Java SSLContexts類代碼示例

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
@Bean
public RestTemplate restTemplate() throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException {

    SSLContext sslContext = SSLContexts.custom()
            .loadTrustMaterial(null, new TrustSelfSignedStrategy())
            .build();

    SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
    CloseableHttpClient httpClient = HttpClients.custom()
            .setSSLSocketFactory(sslConnectionSocketFactory)
            .build();

    HttpComponentsClientHttpRequestFactory requestFactory =
            new HttpComponentsClientHttpRequestFactory();

    requestFactory.setHttpClient(httpClient);

    return new RestTemplate(requestFactory);
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
/**
 * Will create a certificate-ignoring {@link SSLContext}. Please use with utmost caution as it undermines security,
 * but may be useful in certain testing or development scenarios.
 *
 * @return The SSLContext
 */
public static SSLContext buildCertificateIgnoringSslContext() {
	try {
		return SSLContexts
			.custom()
			.loadTrustMaterial(new TrustStrategy() {
				@Override
				public boolean isTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {
					return true;
				}
			})
			.build();
	}
	catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
		throw new IllegalStateException("Unexpected exception while building the certificate-ignoring SSLContext.", e);
	}
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
private SSLConnectionSocketFactory getSSLConnectionSocketFactory() {
	// Trust own CA and all self-signed certificates
       SSLContext sslcontext = null;
	try {
		sslcontext = SSLContexts.custom()
		        .loadTrustMaterial(new File("sepa.jks"), "*sepa.jks*".toCharArray(),new TrustSelfSignedStrategy())
		        .build();
	} catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException | CertificateException
			| IOException e1) {
		logger.error(e1.getMessage());
		return null;
	}
	
       // Allow TLSv1 protocol only
       SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
               sslcontext,
               new String[] { "TLSv1" },
               null,
               new SEPAHostnameVerifier());
       return 	sslsf;
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
private HttpClient httpClient(JiraConnectionProperties jiraConnectionProperties) {
	try {
		SSLContext sslContext = SSLContexts.custom()
			.loadTrustMaterial(
				jiraConnectionProperties.getSslTrustStore().getFile(),
				jiraConnectionProperties.getSslTrustStorePassword())
			.build();

		HostnameVerifier hostnameVerifier = SSLConnectionSocketFactory.getDefaultHostnameVerifier();
		SSLSocketFactory socketFactory = sslContext.getSocketFactory();
		LayeredConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(socketFactory, hostnameVerifier);

		if (jiraConnectionProperties.getSshJumpHost() != null) {
			sshProxy = new SshProxy();
			sslSocketFactory = new SshTunnelSslSocketFactory(sshProxy, sslSocketFactory, jiraConnectionProperties.getSshJumpHost());
		}

		return HttpClientBuilder.create()
			.setSSLSocketFactory(sslSocketFactory)
			.build();
	} catch (GeneralSecurityException | IOException e) {
		throw new JiraSyncException("Failed to build custom http client", e);
	}
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
/**
 * Sets a Safecharge's default  {@link LayeredConnectionSocketFactory} object to set connection properties,
 * such as supported SSL Protocols, hostname verifier, etc(needed to create a https connection).
 *
 * @return this object
 */
public SafechargeClientBuilder setDefaultSSLSocketFactory() {
    SSLContext sslContext = SSLContexts.createDefault();
    String[] javaSupportedProtocols = sslContext.getSupportedSSLParameters()
            .getProtocols();

    List<String> supportedProtocols = new ArrayList<>();
    for (String SERVER_SUPPORTED_SSL_PROTOCOL : SERVER_SUPPORTED_SSL_PROTOCOLS) {
        for (String javaSupportedProtocol : javaSupportedProtocols) {
            if (SERVER_SUPPORTED_SSL_PROTOCOL.equals(javaSupportedProtocol)) {
                supportedProtocols.add(SERVER_SUPPORTED_SSL_PROTOCOL);
            }
        }
    }

    if (!supportedProtocols.isEmpty()) {
        sslSocketFactory =
                new SSLConnectionSocketFactory(sslContext, supportedProtocols.toArray(new String[]{}), null, new DefaultHostnameVerifier());
    } else {
        throw new UnsupportedOperationException("Your Java version doesn't support any of the server supported SSL protocols: " + Arrays.toString(
                SERVER_SUPPORTED_SSL_PROTOCOLS));
    }
    return this;
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
@Override
public void setSslContextFilePath(String filePath) {
  if (null == partnerId) {
    throw new IllegalArgumentException("請設置partnerId的值");
  }

