WARN: 不建议在没有服务器身份验证的情况下建立 SSL 连接
Posted
技术标签:
【中文标题】WARN: 不建议在没有服务器身份验证的情况下建立 SSL 连接【英文标题】：WARN: Establishing SSL connection without server's identity verification is not recommended 【发布时间】：2017-02-03 00:20:15 【问题描述】：您好，我正在尝试使用 eclipse 和 tomcat 通过 java servlet 连接到 mysql 数据库，但出现以下错误：“警告：不建议在没有服务器身份验证的情况下建立 SSL 连接”。我添加了“useSSL=false ？”到连接网址，但仍然出现相同的错误。有什么建议吗？ servlet 的代码是：
package com.simpleWebApplication.servlet;
import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
@WebServlet("/register")
public class RegisterServlet extends HttpServlet
private static final long serialVersionUID = 1L;
/**
* @see HttpServlet#HttpServlet()
*/
public RegisterServlet()
super();
// TODO Auto-generated constructor stub
protected void doPost(HttpServletRequest request, HttpServletResponse
response)
throws ServletException, IOException
doGet(request, response);
response.setContentType("text/html");
PrintWriter out = response.getWriter();
String idusers = request.getParameter("0");
String name = request.getParameter("name");
String surname = request.getParameter("surname");
String gender = request.getParameter("gender");
String birthdate = request.getParameter("birthdate");
String workAddress = request.getParameter("workAddress");
String homeAddress = request.getParameter("homeAddress");
try
Class.forName("com.mysql.jdbc.Driver");
Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/mysys?autoReconnect=true&useSSL=false","root","pass");
PreparedStatement ps = con.prepareStatement("insert into Users values(?,?,?,?,?,?)");
ps.setString(1, idusers);
ps.setString(2, name);
ps.setString(3, surname);
ps.setString(4, gender);
ps.setString(5, birthday);
ps.setString(6, workAddress);
ps.setString(7, homeAddress);
int i=ps.executeUpdate();
if(i>0)
out.println("You are sucessfully registered");
catch(Exception se)
se.printStackTrace();
这里是与servlet连接的register.jsp页面。
<%@ page language="java" contentType="text/html; charset=ISO-8859-1"
pageEncoding="ISO-8859-1"%>
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
<title>Register New User</title>
</head>
<body>
<form action="register" method="post">
<table align="center" bgcolor="#ffffff" border="1" >
<tr>
<td colspan="2" align="center">User Details </td>
</tr>
<tr>
<td>Name </td>
<td><input type="text" name="name" maxlength="25"></td>
</tr>
<tr>
<td>Surname </td>
<td><input type="text" name="surname" maxlength="40"></td>
</tr>
<tr>
<td>Gender </td>
<td><select>
<option value="male">Male</option>
<option value="female">Female</option>
</select></td>
</tr>
<tr>
<td>Birthdate </td>
<td><input type="date" name="birthdate" maxlength="30"></td>
</tr>
<tr>
<tr>
<td>Work Address </td>
<td><input type="text" name="workaddress" maxlength="30"></td>
</tr>
<tr>
<td>Home Address </td>
<td><input type="text" name="homeaddress" maxlength="30"></td>
</tr>
<td colspan="2" align="center"><input type="submit" value="Submit"></td>
</tr>
</table>
</form>
</body>
</html>
堆栈错误：
Wed Sep 28 08:58:53 EEST 2016 WARN: Establishing SSL connection without server's identity verification is not recommended. According to MySQL 5.5.45+, 5.6.26+ and 5.7.6+ requirements SSL connection must be established by default if explicit option isn't set. For compliance with existing applications not using SSL the verifyServerCertificate property is set to 'false'. You need either to explicitly disable SSL by setting useSSL=false, or set useSSL=true and provide truststore for server certificate verification.
java.sql.SQLException: Access denied for user 'username'@'localhost' (using password: YES)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:963)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3966)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:3902)
at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:875)
at com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1712)
at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1228)
at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2253)
at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2284)
at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2083)
at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:806)
at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:47)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:404)
at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:410)
at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:328)
at java.sql.DriverManager.getConnection(Unknown Source)
at java.sql.DriverManager.getConnection(Unknown Source)
at com.simpleWebApplication.servlet.RegisterServlet.doPost(RegisterServlet.java:47)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:650)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:731)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:505)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1082)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:623)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:318)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Unknown Source)
【问题讨论】：
你从什么地方得到这个警告？ 当我从与 servlet 连接的 jsp 页面按下提交按钮时收到此警告。 您从浏览器弹出窗口 (4) 其他浏览器页面 (3) 上的服务器日志 (2) 中收到此警告 (1)？ 我在 Eclipse 控制台上得到它，在浏览器页面上得到 HTTP 状态 405 - 此 URL 不支持 HTTP 方法 GET 什么是mysql版本？ 【参考方案1】：尝试删除 doGet (request, response) 行；因为您在上面的示例中没有 get 方法。 我也总是使用 jdbc 收到此警告，但一切运行正常。
【讨论】：
【参考方案2】：这是你写的：
"jdbc:mysql://localhost:3306/mysys?autoReconnect=true&useSSL=false","root","pass";
以下是我认为您可能需要编写的内容：
"jdbc:mysql://localhost:3306?useSSL=false/mysys?autoReconnect=true","root","pass";
如果这解决了您的问题，请告诉我。
【讨论】：
【参考方案3】：首先，您必须确保正确输入用户名和密码。
当您尝试与 DriverManager 连接时，您得到的错误来自 servlet 代码：
Connection con = DriverManager.getConnection("jdbc:mysql://localhost:3306/mysys?autoReconnect=true&useSSL=false","root","pass");
如果您使用 MySQL Workbench 或其他软件，请尝试在该软件中检查连接数据库和表的参数。
当您收到 useSSL 警告时，它只是一个警告。检查这个问题：Warning about SSL connection when connecting to MySQL database
【讨论】：
感谢您的关注。但是我已经按照你的建议做了，没有结果。 提交您的项目，我会为您修复。以上是关于WARN: 不建议在没有服务器身份验证的情况下建立 SSL 连接的主要内容，如果未能解决你的问题，请参考以下文章
如何在没有客户端身份验证的情况下从服务器验证 Firebase 用户？
如何在没有身份验证的情况下直接向 SMTP 服务器发送邮件？
如何在不使用身份验证的情况下保护 RESTful Web 服务
如何在没有手动浏览器身份验证的情况下从 Meteor.js 应用程序对 GMail-api 进行 oauth (2) 身份验证？