解决SSLHandshakeException和主机名验证问题,但需要注意其潜在的安全风险:
推荐做法:
当Java HttpURLConnection在面对SSL证书的主机名不匹配或自签名证书时,会因严格的校验机制而抛出SSLHandshakeException。Apache HttpClient提供了一个更灵活的框架,允许开发者通过自定义SSLContext和HostnameVerifier来适应这些特殊场景。虽然禁用主机名验证和信任自签名证书可以快速解决问题,但在生产环境中,务必充分考虑其安全影响,并优先采用更安全的证书管理和验证策略。
以上就是解决Java REST客户端SSL握手异常:绕过证书与主机名验证的详细内容,更多请关注php中文网其它相关文章!
每个人都需要一台速度更快、更稳定的 PC。随着时间的推移,垃圾文件、旧注册表数据和不必要的后台进程会占用资源并降低性能。幸运的是,许多工具可以让 Windows 保持平稳运行。
Copyright 2014-2025 https://www.php.cn/ All Rights Reserved | php.cn | 湘ICP备2023035733号