没有为Android SSL连接找到信任锚

我得到的错误消息是类似的，但原因是自签名证书已经过期。 当尝试openssl客户端时，它给了我一个原因，当我从firefox中检查证书对话框时忽略了这个原因

因此，通常情况下，如果证书在密钥存储库中并且它是“VALID”，则此错误将消失。

在姜饼手机中，我总是得到这个错误:Trust Anchor not found for Android SSL Connection，即使我设置依赖于我的证书。

下面是我使用的代码(在Scala语言中):

object Security {
private def createCtxSsl(ctx: Context) = {
val cer = {
val is = ctx.getAssets.open("mycertificate.crt")
try
CertificateFactory.getInstance("X.509").generateCertificate(is)
finally
is.close()
}
val key = KeyStore.getInstance(KeyStore.getDefaultType)
key.load(null, null)
key.setCertificateEntry("ca", cer)


val tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm)
tmf.init(key)


val c = SSLContext.getInstance("TLS")
c.init(null, tmf.getTrustManagers, null)
c
}


def prepare(url: HttpURLConnection)(implicit ctx: Context) {
url match {
case https: HttpsURLConnection ⇒
val cSsl = ctxSsl match {
case None ⇒
val res = createCtxSsl(ctx)
ctxSsl = Some(res)
res
case Some(c) ⇒ c
}
https.setSSLSocketFactory(cSsl.getSocketFactory)
case _ ⇒
}
}


def noSecurity(url: HttpURLConnection) {
url match {
case https: HttpsURLConnection ⇒
https.setHostnameVerifier(new HostnameVerifier {
override def verify(hostname: String, session: SSLSession) = true
})
case _ ⇒
}
}
}

下面是连接代码:

def connect(securize: HttpURLConnection ⇒ Unit) {
val conn = url.openConnection().asInstanceOf[HttpURLConnection]
securize(conn)
conn.connect();
....
}


try {
connect(Security.prepare)
} catch {
case ex: SSLHandshakeException /*if ex.getMessage != null && ex.getMessage.contains("Trust anchor for certification path not found")*/ ⇒
connect(Security.noSecurity)
}

基本上，我在自定义证书上设置了信任。如果失败，我就禁用安全机制。这不是最好的选择，但这是我所知道的对于老旧和有问题的手机的唯一选择。

这个示例代码，可以很容易地翻译成Java。

我有同样的问题，我发现我提供的证书.crt文件缺少一个中间证书。所以我从我的服务器管理员那里询问了所有的.crt文件，然后按相反的顺序将它们连接起来。

在Windows I执行 复制国际米兰。crt + Root。crt newCertificate.crt < / p >

(这里我忽略了myCrt.crt)

然后我提供newCertificate。CRT文件通过输入流转换成代码。 工作。< / p >

**Set proper alias name**
CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509","BC");
X509Certificate cert = (X509Certificate) certificateFactory.generateCertificate(derInputStream);
String alias = cert.getSubjectX500Principal().getName();
KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
trustStore.load(null);
trustStore.setCertificateEntry(alias, cert);

您可以在运行时信任某个证书 只需从服务器下载它，放入资产并像这样使用ssl-utils-android:

OkHttpClient client = new OkHttpClient();
SSLContext sslContext = SslUtils.getSslContextForCertificateFile(context, "BPClass2RootCA-sha2.cer");
client.setSslSocketFactory(sslContext.getSocketFactory());

在上面的例子中，我使用了OkHttpClient，但是SSLContext可以用于Java中的任何客户端。

如果你有任何问题，请提出来。我是这个小图书馆的作者。

根据最新的Android文档(2017年3月)更新:

当你得到这种类型的错误:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.
at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:374)
at libcore.net.http.HttpConnection.setupSecureSocket(HttpConnection.java:209)
at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.makeSslConnection(HttpsURLConnectionImpl.java:478)
at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:433)
at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:290)
at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:240)
at libcore.net.http.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:282)
at libcore.net.http.HttpURLConnectionImpl.getInputStream(HttpURLConnectionImpl.java:177)
at libcore.net.http.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:271)

问题可能是以下情况之一:

