blocks|key|1212121|text|如果它想要*.someUrl.com，那么看起来你可以给它www.someUrl.com/somePath而不是someUrl.com/somePath。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1212122|entityMap^0|5|D|T|O|1K|K|0^^$0|@$1|2|3|4|5|6|7|H|8|@$9|I|A|J|B|C]|$9|K|A|L|B|C]|$9|M|A|N|B|C]]|D|@]|E|$]]|$1|F|3|-4|5|6|7|O|8|@]|D|@]|E|$]]]|G|$]]

If it wants <code>*.someUrl.com</code>, then it seems like you could just give it <code>www.someUrl.com/somePath</code> instead of <code>someUrl.com/somePath</code>.

blocks|key|1212159|text|Android上的BouncyCastle太旧了，不能识别通配符证书。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1212160|您可以编写自己的X509TrustManager来检查通配符。|1212161|或者，如果您可以接受风险，则可以完全禁用证书检查。看这个问题，|1212162|Self-signed+SSL+acceptance+on+Android|offset|length|1212163|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/questions/1217141/self-signed-ssl-acceptance-android^0|0|0|0|0|11|0|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|S|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|T|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|U|8|@]|9|@$H|V|I|W|1|X]]|A|$]]|$1|J|3|-4|5|6|7|Y|8|@]|9|@]|A|$]]]|K|$L|$5|M|N|O|A|$P|Q]]]]

The BouncyCastle on Android is too old and it doesn't recognize wildcard certificate. 

You can write your own X509TrustManager to check for wildcard. 

or you can disable certificate check altogether if you can accept the risk. See this question,

<a href="https://stackoverflow.com/questions/1217141/self-signed-ssl-acceptance-android">Self-signed SSL acceptance on Android</a>

blocks|key|997949|text|这是我(编辑过的)解决方案：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|997950|class+MyVerifier+extends+AbstractVerifier+{

++++private+final+X509HostnameVerifier+delegate;

++++public+MyVerifier(final+X509HostnameVerifier+delegate)+{
++++++++this.delegate+=+delegate;
++++}

++++@Override
++++public+void+verify(String+host,+String[]+cns,+String[]+subjectAlts)
++++++++++++++++throws+SSLException+{
++++++++boolean+ok+=+false;
++++++++try+{
++++++++++++delegate.verify(host,+cns,+subjectAlts);
++++++++}+catch+(SSLException+e)+{
++++++++++++for+(String+cn+:+cns)+{
++++++++++++++++if+(cn.startsWith("*."))+{
++++++++++++++++++++try+{
++++++++++++++++++++++++++delegate.verify(host,+new+String[]+{+
++++++++++++++++++++++++++++++++cn.substring(2)+},+subjectAlts);
++++++++++++++++++++++++++ok+=+true;
++++++++++++++++++++}+catch+(Exception+e1)+{+}
++++++++++++++++}
++++++++++++}
++++++++++++if(!ok)+throw+e;
++++++++}
++++}
}


public+DefaultHttpClient+getTolerantClient()+{
++++DefaultHttpClient+client+=+new+DefaultHttpClient();
++++SSLSocketFactory+sslSocketFactory+=+(SSLSocketFactory)+client
++++++++++++.getConnectionManager().getSchemeRegistry().getScheme("https")
++++++++++++.getSocketFactory();
++++final+X509HostnameVerifier+delegate+=+sslSocketFactory.getHostnameVerifier();
++++if(!(delegate+instanceof+MyVerifier))+{
++++++++sslSocketFactory.setHostnameVerifier(new+MyVerifier(delegate));
++++}
++++return+client;
}|code-block|syntax|javascript|997951|它的优点是，除非存在通配符域，否则不会更改默认行为，在这种情况下，它会重新验证，就好像两部分的域(例如，someUrl.com)是证书的一部分一样，否则会重新抛出原始异常。这意味着真正无效的证书仍然会失败。|997952|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

This is my (edited) solution:

<pre><code>class MyVerifier extends AbstractVerifier {

 private final X509HostnameVerifier delegate;

 public MyVerifier(final X509HostnameVerifier delegate) {
 this.delegate = delegate;
 }

 @Override
 public void verify(String host, String[] cns, String[] subjectAlts)
 throws SSLException {
 boolean ok = false;
 try {
 delegate.verify(host, cns, subjectAlts);
 } catch (SSLException e) {
 for (String cn : cns) {
 if (cn.startsWith("*.")) {
 try {
 delegate.verify(host, new String[] { 
 cn.substring(2) }, subjectAlts);
 ok = true;
 } catch (Exception e1) { }
 }
 }
 if(!ok) throw e;
 }
 }
}


public DefaultHttpClient getTolerantClient() {
 DefaultHttpClient client = new DefaultHttpClient();
 SSLSocketFactory sslSocketFactory = (SSLSocketFactory) client
 .getConnectionManager().getSchemeRegistry().getScheme("https")
 .getSocketFactory();
 final X509HostnameVerifier delegate = sslSocketFactory.getHostnameVerifier();
 if(!(delegate instanceof MyVerifier)) {
 sslSocketFactory.setHostnameVerifier(new MyVerifier(delegate));
 }
 return client;
}
</code></pre>

It has the advantage of not changing the default behavior unless there is a wildcard domain, and in that case it revalidates as though the 2 part domain (e.g., someUrl.com) were part of the certificate, otherwise the original exception is rethrown. That means truly invalid certs will still fail.

blocks|key|1212236|text|如果使用WebView，只需调用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1212237|webview.clearSslPreferences();|code-block|syntax|javascript|1212238|忽略SSL错误的步骤|1212239|entityMap^0|0|0|0^^$0|@$1|2|3|4|5|6|7|K|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|L|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|M|8|@]|9|@]|A|$]]|$1|I|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|J|$]]

if you use a WebView just call 

<pre><code>webview.clearSslPreferences();
</code></pre>

to ignore SSL errors

I'm using HttpClient on Android to connect to <a href="https://someUrl.com/somePath" rel="noreferrer">https://someUrl.com/somePath</a>. The problem is that the site's certificate is for *.someUrl.com, not someUrl.com, so I get an SSLException. Lame on the part of the site, yes, but unless I can get it fixed, I'm stuck. Is there a way I can get HttpClient to relax and accept the certificate?

Android HttpClient - hostname in certificate didn't match <example.com> != <*.example.com>

Android

我正在使用安卓系统上的HttpClient连接到。问题是站点的证书是针对*.someUrl.com的，而不是针对someUrl.com的，所以我得到了一个SSLException。网站的问题，是的，但除非我能把它修好，否则我就卡住了。有没有办法让HttpClient放松下来，接受证书？

问Android HttpClient -证书中的主机名与<example.com> != <*.example.com>不匹配
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Android HttpClient -证书中的主机名与<example.com> != <*.example.com>不匹配EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问Android HttpClient -证书中的主机名与<example.com> != <*.example.com>不匹配
EN