SSLHandshakeException 未找到证书路径的信任锚 Android HTTPS

Question

I'm trying to establish a connection to a HTTPS site and I got this exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found .我正在尝试与 HTTPS 站点建立连接，但出现此异常： javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found 。
My original code is as follows:我的原始代码如下：

URL url = new URL("https://example.com");
            HttpsURLConnection urlConnection =
                (HttpsURLConnection)url.openConnection();
            in = urlConnection.getInputStream();
            byte[] responsedata = CommonUtil.readInputStream(in);
            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));

Then, I read Google's article here and modified my code to:然后，我在这里阅读了谷歌的文章并将我的代码修改为：

CertificateFactory cf;
        try {
            cf = CertificateFactory.getInstance("X.509");
            InputStream in = this.mContext.getResources().openRawResource(R.raw.cert);
            Certificate ca;
            ca = cf.generateCertificate(in);
                System.out.println("ca=" + ((X509Certificate) ca).getSubjectDN());
                in.close();
                URL url = new URL("https://example.com");
                HttpsURLConnection urlConnection =
                (HttpsURLConnection)url.openConnection();
                in = urlConnection.getInputStream();
                byte[] responsedata = CommonUtil.readInputStream(in);
            Log.w(TAG, "response is "+CommonUtil.convertBytesToHexString(responsedata));
            in.close();

Regarding the R.raw.cert file, I use this site to check the certificates of the site.关于R.raw.cert文件，我使用这个站点来检查站点的证书。 I found 3 cetificates and I have no idea which one to use.我找到了 3 个证书，但我不知道该使用哪一个。 I tried them one by one.我一一尝试了。
The one name "VeriSign Class 3 Public Primary Certification Authority - G5" results in the following exceptions:单一名称“VeriSign Class 3 Public Primary Certification Authority - G5”导致以下例外情况：

01-17 17:46:54.759: E/Process(8764): java.security.cert.CertificateException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: org.apache.harmony.xnet.provider.jsse.OpenSSLX509CertificateFactory$ParsingException: java.lang.RuntimeException: error:0906D06C:PEM routines:PEM_read_bio:no start line

When I use the one named "VeriSign Class 3 Secure Server CA - G3" or the one with the name "example.com" (same as the site name) I got the same SSLHandshakeException .当我使用名为“VeriSign Class 3 Secure Server CA - G3”或名为“example.com”（与站点名称相同）的一个时，我得到了相同的SSLHandshakeException 。

What do I need to do?我需要做什么？

At the same time, Symatec SSL Toolbox shows me an error and 1 recommendation which I don't understand:同时， Symatec SSL Toolbox向我显示了一个错误和 1 个我不明白的建议：

Intermediate certificate missing.
VeriSign Class 3 Secure Server CA - G3

Update your certificate chain.
Your certificate chain is valid, but some older browsers may not recognize it. To support older browsers, download and install the missing intermediate certificate

The 3 certificates found for the site are as follows:为该站点找到的 3 个证书如下：
example.com :例子.com :

VeriSign Class 3 Secure Server CA - G3 VeriSign 3 类安全服务器 CA - G3

VeriSign Class 3 Public Primary Certification Authority - G5 : VeriSign 3 类公共主要证书颁发机构 - G5 ：

Answer 1

Updates:更新：

I've never been an expert at this matter, the following is only a workaround and might not be secure, use it at your own risk我从来不是这方面的专家，以下只是一种解决方法，可能不安全，使用风险自负
This post is 3+ years old, so it may be outdated by now (code will not compile) but you should find be able to find the updated approach or official docs saying certain parts are deprecated or removed这篇文章已经有 3 年以上的历史了，所以它现在可能已经过时了（代码不会编译）但是你应该能够找到更新的方法或官方文档说某些部分已被弃用或删除

Thank noloader for pointing me in the correction direction.感谢 noloader 为我指出更正方向。 I solved my issue using the following:我使用以下方法解决了我的问题：

String keyStoreType = KeyStore.getDefaultType();
            KeyStore keyStore = KeyStore.getInstance(keyStoreType);
            keyStore.load(null, null);
            keyStore.setCertificateEntry("ca", ca);// my question shows how to get 'ca'
TrustManagerFactory tmf = TrustManagerFactory.getInstance(
    TrustManagerFactory.getDefaultAlgorithm());
// Initialise the TMF as you normally would, for example:
tmf.init(ca); 

TrustManager[] trustManagers = tmf.getTrustManagers();
final X509TrustManager origTrustmanager = (X509TrustManager)trustManagers[0];

TrustManager[] wrappedTrustManagers = new TrustManager[]{
   new X509TrustManager() {
       public java.security.cert.X509Certificate[] getAcceptedIssuers() {
          return origTrustmanager.getAcceptedIssuers();
       }

       public void checkClientTrusted(X509Certificate[] certs, String authType) {
           origTrustmanager.checkClientTrusted(certs, authType);
       }

       public void checkServerTrusted(X509Certificate[] certs, String authType) {
           try {
               origTrustmanager.checkServerTrusted(certs, authType);
           } catch (CertificateExpiredException e) {
               // Do what you need to do, log to Crashlytics?
           }
       }
   }
};

SSLContext sc = SSLContext.getInstance("TLS");
sc.init(null, wrappedTrustManagers, null);
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

Out of the 3 certificates found for the site, mentioned in my question, the one that worked for me was the VeriSign Class 3 Secure Server CA - G3在我的问题中提到的为该站点找到的 3 个证书中，对我有用的一个是VeriSign Class 3 Secure Server CA - G3

Answer 2

在我的情况下，我在本地主机上的 Https 上运行我的服务器我必须切换到 http 并且它工作可能服务器的 ssl 证书不受 android 设备信任

SSLHandshakeException 未找到证书路径的信任锚 Android HTTPS

问题描述

2 个解决方案

解决方案1
4 已采纳 2014-01-20 03:19:17

解决方案2
0 2020-09-03 18:41:59

SSLHandshakeException 未找到证书路径的信任锚 Android HTTPS

问题描述

2 个解决方案

解决方案1 4 已采纳 2014-01-20 03:19:17

解决方案2 0 2020-09-03 18:41:59

解决方案1
4 已采纳 2014-01-20 03:19:17

解决方案2
0 2020-09-03 18:41:59