1. 颁发服务器证书的CA未知
2. 服务器证书不是由CA签署的，而是自签署的
3. 服务器配置缺少一个中间CA

解决方案是教会HttpsURLConnection信任一组特定的ca。怎么做?请检查https://developer.android.com/training/articles/security-ssl.html#CommonProblems

其他正在使用com.loopj.android:android-async-http库中的AsyncHTTPClient的人，请检查设置AsyncHttpClient使用HTTPS。

回复一个很旧的帖子。但也许它会帮助一些新手，如果以上都行不通的话。

我知道没人想听废话解释;而是解决方案。但是在一行代码中，您试图从本地计算机访问服务到不信任您的计算机的远程计算机。您的请求需要获得远程服务器的信任。

解决方案:下面的解决方案假设你满足以下条件

1. 试图从本地机器访问远程api。
2. 你正在为Android应用开发
3. 您的远程服务器在代理过滤下(您在浏览器设置中使用代理来访问远程api服务，通常是登台或开发服务器)
4. 你是在真实的设备上测试

步骤:

你需要一个.keystore扩展文件来注册你的应用。如果你不知道如何创建.keystore文件;然后按照下面的section创建.keystore文件进行操作，否则跳到下一节签署Apk文件

创建.keystore文件

打开Android Studio。单击顶部菜单Build > Generate Signed APK。在下一个窗口中单击创建新的…按钮。在新窗口中，请在所有字段中输入数据。记住我建议的两个密码字段应该有相同的密码;不要使用不同的密码;还要记住最上面字段密钥库路径:的保存路径。输入所有字段后单击OK按钮。

签署Apk文件

现在需要使用刚才创建的.keystore文件构建一个签名应用程序。遵循以下步骤

1. 建立>清洁项目，等待直到它完成清洁
2. 生成签名APK
3. 单击Choose existing...按钮
4. 选择我们刚刚在创建.keystore文件部分中创建的.keystore文件
5. 输入您在创建.keystore文件部分创建时创建的相同密码。Key store password和Key password字段使用相同的密码。还要输入别名
6. 点击下一步按钮
7. 在下一个屏幕中;根据你在build.gradle文件中的设置可能会有所不同，你需要选择Build Types和Flavors。
8. 对于Build Types，从下拉菜单中选择release

9. 对于Flavors，但是它将取决于你在build.gradle文件中的设置。从这个字段中选择staging。我在build.gradle中使用了以下设置，您可以使用与我相同的设置，但请确保将applicationId更改为您的包名

   productFlavors {
   staging {
   applicationId "com.yourapplication.package"
   manifestPlaceholders = [icon: "@drawable/ic_launcher"]
   buildConfigField "boolean", "CATALYST_DEBUG", "true"
   buildConfigField "boolean", "ALLOW_INVALID_CERTIFICATE", "true"
   }
   production {
   buildConfigField "boolean", "CATALYST_DEBUG", "false"
   buildConfigField "boolean", "ALLOW_INVALID_CERTIFICATE", "false"
   }
   }
   

10. Click the bottom two Signature Versions checkboxes and click Finish button.

Almost There:

All the hardwork is done, now the movement of truth. Inorder to access the Staging server backed-up by proxy, you need to make some setting in your real testing Android devices.

Proxy Setting in Android Device:

1. Click the Setting inside Android phone and then wi-fi
2. Long press on the connected wifi and select Modify network
3. Click the Advanced options if you can't see the Proxy Hostname field
4. In the Proxy Hostname enter the host IP or name you want to connect. A typical staging server will be named as stg.api.mygoodcompany.com
5. For the port enter the four digit port number for example 9502
6. Hit the Save button

One Last Stop:

Remember we generated the signed apk file in Sign APK File section. Now is the time to install that APK file.

1. Open a terminal and changed to the signed apk file folder
2. Connect your Android device to your machine
3. Remove any previous installed apk file from the Android device
4. Run adb install name of the apk file
5. If for some reason the above command return with adb command not found. Enter the full path as C:\Users\shah\AppData\Local\Android\sdk\platform-tools\adb.exe install name of the apk file

I hope the problem might be solved. If not please leave me a comments.

Salam!

