解决PKIX path building failed的问题

Java在请求某些不受信任的https网站时会报：PKIX path building failed

解决方法一：使用keytool手动导入证书，为JRE环境导入信任证书

参考：http://www.cnblogs.com/wanghaixing/p/5630070.html

方法二：使用代码下载证书保存

参考：https://blog.csdn.net/frankcheng5143/article/details/52164939

方法三：服务器不信任我们自己创建的证书，所以在代码中忽略证书信任问题。

参考：http://mengyang.iteye.com/blog/575671

最后注意：检查eclipse/myeclipse的JDK或JRE，是否为你导入证书的JRE。

注意：myeclipse是自带JDK的，JDK中自带JRE，而我们通过命令导入的jre是系统环境变量下path的jre。

两者很可能不是同一个，要改myeclipse的配置。(具体操作很简单，windows-->preferences-->搜索jre)

方法二代码实现

功能：把目标host证书保存到jre/lib/security/jssecacerts文件，亲测有效

import java.io.BufferedReader;
import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStream;
import java.security.*;
import javax.net.ssl.*;
import java.security.cert.*;
import org.junit.Test;

public class certUtils {
	private int port = 443;
	private char[] passphrase="changeit".toCharArray();

	/**
	 * @param host 例：www.80s.tw
	 * @param port	https默认为443端口
	 * @param passphrase keyStore密码
	 */
	public void installCert(String host, int port, char[] passphrase) {
		//文件分隔符
		char SEP = File.separatorChar;
		//获取jre/lib/security目录
		File dir = new File(System.getProperty("java.home") + SEP + "lib" + SEP
				+ "security");
		//新建文件jre/lib/security/jssecacerts,向文件输出时文件才真正创建
		File file = new File(dir, "jssecacerts");
		//jssecacerts文件不存在时，获取jre/lib/security/cacerts文件索引
		if (file.isFile() == false) {
			file = new File(dir, "cacerts");
		}
		System.out.println("Loading KeyStore " + file + "...");
		try {
			InputStream in = new FileInputStream(file);
			KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
			ks.load(in, passphrase);
			in.close();
			SSLContext context = SSLContext.getInstance("TLS");
			TrustManagerFactory tmf = TrustManagerFactory
					.getInstance(TrustManagerFactory.getDefaultAlgorithm());
			tmf.init(ks);
			X509TrustManager defaultTrustManager = (X509TrustManager) tmf
					.getTrustManagers()[0];
			SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
			context.init(null, new TrustManager[] { tm }, null);
			SSLSocketFactory factory = context.getSocketFactory();

			//与目标主机进行连接
			System.out.println("Opening connection to " + host + ":" + port);
			try {
				SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
				socket.setSoTimeout(10000);
				System.out.println("Starting SSL handshake...");
				socket.startHandshake();
				socket.close();
				System.out.println("No errors, certificate is already trusted");
			} catch (Exception e) {
				e.printStackTrace();
			}

			X509Certificate[] chain = tm.chain;
			if (chain == null) {
				return;
			}

			BufferedReader reader = new BufferedReader(new InputStreamReader(
					System.in));
			MessageDigest sha1 = MessageDigest.getInstance("SHA1");
			MessageDigest md5 = MessageDigest.getInstance("MD5");
			for (int i = 0; i < chain.length; i++) {
				X509Certificate cert = chain[i];
				sha1.update(cert.getEncoded());
				md5.update(cert.getEncoded());
			}
			// 默认证书链第一个
			int index = 0;
			X509Certificate cert = chain[index];
			String alias = host + "-" + (index + 1);
			ks.setCertificateEntry(alias, cert);

			// keyStore保存到文件jssecacerts
			File jssecacerts = new File(dir, "jssecacerts");
			OutputStream out = new FileOutputStream(jssecacerts);
			ks.store(out, passphrase);
			out.close();

			System.out.println("-----打印cert-----");
			System.out.println(cert);
		} catch (Exception e) {
			e.printStackTrace();
		}
	}

	private final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

	private String toHexString(byte[] bytes) {
		StringBuilder sb = new StringBuilder(bytes.length * 3);
		for (int b : bytes) {
			b &= 0xff;
			sb.append(HEXDIGITS[b >> 4]);
			sb.append(HEXDIGITS[b & 15]);
			sb.append(' ');
		}
		return sb.toString();
	}

	private class SavingTrustManager implements X509TrustManager {

		private final X509TrustManager tm;
		private X509Certificate[] chain;

		SavingTrustManager(X509TrustManager tm) {
			this.tm = tm;
		}

		public X509Certificate[] getAcceptedIssuers() {
			throw new UnsupportedOperationException();
		}

		public void checkClientTrusted(X509Certificate[] chain, String authType)
				throws CertificateException {
			throw new UnsupportedOperationException();
		}

		public void checkServerTrusted(X509Certificate[] chain, String authType)
				throws CertificateException {
			this.chain = chain;
			tm.checkServerTrusted(chain, authType);
		}
	}
}

　　

查看证书

keytool -list -v -alias aurora -keystore "C:/Program Files/Java/jdk1.7.0_03/jre/lib/security/cacerts" -storepass changeit  
这条命令是在JDK安装的密钥库中，查找别名是aurora的证书，密钥库口令是changeit。

删除证书

keytool -delete -alias aurora -keystore "C:/Program Files/Java/jdk1.7.0_03/jre/lib/security/cacerts" -storepass changeit
删除别名是aurora的证书。

方法三代码实现

　　只要在创建connection之前调用两个方法：

　　由于有网友这么说：这样做是放弃了证书的认证，那你们用https还有什么意义呢？就好像搭建了一个https的server，最后在认证失败的时候放弃认证，直接选择信任，那么这个https的server就沦落为一个http的server了，而且性能要比http差

　　在下就没有测试，请自行测试。

trustAllHttpsCertificates();
HttpsURLConnection.setDefaultHostnameVerifier(hv);

　　

HostnameVerifier hv = new HostnameVerifier() {
        public boolean verify(String urlHostName, SSLSession session) {
            System.out.println("Warning: URL Host: " + urlHostName + " vs. "
                               + session.getPeerHost());
            return true;
        }
    };

	private static void trustAllHttpsCertificates() throws Exception {
		javax.net.ssl.TrustManager[] trustAllCerts = new javax.net.ssl.TrustManager[1];
		javax.net.ssl.TrustManager tm = new miTM();
		trustAllCerts[0] = tm;
		javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext
				.getInstance("SSL");
		sc.init(null, trustAllCerts, null);
		javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc
				.getSocketFactory());
	}

	static class miTM implements javax.net.ssl.TrustManager,
			javax.net.ssl.X509TrustManager {
		public java.security.cert.X509Certificate[] getAcceptedIssuers() {
			return null;
		}

		public boolean isServerTrusted(
				java.security.cert.X509Certificate[] certs) {
			return true;
		}

		public boolean isClientTrusted(
				java.security.cert.X509Certificate[] certs) {
			return true;
		}

		public void checkServerTrusted(
				java.security.cert.X509Certificate[] certs, String authType)
				throws java.security.cert.CertificateException {
			return;
		}

		public void checkClientTrusted(
				java.security.cert.X509Certificate[] certs, String authType)
				throws java.security.cert.CertificateException {
			return;
		}
	}