如何解决 javax.net.ssl.SSLHandshakeException：java.security.cert.CertificateEx ception：没有名称匹配

Posted 2023-02-27

【中文标题】如何解决 javax.net.ssl.SSLHandshakeException：java.security.cert.CertificateEx ception：没有名称匹配

【英文标题】：How to solve javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateEx ception: No name matching

【发布时间】：2016-03-21 14:57:06

【问题描述】：

我正在尝试使用 Java 通过 ssl 连接到我的一台服务器。我尝试了很多选择

String jwtUrl = "https://ABC.XYZ.COM:3333/api/auth";
String username = "ABC";
String password = "ABC";


String userCredentials = username + ":" + password;
String basicAuth = "Basic "
+ new String(org.apache.commons.codec.binary.Base64.encodeBase64(userCredentials.getBytes()));

HttpHeaders headers1 = new HttpHeaders();
headers1.set("Authorization", basicAuth);
HttpEntity httpEntity = new HttpEntity(headers1);
ResponseEntity<String> responseEntity = restTemplate1.exchange(jwtUrl, HttpMethod.GET, httpEntity,
String.class);

System.out.println("Response Body = " + responseEntity.getBody());

我遇到了这个异常，

Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateEx
ception: No name matching ABC.XYZ.COM found
        at sun.security.ssl.Alerts.getSSLException(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
        at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
        at sun.security.ssl.Handshaker.processLoop(Unknown Source)
        at sun.security.ssl.Handshaker.process_record(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source
)

这种方式对我有用，用于测试目的

static 
        disableSslVerification();


private static void disableSslVerification() 
        try 
            // Create a trust manager that does not validate certificate chains
            TrustManager[] trustAllCerts = new TrustManager[]  new X509TrustManager() 
                @Override
                public java.security.cert.X509Certificate[] getAcceptedIssuers() 
                    return null;
                

                @Override
                public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException 
                    // TODO Auto-generated method stub

                

                @Override
                public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException 
                    // TODO Auto-generated method stub

                
             ;

            // Install the all-trusting trust manager
            SSLContext sc = SSLContext.getInstance("SSL");
            sc.init(null, trustAllCerts, new java.security.SecureRandom());
            HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

            // Create all-trusting host name verifier
            HostnameVerifier allHostsValid = new HostnameVerifier() 

                @Override
                public boolean verify(String hostname, SSLSession session) 
                    // TODO Auto-generated method stub
                    return false;
                
            ;

            // Install the all-trusting host verifier
            HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
         catch (NoSuchAlgorithmException e) 
            e.printStackTrace();
         catch (KeyManagementException e) 
            e.printStackTrace();
        
    

如何以好的方式解决这个问题。 我无法禁用 ssl 验证，还有哪些其他可用选项？ 我正在使用 spring Rest Template ，tomcat 等 我不想完全忽略证书检查。

【问题讨论】：

确保证书在您的信任存储文件中。在你的 java 程序中提及它。更多详情请参考javarevisited.blogspot.com/2012/03/…

试试看这个答案***.com/questions/4072585/…

【参考方案1】：

确保证书在您的信任存储文件中。 JRE 的 trustStore 默认位于 JAVA_HOME/jre/lib/security 文件夹中，通常命名为“cacerts”。将您的服务器证书导入此文件并通过 javax.net.ssl.trustStore JVM 属性指定它。请参阅 javarevisited.blogspot.com/2012/03/... 了解更多详情

【讨论】：

但在我的情况下，服务器没有为我提供证书

试试这些链接serverfault.com/questions/139728/…superuser.com/questions/97201/…