在我的例子中，这发生在更新到Android 8.0之后。Android设置为信任的自签名证书使用的是签名算法SHA1withRSA。切换到新的证书，使用签名算法sha256withthrsa解决了这个问题。

产生信任锚错误的原因有很多。对我来说，这只是我试图访问https://example.com/而不是https://www.example.com/。

因此，在开始构建自己的信任管理器(就像我做的那样)之前，您可能需要仔细检查您的url。

我知道你不需要信任所有的证书，但在我的案例中，我在一些调试环境中遇到了问题，我们有自签名证书，我需要一个脏的解决方案。

我所要做的就是改变sslContext的初始化

mySSLContext.init(null, trustAllCerts, null);

其中trustAllCerts是这样创建的:

private final TrustManager[] trustAllCerts= new TrustManager[] { new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return new java.security.cert.X509Certificate[]{};
}


public void checkClientTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
}


public void checkServerTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
}
} };

希望这能派上用场。

如果你使用改装，你需要自定义你的OkHttpClient。

retrofit = new Retrofit.Builder()
.baseUrl(ApplicationData.FINAL_URL)
.client(getUnsafeOkHttpClient().build())
.addConverterFactory(GsonConverterFactory.create())
.build();

完整代码如下。

public class RestAdapter {


private static Retrofit retrofit = null;
private static ApiInterface apiInterface;


public static OkHttpClient.Builder getUnsafeOkHttpClient() {
try {
// Create a trust manager that does not validate certificate chains
final TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
@Override
public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
}


@Override
public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) throws CertificateException {
}


@Override
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return new java.security.cert.X509Certificate[]{};
}
}
};
    

// Install the all-trusting trust manager
final SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
    

// Create an ssl socket factory with our all-trusting manager
final SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
    

OkHttpClient.Builder builder = new OkHttpClient.Builder();
builder.sslSocketFactory(sslSocketFactory, (X509TrustManager) trustAllCerts[0]);
builder.hostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession session) {
return true;
}
});
return builder;
} catch (Exception e) {
throw new RuntimeException(e);
}
}
        

public static ApiInterface getApiClient() {
if (apiInterface == null) {
    

try {
retrofit = new Retrofit.Builder()
.baseUrl(ApplicationData.FINAL_URL)
.client(getUnsafeOkHttpClient().build())
.addConverterFactory(GsonConverterFactory.create())
.build();
    

} catch (Exception e) {
    

e.printStackTrace();
}
    

    

apiInterface = retrofit.create(ApiInterface.class);
}
return apiInterface;
}
        

}

我也遇到过类似的问题，我已经完全排除了相信所有消息来源的策略。

我在这里分享我在Kotlin中实现的应用程序中的解决方案

我首先建议使用以下网站来获取关于证书及其有效性的信息

如果它在Android默认信任存储中没有作为“接受发行人”出现，我们必须获得该证书并将其合并到应用程序中以创建自定义信任存储

在我的案例中，理想的解决方案是创建一个高级信托经理，它结合了自定义和Android默认信任存储

在这里，他公开了用于配置他与Retrofit一起使用的OkHttpClient的高级代码。

override fun onBuildHttpClient(httpClientBuild: OkHttpClient.Builder) {


val trustManagerWrapper = createX509TrustManagerWrapper(
arrayOf(
getCustomX509TrustManager(),
getDefaultX509TrustManager()
)
)


printX509TrustManagerAcceptedIssuers(trustManagerWrapper)


val sslSocketFactory = createSocketFactory(trustManagerWrapper)
httpClientBuild.sslSocketFactory(sslSocketFactory, trustManagerWrapper)


}

通过这种方式，我可以使用自签名证书与服务器通信，也可以使用受信任的证书实体颁发的证书与其他服务器通信

就是这个，我希望它能帮助到一些人。

我知道这是一篇非常古老的文章，但我在尝试解决信任锚问题时遇到了这篇文章。我已经发布了我是如何修复它的。如果您已经预安装了根CA，则需要向清单中添加配置。

https://stackoverflow.com/a/60102517/114265 < a href = " https://stackoverflow.com/a/60102517/114265 " > < / >