  File file = new File(filePath);
  if (!file.exists()) {
    throw new RuntimeException("證書文件：【" + file.getPath() + "】不存在！");
  }

  try {
    FileInputStream inputStream = new FileInputStream(file);
    KeyStore keystore = KeyStore.getInstance("PKCS12");
    char[] partnerId2charArray = partnerId.toCharArray();
    keystore.load(inputStream, partnerId2charArray);
    this.sslContext = SSLContexts.custom().loadKeyMaterial(keystore, partnerId2charArray).build();
  } catch (Exception e) {
    throw new RuntimeException("證書文件有問題，請核實！", e);
  }
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
public NestSession(String username, String password) throws LoginException {
	super();
	theLine = null;
	theBody = null;
	response = null;
	theUsername = new String(username);
	thePassword = new String(password);
	log.info("Starting Nest login...");
	retry = 0;
       // Trust own CA and all self-signed certs
       sslcontext = SSLContexts.createDefault();
       // Allow TLSv1 protocol only
       sslsf = new SSLConnectionSocketFactory(
               sslcontext,
               new String[] { "TLSv1" },
               null,
               SSLConnectionSocketFactory.getDefaultHostnameVerifier());
       globalConfig = RequestConfig.custom()
               .setCookieSpec(CookieSpecs.STANDARD)
               .build();
       
       _login();
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
private SSLConnectionSocketFactory buildSSLConnectionSocketFactory() {
  try {
    SSLContext sslcontext = SSLContexts.custom()
      //忽略掉對服務器端證書的校驗
      .loadTrustMaterial(new TrustStrategy() {
        @Override
        public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {
          return true;
        }
      }).build();

    return new SSLConnectionSocketFactory(
      sslcontext,
      new String[]{"TLSv1"},
      null,
      SSLConnectionSocketFactory.getDefaultHostnameVerifier());
  } catch (NoSuchAlgorithmException | KeyManagementException | KeyStoreException e) {
    this.log.error(e.getMessage(), e);
  }

  return null;
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
public static void setupHttpsUnirest() {
    SSLContext sslcontext = null;
    try {
        sslcontext = SSLContexts.custom().loadTrustMaterial(null, new TrustSelfSignedStrategy()).build();
    } catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
        fail(e.toString());
    }

    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext, new HostnameVerifier() {
        @Override
        public boolean verify(String hostname, SSLSession session) {
            return true;
        }
    });
    CloseableHttpClient httpclient = HttpClients.custom().setSSLSocketFactory(sslsf).build();
    Unirest.setHttpClient(httpclient);
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
/**
 * Creates {@link HttpClient} that trusts any SSL certificate
 *
 * @return prepared HTTP client
 */
protected HttpClient getSSLAcceptingClient() {
	final TrustStrategy trustAllStrategy = (final X509Certificate[] chain, final String authType) -> true;
	try {
		final SSLContext sslContext = SSLContexts.custom().loadTrustMaterial(null, trustAllStrategy).build();

		sslContext.init(null, getTrustManager(), new SecureRandom());
		final SSLConnectionSocketFactory connectionSocketFactory = new SSLConnectionSocketFactory(sslContext,
				new NoopHostnameVerifier());

		return HttpClients.custom().setSSLSocketFactory(connectionSocketFactory).build();
	} catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException error) {
		ConsoleUtils.printError(error.getMessage());
		throw new IllegalStateException(ErrorMessage.CANNOT_CREATE_SSL_SOCKET, error);
	}
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
public void setTrustedKeystore(final RestSettings.Keystore keystore) throws Exception {
    final SSLContextBuilder ssl = SSLContexts.custom();

