一、说明

项目中经常会遇到业务系统使用https的情况，对方会提供jks或pem证书，此时我方有3种方式处理，1种是忽略证书的校验（比较常见的做法，因为有时候证书现在大多数是绑定要域名而不是ip上，此时如果使用的jdk1.8（jdk1.6不会有问题）用ip访问就会报错：java.security.cert.CertificateException: No subject alternative names present）），第二种是将证书导入到jre中,第三种就是代码上指定jks

二、示例

2.1方式1：忽略证书

在获取HttpClient的时候，要使用忽略证书处理过的HttpClient

/***
 * 忽略证书
 */
public static CloseableHttpClient createHttpClient(String url){
    try {
        if(url.startsWith("http://")){
            return HttpClients.createDefault();
        }
        X509TrustManager x509mgr = new X509TrustManager() {
            public void checkClientTrusted(X509Certificate[] xcs, String string) {
            }
            public void checkServerTrusted(X509Certificate[] xcs, String string) {
            }
            public X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        };
        SSLContext sslContext = null;
        sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, new TrustManager[] { x509mgr }, null);
        SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new HostnameVerifier() {
            @Override
            public boolean verify(String hostname, SSLSession sslSession) {
                return true;
            }
        });
        return HttpClients.custom().setSSLSocketFactory(sslsf).build();
    } catch (Exception e) {
        logger.error("忽略证书异常", e);
        return HttpClients.createDefault();
    }
}

/****
 * get请求
 * @param url
 * @return
 */
public static String sendGet(String url){
    HttpGet get = new HttpGet(url);
    CloseableHttpClient httpClient = createHttpClient(url);
    String result = "";
    CloseableHttpResponse response = null;
    try{
        response = httpClient.execute(get);
        logger.info("返回状态码:"+ response.getStatusLine().getStatusCode());
        HttpEntity entity = response.getEntity();
        result = EntityUtils.toString(entity);
        logger.info("返回值:" + result);
        return result;
    }catch (Exception e){
        logger.error("请求异常",e);
        return "";
    }finally{
        IOUtils.closeQuietly(response);
        IOUtils.closeQuietly(httpClient);
    }
}

2.2方式2：导入jdk

如果对方给的是jks,此时可以先获取出来pem证书，之后导入到jre下面，这种方式导入后，代码上就不用考虑https的证书问题，但是这种做法的缺点就是得一直维护着jdk，后续升级或其他人维护的时候需要交接好。

2.3方式3：使用代码指定

项目上我没有用该种方式，一来有时候该方式不生效，二来对代码侵入性太强，仅供参考吧，如果有需要的可以试下

private static Logger logger = LoggerFactory.getLogger(Test3.class);

public String sendGet(String urlStr){
    HttpsURLConnection connection = null;
    try {
        initJks();
        URL url = new URL(urlStr);
        connection = (HttpsURLConnection) url.openConnection();
        connection.setRequestMethod("GET");
        InputStream is = null;
        if (connection.getResponseCode() == 200){
            is = connection.getInputStream();
        }else {
            is = connection.getErrorStream();
        }
        InputStreamReader isr = new InputStreamReader(is);
        BufferedReader in = new BufferedReader(isr);
        String inputLine;
        StringBuilder resultSb = new StringBuilder();
        while ((inputLine = in.readLine()) != null) {
            resultSb.append(inputLine);
        }
        in.close();
        isr.close();
        is.close();
        return resultSb.toString();
    } catch (Exception e) {
        logger.error("请求异常",e);
        return "";
    }finally {
        if (connection != null){
            connection.disconnect();
        }
    }
}

public void initJks(){
    InputStream is = null;
    try {
        //JKS文件路径
        String jksPath = "c:/test.jks";
        // JKS密码
        char[] password = "password".toCharArray();
        // 加载JKS文件
        KeyStore keyStore = KeyStore.getInstance("JKS");
        is =  new FileInputStream(jksPath);
        keyStore.load(is, password);
        // 初始化KeyManagerFactory
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, password);
        // 创建SSLContext
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagerFactory.getKeyManagers(), null, new java.security.SecureRandom());
        // 设置默认的SSLSocketFactory
        HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
    }catch (Exception e){
        logger.error("加载证书异常",e);
    }finally {
        IOUtils.closeQuietly(is);
    }
}

三、自己获取证书文件

如果业务系统对方没有给证书，此时也可以通过访问对方的网站，自己去获取pem证书，以百度为例

（1）访问目标网站的任一界面，点击url地址栏中“锁”的标识，之后点击“证书信息”

（2）选择“详细信息”->“导出”

（3）另存为即可

之后将该pem或crt证书使用如上方式进行导入编辑

?