WebService系列之Axis Https(SSL)證書校驗錯誤處理方法

WebService系列之Axis Https(SSL)證照校驗錯誤處理方法

最近在用Axis呼叫https的介面，丟擲異常：

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

異常原因是ssl證照校驗失敗，因為自己網站是http的，對方公司是https的介面，所以證照校驗失敗，處理方法是在網上找的一個不錯的方法，思路是重寫一個不驗證證照的SocketFactory，Axis預設SocketFactory，會對server端的證照進行驗證，導致驗證異常

package com.common.utils.web;

import org.apache.axis.components.net.BooleanHolder;
import org.apache.axis.components.net.JSSESocketFactory;
import org.apache.axis.components.net.SecureSocketFactory;

import javax.net.ssl.*;
import java.io.IOException;
import java.net.Socket;
import java.security.KeyStore;
import java.util.Hashtable;

import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

/**
 * <pre>
 *    Axis自定義JSSESocketFactory
 * </pre>
 *
 * <pre>
 * @author mazq
 * 修改記錄
 *    修改後版本:     修改人：  修改日期: 2020/12/12 14:44  修改內容:
 * </pre>
 */
public class WSTLSSocketSecureFactory extends JSSESocketFactory implements SecureSocketFactory {
    public WSTLSSocketSecureFactory(Hashtable attributes) {
        super(attributes);
    }
    @Override
    public Socket create(String host, int port, StringBuffer otherHeaders, BooleanHolder useFullURL)
            throws Exception{
        Socket s = super.create(host, port, otherHeaders, useFullURL);
        ((SSLSocket)s).setEnabledProtocols(new String[] {"SSLv2Hello", "SSLv3", "TLSv1"});
        return s;
    }

    @Override
    protected void initFactory() throws IOException {
        SSLContext context = null;
        try {
            context = getContext();
        } catch (Exception e) {
            e.printStackTrace();
        }
        this.sslFactory = context.getSocketFactory();

    }

    protected SSLContext getContext() throws Exception {
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        TrustManager[] trustAllCerts = new TrustManager[] {
                new X509TrustManager() {
                    public X509Certificate[] getAcceptedIssuers() {
                        return null;
                    }
                    public void checkClientTrusted(X509Certificate[] certs, String authType) {
                        // Trust always
                    }
                    public void checkServerTrusted(X509Certificate[] certs, String authType) {
                        // Trust always
                    }
                }
        };

        // Install the all-trusting trust manager
        SSLContext sslContext = SSLContext.getInstance("SSL");
        // Create empty HostnameVerifier
        HostnameVerifier hv = new HostnameVerifier() {
            public boolean verify(String arg0, SSLSession arg1) {
                return true;
            }
        };

        sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
        return sslContext;
    }
}

客戶端呼叫時設定setProperty：

 // 支援Https Webservice介面呼叫 
AxisProperties.setProperty("axis.socketSecureFactory", WSTLSSocketSecureFactory.class.getName());

注意點，不同版本jdk對TLS驗證是有差別的：oracle官網部落格Diagnosing TLS, SSL, and HTTPS列出了差別

補充知識點：

• SSL：SSL 是“Secure Sockets Layer”的縮寫，是在上世紀90年代中期，由網景公司設計的
• TLS：IETF 就在那年把 SSL 標準化。標準化之後的名稱改為 TLS（是“Transport Layer Security”的縮寫），中文叫做“傳輸層安全協議”