使用https://www.ssllabs.com/ssltest/来测试一个域。

Kotlin中Shihab Uddin的解决方案。

import java.security.SecureRandom
import java.security.cert.X509Certificate
import javax.net.ssl.*
import javax.security.cert.CertificateException


object {


val okHttpClient: OkHttpClient
val gson: Gson
val retrofit: Retrofit


init {


okHttpClient = getOkHttpBuilder()
// Other parameters like connectTimeout(15, TimeUnit.SECONDS)
.build()


gson = GsonBuilder().setLenient().create()


retrofit = Retrofit.Builder()
.baseUrl(BASE_URL)
.client(okHttpClient)
.addConverterFactory(GsonConverterFactory.create(gson))
.build()
}


fun getOkHttpBuilder(): OkHttpClient.Builder =
if (Build.VERSION.SDK_INT >= Build.VERSION_CODES.M) {
OkHttpClient().newBuilder()
} else {
// Workaround for the error "Caused by: com.android.org.bouncycastle.jce.exception.ExtCertPathValidatorException: Could not validate certificate: Certificate expired at".
getUnsafeOkHttpClient()
}


private fun getUnsafeOkHttpClient(): OkHttpClient.Builder =
try {
// Create a trust manager that does not validate certificate chains
val trustAllCerts: Array<TrustManager> = arrayOf(
object : X509TrustManager {
@Throws(CertificateException::class)
override fun checkClientTrusted(chain: Array<X509Certificate?>?,
authType: String?) = Unit


@Throws(CertificateException::class)
override fun checkServerTrusted(chain: Array<X509Certificate?>?,
authType: String?) = Unit


override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf()
}
)
// Install the all-trusting trust manager
val sslContext: SSLContext = SSLContext.getInstance("SSL")
sslContext.init(null, trustAllCerts, SecureRandom())
// Create an ssl socket factory with our all-trusting manager
val sslSocketFactory: SSLSocketFactory = sslContext.socketFactory
val builder = OkHttpClient.Builder()
builder.sslSocketFactory(sslSocketFactory,
trustAllCerts[0] as X509TrustManager)
builder.hostnameVerifier { _, _ -> true }
builder
} catch (e: Exception) {
throw RuntimeException(e)
}
}

如果你使用Glide，同样的错误也会出现，图像不会显示。要克服它，请参阅javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException:没有找到认证路径的信任锚和如何设置OkHttpClient滑翔。

@GlideModule
class MyAppGlideModule : AppGlideModule() {


val okHttpClient = Api.getOkHttpBuilder().build() // Api is the class written above.
// It is better to create okHttpClient here and not use Api.okHttpClient,
// because their settings may differ. For instance, it can use its own
// `addInterceptor` and `addNetworkInterceptor` that can affect on a read JSON.




override fun registerComponents(context: Context, glide: Glide, registry: Registry) {
registry.replace(GlideUrl::class.java, InputStream::class.java,
OkHttpUrlLoader.Factory(okHttpClient))
}
}

build.gradle:

// Glide.
implementation 'com.github.bumptech.glide:glide:4.11.0'
implementation 'com.github.bumptech.glide:okhttp3-integration:4.11.0'
kapt 'com.github.bumptech.glide:compiler:4.11.0'

更新

我还在API 16模拟器上得到了另一个错误:

routines:SSL23_GET_SERVER_HELLO:tlsv1警报协议版本 (外部/ openssl / ssl / s23_clnt.c: 741。< / p >

读取1和2，我改变了代码，这样:

okHttpClient = getOkHttpBuilder().build()


private fun getOkHttpBuilder(): OkHttpClient.Builder {
if (Build.VERSION.SDK_INT < Build.VERSION_CODES.M) {
Security.insertProviderAt(Conscrypt.newProvider(), 1)
}
return OkHttpClient().newBuilder()
}


// build.gradle:
implementation 'org.conscrypt:conscrypt-android:2.5.1'

