防止Java中的SSL证书验证

Question

I've been developing a Client-Server application, that right now, just uses standard Sockets/ServerSockets. However, I need to send data over a secure connection. I don't think SSL is an option, because I will be distributing the Client/Server application publicly online, so anyone who wants to host a server can, their for making SSL's certificate verification not relevant, since I would have to bundle the certificate in the distributed server.

So my question is: what is the correct way to handle something like this? I've heard that their are ways to disable SSL's verification, but from what I hear, those methods are considered hacky/deprecated to some extent (correct me if I'm wrong).

Another idea is to manually implement encryption/decryption at either end (similar to how SSL works, just without the certificate verification).

Or, is there their another way/protocol designed for this (or something similar)?

Answer 1

You ask for an alternative to SSL, but when it comes to security/encryption it is generally best to stick with the standard methodologies - it is too easy to homebrew a solution that turns out to have significant shortcomings.

Having said that, you can pretty easily configure SSL to not do validation of the certificate (essentially by trusting all certificates). This is generally a bad idea.

SSL communication does two things;

1. Encrypts the communication, so no third-party can see what is being sent.
2. Establishes the identity of the owner of the server.

Not validating the certificate means that you have no idea who is running the server that you just connected to. Generally speaking, if you are concerned about encrypting the communication with the server, you must be concerned about who is on the other end of the socket. If you do not know for sure that the server is run by the person with whom you want to have sensitive communication, you shouldn't send sensitive data because whoever you are trying to hide from might be reading from the other end of then socket.

If it is true that all you want is encrypted communication, then you should use SSL with a self-signed certificate. To keep the client happy, tweak the SSLContext in the client to trust such certificates.

If you go this route, the client application will not be able to tell whether the server it is talking to is the real thing or an imposter set up by the bad guys.

If you want the full protection of SSL, you should have the operator of every server supply their own certificate to identify themselves and your client should be set up to only talk to trusted servers. It is easiest to configure if this is a certificate issued by a recognized certificate authority (CA). However, you can use a self-signed certificate, but each client will need to include the certificate (or the root of the certificate chain) in the cacerts file (or you can tweak the SSLContext to trust the specific self-signed certificate and make this part of the client configuration).