“未找到证书路径的信任锚”的问题。

Question

Hello i didn't found solution for my problem. In new OkHttp and Retrofit is some function:

 HandshakeCertificates certificates =  new HandshakeCertificates.Builder()
                        .addPlatformTrustedCertificates()
                        .addInsecureHost("192.168.0.150")
                        .build();

I am trying to connect my Android App to Spring Boot Server. This Server must use HTTPS - not my idea. On this server i generated self-sign certyficate, but still i got error, now i don't have any ideas. Here is a full error: java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found. Below i insert code of Retrofit generator:

public class ServiceGenerator {
    public static final String API_BASE_URL = "https://192.168.0.150:8443/";
    private static OkHttpClient.Builder httpClient = new OkHttpClient.Builder();
    // private static OkHttpClient httpClient = getUnsafeOkHttpClient();

    private static Retrofit.Builder builder =
            new Retrofit.Builder()
                    .baseUrl(API_BASE_URL)
                    .addConverterFactory(GsonConverterFactory.create());

    private static Retrofit retrofit = builder.build();

    public static <S> S createService(Class<S> serviceClass) {
        return createService(serviceClass, null);
    }

    static public <S> S createService(
            Class<S> serviceClass, final String authToken) {
        if (!TextUtils.isEmpty(authToken)) {
            AuthenticationInterceptor interceptor =
                    new AuthenticationInterceptor(authToken);

            if (!httpClient.interceptors().contains(interceptor)) {
                httpClient.addInterceptor(interceptor);

                HandshakeCertificates certificates =  new HandshakeCertificates.Builder()
                        .addPlatformTrustedCertificates()
                        .addInsecureHost("192.168.0.150")
                        .build();
                httpClient.sslSocketFactory(certificates.sslSocketFactory(), certificates.trustManager());

                OkHttpClient okHttpClient = httpClient.build();

                builder.client(okHttpClient);
                retrofit = builder.build();
            }
        }

        return retrofit.create(serviceClass);
    }
}

Request Code:

 private void doLoginRequest() {
        DeviceAPI deviceAPI = ServiceGenerator.createService(DeviceAPI.class);
        Call<JWTResponse> call = deviceAPI.login(new Login(usernameEditText.getText().toString(), passwordEditText.getText().toString()));
        call.enqueue(new Callback<JWTResponse>() {
            @Override
            public void onResponse(Call<JWTResponse> call, Response<JWTResponse> response) {
                if (response.isSuccessful()) {
                    Toast.makeText(LoginActivity.this, response.body().toString(), Toast.LENGTH_SHORT).show();
                } else {
                    Toast.makeText(LoginActivity.this, response.message(), Toast.LENGTH_SHORT).show();
                }
            }

            @Override
            public void onFailure(Call<JWTResponse> call, Throwable t) {
                System.out.println(t.getCause());
                Toast.makeText(LoginActivity.this, t.getMessage() , Toast.LENGTH_SHORT).show();
            }
        });
    }

Api Code:

public interface DeviceAPI {
    @POST("api/auth/signin")
    Call<JWTResponse> login(@Body Login login);
}

If you need more information give me feedback!

Answer 1

This example shows connecting twice to a host - Once with a valid HTTPS Handshake, and second using addInsecureHost. nb you won't get a handshake peer in the second because the handshake won't result in valid certificates.

The same will apply if you run against a dev server, so edit the example to use your devserver.

https://gist.github.com/yschimke/796e58a6152137bdcd7d2f9d63e26363

import okhttp3.OkHttpClient
import okhttp3.Request
import okhttp3.tls.HandshakeCertificates.Builder

fun main() {
  val request = Request.Builder()
      .url("https://httpbin.org/get")
      .build()

  var client = OkHttpClient();
  var response = client.newCall(request).execute()

  println(response.handshake?.peerPrincipal) // CN=httpbin.org
  println(response.code)

  val certificates = Builder()
      .addInsecureHost("httpbin.org")
      .build()

  client = OkHttpClient.Builder().sslSocketFactory(certificates.sslSocketFactory(),
      certificates.trustManager
  ).build();
  response = client.newCall(request).execute()

  println(response.handshake?.peerPrincipal) // null
  println(response.code)
}