blocks|key|215975|text|如果服务器的证书是自签名的，那么这将按设计工作，您必须将服务器的证书导入到您的密钥库中。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|215976|假设服务器证书是由知名的CA签署的，这是因为现代浏览器可用的CA证书集比JDK/JRE附带的有限集要大得多。|215977|你提到的其中一篇文章中给出的EasySSL解决方案只是掩盖了错误，你不知道服务器是否有有效的证书。|215978|您必须将正确的根CA导入到密钥库中以验证证书。有一个原因是您不能用常用的SSL代码绕过这个问题，那就是防止您编写的程序表现得好像它们是安全的，但实际上并不安全。|215979|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|J|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|K|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|L|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|M|8|@]|9|@]|A|$]]|$1|H|3|-4|5|6|7|N|8|@]|9|@]|A|$]]]|I|$]]

If the server's certificate is self-signed, then this is working as designed and you will have to import the server's certificate into your keystore.

Assuming the server certificate is signed by a well-known CA, this is happening because the set of CA certificates available to a modern browser is much larger than the limited set that is shipped with the JDK/JRE.

The EasySSL solution given in one of the posts you mention just buries the error, and you won't know if the server has a valid certificate.

You must import the proper Root CA into your keystore to validate the certificate. There's a reason you can't get around this with the stock SSL code, and that's to prevent you from writing programs that behave as if they are secure but are not.

blocks|key|218893|text|在以下情况下抛出此异常|type|unstyled|depth|inlineStyleRanges|entityRanges|data|218894|218895|+...对等项无法标识自身(例如，没有证书、所使用的特定密码套件不支持身份验证，或者在SSL握手期间未建立对等项身份验证)，将引发此异常。|blockquote|218896|218897|218898|可能这个异常的原因(其中是堆栈跟踪)会告诉你抛出这个异常的原因。Java附带的默认密钥库很可能不包含(并信任)正在使用的TTP的根证书。|218899|答案是检索根证书(例如，从您的浏览器SSL连接)，将其导入到cacerts文件中，并使用Java+JDK附带的keytool信任它。否则，您将不得不以编程方式分配另一个信任存储区。|offset|length|style|CODE|218900|entityMap^0|0|0|0|0|0|0|U|7|1J|7|0^^$0|@$1|2|3|4|5|6|7|R|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|S|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|T|8|@]|9|@]|A|$]]|$1|F|3|-4|5|6|7|U|8|@]|9|@]|A|$]]|$1|G|3|-4|5|6|7|V|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|W|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|X|8|@$L|Y|M|Z|N|O]|$L|10|M|11|N|O]]|9|@]|A|$]]|$1|P|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|Q|$]]

This is thrown when 

<blockquote>
 ... the peer was not able to identify itself (for example; no
 certificate, the particular cipher suite being used does not support
 authentication, or no peer authentication was established during SSL
 handshaking) this exception is thrown.
</blockquote>

Probably the cause of this exception (where is the stacktrace) will show you why this exception is thrown. Most likely the default keystore shipped with Java does not contain (and trust) the root certificate of the TTP that is being used.

The answer is to retrieve the root certificate (e.g. from your browsers SSL connection), import it into the <code>cacerts</code> file and trust it using <code>keytool</code> which is shipped by the Java JDK. Otherwise you will have to assign another trust store programmatically.

blocks|key|218922|text|我不是java开发人员，但正在使用java应用程序测试RESTful应用程序接口。为了修复错误，我必须在away服务器中安装中间证书，以便消除错误。我使用的是lighttpd，原始证书安装在IIS服务器上。希望能有所帮助。这些是我在服务器上丢失的证书。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|218923|218924|CA.crt|unordered-list-item|218925|UTNAddTrustServer_CA.crt|218926|AddTrustExternalCARoot.crt|218927|218928|entityMap^0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|-4|5|6|7|N|8|@]|9|@]|A|$]]|$1|C|3|D|5|E|7|O|8|@]|9|@]|A|$]]|$1|F|3|G|5|E|7|P|8|@]|9|@]|A|$]]|$1|H|3|I|5|E|7|Q|8|@]|9|@]|A|$]]|$1|J|3|-4|5|6|7|R|8|@]|9|@]|A|$]]|$1|K|3|-4|5|6|7|S|8|@]|9|@]|A|$]]]|L|$]]

Im not a java developer but was using a java app to test a RESTful API. In order for me to fix the error I had to install the intermediate certificates in the webserver in order to make the error go away. I was using lighttpd, the original certificate was installed on an IIS server. Hope it helps. These were the certificates I had missing on the server. 

<ul>
<li>CA.crt</li>
<li>UTNAddTrustServer_CA.crt</li>
<li>AddTrustExternalCARoot.crt</li>
</ul>

blocks|key|3080498|text|keytool+-import+-v+-alias+cacerts+-keystore+cacerts.jks+-storepass+changeit+-file+C:\cacerts.cer|type|code-block|depth|inlineStyleRanges|entityRanges|data|syntax|javascript|3080499|unstyled|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$B|C]]|$1|D|3|-4|5|E|7|H|8|@]|9|@]|A|$]]]|F|$]]

<pre><code>keytool -import -v -alias cacerts -keystore cacerts.jks -storepass changeit -file C:\cacerts.cer
</code></pre>

I am building a simple app monitor to poll one of our API URLs and email us if it can't get a HTTP 200 status code from the response (this would indicate our API is down for some reason).

I am using HttpClient 4.1 (this is important because its API differs greatly from 3.x).

Our API is secure with SSL, however entering:

<blockquote>
 <a href="http://example.com/our-api" rel="noreferrer">http://example.com/our-api</a>
</blockquote>

into a web browser redirects you to

<blockquote>
 <a href="https://example.com/our-api" rel="noreferrer">https://example.com/our-api</a>
</blockquote>

Without causing any errors.

When HttpClient attempts to hit this URL (<code>http://example.com/our-api</code>), it fails with a <code>javax.net.ssl.SSLPeerUnverifiedException</code> exception with a message stating:

<blockquote>
 peer not authenticated
</blockquote>

I see this happening a lot for other people as is evidenced by <a href="https://stackoverflow.com/questions/2308774/httpget-with-https-sslpeerunverifiedexception">this</a> post (which also provides some ways of circumventing this problem - a solution that I am going to try and implement tonight in fact).

What this other post (and the other similar ones to it) do not do is explain why this is happening in the first place! So, rather than ask "how do I fix this?" I figured I would ask "why is this happening?" Before I go barging ahead with one of the proposed solutions, I'd like to know what the problem is that I'm attempting to fix ;-)

SSL "Peer Not Authenticated" error with HttpClient 4.1

身份验证

服务器

Java

我正在构建一个简单的应用程序监视器来轮询我们的API URL之一，如果它不能从响应中获得HTTP 200状态代码，则向我们发送电子邮件(这将表明我们的API由于某种原因而关闭)。我使用的是HttpClient 4.1API(这一点很重要，因为它的与3.x有很大的不同)。我们的API使用SSL是安全的，但是输入： 重定向...

问HttpClient 4.1中的SSL“对等项未验证”错误
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问HttpClient 4.1中的SSL“对等项未验证”错误EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问HttpClient 4.1中的SSL“对等项未验证”错误
EN