一、前言

最近在對(duì)接騰訊會(huì)議API接口，在鑒權(quán)完成后開始調(diào)用對(duì)方的接口，在此過程中出現(xiàn)調(diào)用報(bào)錯(cuò)：javax.net.ssl.SSLHandshakeException。

二、出現(xiàn)原因

當(dāng)你在進(jìn)行https請(qǐng)求時(shí)，JDK中不存在三方服務(wù)的信任證書，導(dǎo)致出現(xiàn)錯(cuò)誤javax.net.ssl.SSLHandshakeException：sun.security.validator.ValidatorException：PKIX路徑構(gòu)建失敗。

三、解決方法

1、獲取根證書安裝證書到你的JRE的Java cacerts中（安裝證書到PATHTOYOURJDK/JRE/lib目錄/ cacerts中）。

2、忽略SSL證書的校驗(yàn)。

這里因?yàn)楹芏嗲闆r沒有證書，所以采用第二種方案，在你的代碼中進(jìn)行忽略SSL證書校驗(yàn)。

四、代碼

這里要區(qū)分你使用的是那種方式調(diào)用三方服務(wù)（RestTemplate 、OkHttpClient）。

1、RestTemplate

package com.hikvision.meeting.config;

import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;

import javax.net.ssl.*;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;


/**
 * @author dongliang7
 * @projectName 
 * @ClassName Config2RestTemplate.java
 * @description: 跳過證書效驗(yàn)
 * @createTime 2021年11月23日 09:59:00
 */
@Configuration
public class Config2RestTemplate {

    @Bean
    public RestTemplate restTemplate() throws Exception {
        TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -> true;

        SSLContext sslContext = org.apache.http.ssl.SSLContexts.custom()
                .loadTrustMaterial(null, acceptingTrustStrategy)
                .build();

//        SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext);
        SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(createIgnoreVerifySSL(),
                // 指定TLS版本
                null,
                // 指定算法
                null,
                // 取消域名驗(yàn)證
                new HostnameVerifier() {
                    @Override
                    public boolean verify(String string, SSLSession ssls) {
                        return true;
                    }
                });

        CloseableHttpClient httpClient = HttpClients.custom()
                .setSSLSocketFactory(csf)
                .build();

        HttpComponentsClientHttpRequestFactory requestFactory =
                new HttpComponentsClientHttpRequestFactory();

        requestFactory.setHttpClient(httpClient);
        requestFactory.setReadTimeout(60 * 1000);// ms
        requestFactory.setConnectTimeout(60 * 1000);// ms
        // 該代碼的意思是請(qǐng)求工廠類是否應(yīng)用緩沖請(qǐng)求正文內(nèi)部，默認(rèn)值為true，當(dāng)post或者put大文件的時(shí)候會(huì)造成內(nèi)存溢出情況，設(shè)置為false將數(shù)據(jù)直接流入底層HttpURLConnection
        requestFactory.setBufferRequestBody(false);
        RestTemplate restTemplate = new RestTemplate(requestFactory);
        return restTemplate;
    }

    /**
     * 跳過證書效驗(yàn)的sslcontext
     *
     * @return
     * @throws Exception
     */
    private static SSLContext createIgnoreVerifySSL() throws Exception {
        SSLContext sc = SSLContext.getInstance("TLS");

        // 實(shí)現(xiàn)一個(gè)X509TrustManager接口，用于繞過驗(yàn)證，不用修改里面的方法
        X509TrustManager trustManager = new X509TrustManager() {
            @Override
            public void checkClientTrusted(X509Certificate[] paramArrayOfX509Certificate,
                                           String paramString) throws CertificateException {
            }

            @Override
            public void checkServerTrusted(X509Certificate[] paramArrayOfX509Certificate,
                                           String paramString) throws CertificateException {
            }

            @Override
            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };
        sc.init(null, new TrustManager[] { trustManager }, null);
        return sc;
    }
}

2、OkHttpClient

package com.tencent.wemeet.gateway.restapisdk.util;

import lombok.extern.slf4j.Slf4j;
import okhttp3.OkHttpClient;

import javax.net.ssl.*;
import java.security.KeyStore;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;
import java.util.concurrent.TimeUnit;

/**
 * @author dongliang7
 * @projectName tenxun-meeting-api
 * @ClassName SSLSocketClient.java
 * @description: 創(chuàng)建 OkHttpClient 不進(jìn)行SSL（證書）驗(yàn)證
 * @createTime 2021年11月19日 09:50:00
 */
@Slf4j
public class SSLSocketClient {

    public static OkHttpClient getUnsafeOkHttpClient() {
        try {
            // 創(chuàng)建不驗(yàn)證證書鏈的信任管理器
            final TrustManager[] trustAllCerts = new TrustManager[]{
                    new X509TrustManager() {
                        @Override
                        public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) {}
                        @Override
                        public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) {}
                        @Override
                        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                            return new java.security.cert.X509Certificate[]{};
                        }
                    }
            };
            if (trustAllCerts.length != 1 || !(trustAllCerts[0] instanceof X509TrustManager)) {
                throw new IllegalStateException("Unexpected default trust managers:" + Arrays.toString(trustAllCerts));
            }
            X509TrustManager x509TrustManager = (X509TrustManager) trustAllCerts[0];

            // 安裝全信任信任管理器
            final SSLContext sslContext = SSLContext.getInstance("SSL");
            sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
            // 使用我們完全信任的管理器創(chuàng)建 ssl 套接字工廠
            final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();

            OkHttpClient.Builder builder = new OkHttpClient.Builder()
                    .connectTimeout(60 , TimeUnit.SECONDS).readTimeout(60 , TimeUnit.SECONDS).writeTimeout(120 , TimeUnit.SECONDS);
            builder.sslSocketFactory(sslSocketFactory , x509TrustManager);
            builder.hostnameVerifier(new HostnameVerifier() {
                @Override
                public boolean verify(String hostname, SSLSession session) {
                    return true;
                }
            });
            OkHttpClient okHttpClient = builder.build();
            return okHttpClient;
        } catch (Exception e) {
            log.error("創(chuàng)建OkHttpClient不進(jìn)行SSL（證書）驗(yàn)證失?。簕}", e.getMessage());
            throw new RuntimeException(e);
        }
    }
}

獲取OkHttpClient ：

//創(chuàng)建 OkHttpClient 不進(jìn)行SSL（證書）驗(yàn)證
    private static final OkHttpClient okHttpClient = SSLSocketClient.getUnsafeOkHttpClient();

在minio中的運(yùn)用

 minioClient = MinioClient.builder()
                        .endpoint(minioUrl, Integer.parseInt(minioUrl.substring(minioUrl.lastIndexOf(":")+1,minioUrl.length()-1)),true)
                        .credentials(minioName, minioPass)
                        .httpClient(okHttpClient)
                        .build();

轉(zhuǎn)載自：https://www.cnblogs.com/dongl961230/p/15594627.html文章來源地址http://www.zghlxwxcb.cn/news/detail-539639.html

到了這里，關(guān)于解決遠(yuǎn)程調(diào)用三方接口：javax.net.ssl.SSLHandshakeException報(bào)錯(cuò)的文章就介紹完了。如果您還想了解更多內(nèi)容，請(qǐng)?jiān)谟疑辖撬阉鱐OY模板網(wǎng)以前的文章或繼續(xù)瀏覽下面的相關(guān)文章，希望大家以后多多支持TOY模板網(wǎng)！