Android ssl：javax.net.ssl.SSLPeerUnverifiedException：没有同行证书（再次）

问题描述：

我有一个网站，我启用SSL启用RESTful服务。我们已经在RapidSSL上注册，安装了证书，并通过了RapidSSL checker。我可以通过各种浏览器访问网站，包括android浏览器（内置，firefox和opera），没有任何问题，也没有警告。Android ssl：javax.net.ssl.SSLPeerUnverifiedException：没有同行证书（再次）

然而，当我试图用我的Android应用程序访问它，我得到以下异常：

08-11 20:04:05.586 363 381 E HttpProvider: Error executing request: No peer certificate 
08-11 20:04:05.586 363 381 E HttpProvider: javax.net.ssl.SSLPeerUnverifiedException: No peer certificate 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.harmony.xnet.provider.jsse.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:259) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:93) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.conn.ssl.SSLSocketFactory.createSocket(SSLSocketFactory.java:381) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:164) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:164) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:119) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:359) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:555) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:487) 
08-11 20:04:05.586 363 381 E HttpProvider: at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:465) 
08-11 20:04:05.586 363 381 E HttpProvider: at com.xxxxx.netlib.http.HttpProvider.executeRequest(HttpProvider.java:75)

这发生在仿真器上的Android 2.3.3和3.2平板电脑。我已经看到很多关于这个的点击，但是我发现没有找到任何帮助我解决问题的方法。

更多的数据：

$ openssl s_client -CAfile www.xxxxx.com.pem -connect www.xxxxx.com:443 
CONNECTED(00000003) 
depth=3 C = US, O = Equifax, OU = Equifax Secure Certificate Authority 
verify return:1 
depth=2 C = US, O = GeoTrust Inc., CN = GeoTrust Global CA 
verify return:1 
depth=1 C = US, O = "GeoTrust, Inc.", CN = RapidSSL CA 
verify return:1 
depth=0 serialNumber = 1-7wArtEjdTwJ94d5iVDooDmmC4mXyVj, OU = GT82425783, OU = See www.rapidssl.com/resources/cps (c)12, OU = Domain Control Validated - RapidSSL(R), CN = www.xxxxx.com 
verify return:1 
--- 
Certificate chain 
0 s:/serialNumber=1-7wArtEjdTwJ94d5iVDooDmmC4mXyVj/OU=GT82425783/OU=See www.rapidssl.com/resources/cps (c)12/OU=Domain Control Validated - RapidSSL(R)/CN=www.xxxxx.com 
    i:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA 
1 s:/C=US/O=GeoTrust, Inc./CN=RapidSSL CA 
    i:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 
2 s:/C=US/O=GeoTrust Inc./CN=GeoTrust Global CA 
    i:/C=US/O=Equifax/OU=Equifax Secure Certificate Authority 
--- 
[snip]

我正在建立客户端代码：

public class HttpProvider implements INetworkProvider { 
    private static final String LOG = "HttpProvider"; 
    protected DefaultHttpClient client; 

    public HttpProvider() { 
    SchemeRegistry registry = new SchemeRegistry(); 
    registry.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80)); 
    final SSLSocketFactory sslSocketFactory = SSLSocketFactory.getSocketFactory(); 
    sslSocketFactory.setHostnameVerifier(SSLSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER); 
    registry.register(new Scheme("https", sslSocketFactory, 443)); 

    client = new DefaultHttpClient(
     new ThreadSafeClientConnManager((new BasicHttpParams()), registry), new BasicHttpParams() 
    ); 
    } 
[snip]

我也试图与STRICT_HOSTNAME_VERIFIER和仍然没有喜悦。

根据我的理解，我不需要设置任何自定义的信任库或密钥库，因为我已向认可的证书提供者进行了注册。

我对ssl很新，发现我在三字缩写的海洋里游泳，我希望这里有人能够给我一个正确的方向。

我已经想出了如何转储出系统信任存储，并且我没有在那里看到RapidSSL，尽管帖子说它是在蜂窝中。我会尝试创建自己的信任库，看看会发生什么。 – mvsjes2 2012-08-16 17:48:00

试试这个：https：//stackoverflow.com/a/38598593/2301721（使用HttpsURLConnection） – ashishdhiman2007 2017-05-30 09:46:44

答

经过一堆堆的挖掘和实验后，我终于意识到我使用的网址已经硬编码80端口，而不是默认为443.哑哑哑。

这个问题的答案Trusting all certificates using HttpClient over HTTPS对我对SSL的理解有很大的帮助。

Android ssl：javax.net.ssl.SSLPeerUnverifiedException：没有同行证书（再次）

相关推荐