允许Java使用不受信任的证书进行SSL / HTTPS连接

Question

我一直在研究从动态Web应用程序中提取信息的程序，该程序运行良好，直到我将tomcat服务器设置为使用自签名（因此，不受信任）证书使用SSL为止。错误的堆栈跟踪为：

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Error: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1584)

        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:174)

        at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:168)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:848)

        at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:106)

        at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:495)

        at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:433)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:877)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1089)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1116)

        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1100)

        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:402)

        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:170)

        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:857)

在Web浏览器中，当用户使用不受信任的证书访问HTTPS站点时，系统会提示用户警告，并要求他设置是否愿意继续进行操作；我想为我的命令行应用程序实现类似的功能...我承认我是套接字编程和网络领域的新手。解决这个问题的任何建议都会很棒！

Answer 1

另一个选择是获取该特定服务器的“ .pem”（公钥）文件，然后将其本地安装到JRE的“证书”文件的中心，然后它将能够从该服务器下载而不会受到任何损害，而不会受到影响。您正在运行的JVM的整个SSL结构，并允许从其他未知证书服务器下载...