    final String path = keystore.getPath();
    final String password = keystore.getPassword();

    final URL resource = HttpClientFactoryBean.class.getClassLoader().getResource(path);

    if (resource == null) {
        throw new FileNotFoundException(format("Keystore [%s] not found.", path));
    }

    try {
        ssl.loadTrustMaterial(resource, password == null ? null : password.toCharArray());
        builder.setSSLSocketFactory(new SSLConnectionSocketFactory(ssl.build(), getDefaultHostnameVerifier()));
    } catch (final Exception e) {
        LOG.error("Error loading keystore [{}]:", path, e); // log full exception, bean initialization code swallows it
        throw e;
    }
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
/**
 * @return
 */
private HttpClient createSSLHttpClient() {

	final TrustStrategy acceptingTrustStrategy = new TrustStrategy() {

		@Override
		public boolean isTrusted(final X509Certificate[] arg0, final String arg1) throws CertificateException {
			return true;
		}
	};

	SSLContext sslContext = null;
	try {
		sslContext = SSLContexts.custom().loadTrustMaterial(null, acceptingTrustStrategy).build();
	} catch (final Exception e) {
		System.out.println("Could not create SSLContext");
	}

	return HttpClientBuilder.create().setSSLContext(sslContext).build();
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
@Test(expected=SSLException.class)
public void testSSLTrustVerification() throws Exception {
    this.server = ServerBootstrap.bootstrap()
            .setServerInfo(LocalServerTestBase.ORIGIN)
            .setSslContext(SSLTestContexts.createServerSSLContext())
            .create();
    this.server.start();

    final HttpContext context = new BasicHttpContext();
    // Use default SSL context
    final SSLContext defaultsslcontext = SSLContexts.createDefault();

    final SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(defaultsslcontext,
            NoopHostnameVerifier.INSTANCE);

    final Socket socket = socketFactory.createSocket(context);
    final InetSocketAddress remoteAddress = new InetSocketAddress("localhost", this.server.getLocalPort());
    final HttpHost target = new HttpHost("localhost", this.server.getLocalPort(), "https");
    final SSLSocket sslSocket = (SSLSocket) socketFactory.connectSocket(0, socket, target, remoteAddress, null, context);
    sslSocket.close();
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
protected static SSLContext createSslCustomContext() throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException, KeyManagementException, UnrecoverableKeyException, NoSuchProviderException {
    // Load platform specific Trusted CA keystore
    logger.trace(() -> Arrays.toString(Security.getProviders()));
    KeyStore tks;
    switch (AppEnvironment.getInstance().getOsFamily()) {
        case WINDOWS:
            tks = KeyStore.getInstance("Windows-ROOT", "SunMSCAPI");
            tks.load(null, null);
            break;
        case OSX:
            tks = KeyStore.getInstance("KeychainStore", "Apple");
            tks.load(null, null);
            break;
        case LINUX:
        case UNSUPPORTED:
        default:
            tks = null;
            break;
    }
    return SSLContexts.custom().loadTrustMaterial(tks, null).build();
}
 

import org.apache.http.ssl.SSLContexts; //導入依賴的package包/類
public void initClientSession() throws KeyManagementException, UnrecoverableKeyException, NoSuchAlgorithmException, KeyStoreException, CertificateException, IOException {
	// Trust own CA and all self-signed certs
	SSLContext sslcontext = SSLContexts.custom()
			.loadTrustMaterial(TRUSTSTORE_FILE, TRUSTSTORE_PASS.toCharArray(),
					new TrustSelfSignedStrategy())
					.loadKeyMaterial(KEYSTORE_FILE, KEYSTORE_PASS.toCharArray(), KEYSTORE_PASS.toCharArray())
					.build();
	// Allow TLSv1 protocol only
	SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
			sslcontext,
			new String[] { "TLSv1" },
			null,
			SSLConnectionSocketFactory.getDefaultHostnameVerifier());
	this.httpclient = HttpClients.custom()
			.setSSLSocketFactory(sslsf)
			.build();
}