我还从MyApplication中删除了这些行:

try {
ProviderInstaller.installIfNeeded(applicationContext)
val sslContext = SSLContext.getInstance("TLSv1.2")
sslContext.init(null, null, null)
sslContext.createSSLEngine()
} catch (e: GooglePlayServicesRepairableException) {
Timber.e(e.stackTraceToString())
// Prompt the user to install/update/enable Google Play services.
GoogleApiAvailability.getInstance().showErrorNotification(this, e.connectionStatusCode)
} catch (e: GooglePlayServicesNotAvailableException) {
Timber.e(e.stackTraceToString())
// Prompt the user to install/update/enable Google Play services.
// GoogleApiAvailability.getInstance().showErrorNotification(this, e.errorCode)
} catch (e: NoSuchAlgorithmException) {
Timber.e(e.stackTraceToString())
} catch (e: KeyManagementException) {
Timber.e(e.stackTraceToString())
}

但是图书馆给apk增加了3.4 Mb。

有时当管理员错误地设置证书时会发生这种情况 点击此处查看URL https://www.sslshopper.com/ssl-checker.html < / p >

在我的例子中，出现了一个错误

证书在所有浏览器中都不受信任。您可能需要安装中间证书/链证书以将其链接到受信任的根证书。了解关于此错误的更多信息。您可以按照GlobalSign针对您的服务器平台的证书安装说明来解决这个问题。注意中级证书部分。

在我的例子中，词根&中间证书已成功安装，但仍提示“未找到认证路径的信任锚”;例外!在挖掘安卓系统文档后，发现默认情况下，来自所有应用程序的安全连接(使用TLS和HTTPS等协议)信任预安装的系统ca， 针对Android 6.0 (API级别23)及以下的应用程序默认也信任用户添加的CA存储。如果你的应用程序运行在一个api级别高于23的操作系统上，你应该明确地允许应用程序信任用户添加的CA，将其地址添加到network_security_config中，如下所示:

<domain-config>
<domain includeSubdomains="true">PUT_YOUR_SERVER_ADDERESS</domain>
<trust-anchors>
<certificates src="user" />
</trust-anchors>
</domain-config>

我使用这些方法，其中一个是在上述解决方案中对我有用: 第一:< / >强

   public  okhttp3.OkHttpClient getUnsafeOkHttpClient() {
try {
// Create a trust manager that does not validate
certificate chains
final TrustManager[] trustAllCerts = new TrustManager[] {
new X509TrustManager() {
@Override
public void
checkClientTrusted(java.security.cert.X509Certificate[] chain,
String authType) throws CertificateException {
}


@Override
public void
checkServerTrusted(java.security.cert.X509Certificate[] chain,
String authType) throws CertificateException {
}


@Override
public java.security.cert.X509Certificate[]
getAcceptedIssuers() {
return new
java.security.cert.X509Certificate[]{};
}
}
};


// Install the all-trusting trust manager
final SSLContext sslContext =
SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new
java.security.SecureRandom());


// Create an ssl socket factory with our all-trusting
manager
final SSLSocketFactory sslSocketFactory =
sslContext.getSocketFactory();


okhttp3.OkHttpClient.Builder builder = new
okhttp3.OkHttpClient.Builder();
builder.sslSocketFactory(sslSocketFactory,
(X509TrustManager)trustAllCerts[0]);
builder.hostnameVerifier(new HostnameVerifier() {
@Override
public boolean verify(String hostname, SSLSession
session) {
return true;
}
});


okhttp3.OkHttpClient okHttpClient = builder.build();
return okHttpClient;
} catch (Exception e) {
throw new RuntimeException(e);
}
}

    @SuppressLint("TrulyRandom")
public static void handleSSLHandshake() {
try {
TrustManager[] trustAllCerts = new TrustManager[]{new
X509TrustManager() {
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
}


@Override
public void checkClientTrusted(X509Certificate[]
certs, String authType) {
}


@Override
public void checkServerTrusted(X509Certificate[]
certs, String authType) {
}
}};


SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new SecureRandom());
        







HttpsURLConnection
.setDefaultSSLSocketFactory(sc.getSocketFactory());
HttpsURLConnection.setDefaultHostnameVerifier(new
HostnameVerifier() {
@Override
public boolean verify(String arg0, SSLSession arg1) {
return true;
}
});
} catch (Exception ignored) {
}
}

 implementation 'com.squareup.okhttp:okhttp:2.3.0'
implementation 'com.squareup.okhttp:okhttp-urlconnection:2.3.0'
androidTestImplementation 'androidx.test.espresso:espresso-
core:3.3.0'