SSL 证书升级导致问题
我们正在与远程服务器对话以验证用户身份。 Web 服务器使用由 Verisign 签名的 SSL 证书。数据通过 HTTP 进行交换，并且我们已将 ThreadSafeClientConnManager 配置为使用 JVM 默认 SSL 工厂：
SchemeRegistry schemeRegistry = new SchemeRegistry();
schemeRegistry.register(new Scheme("http", PlainSocketFactory
.getSocketFactory(), 80));
schemeRegistry.register(new Scheme("https", SSLSocketFactory
.getSocketFactory(), 443));
ClientConnectionManager manager = new ThreadSafeClientConnManager(
sDefaultHttpParams, schemeRegistry);
最近，Web 服务器更新了其 SSL 证书，这导致我们的应用程序崩溃。我们可以做什么来避免这个问题呢？
请帮忙。
We are talking to a remote server for authenticating a user. The web server uses a SSL certificate signed by Verisign. The data is exchanged over HTTPs and we have configured our ThreadSafeClientConnManager to use the JVM default SSL factory:
SchemeRegistry schemeRegistry = new SchemeRegistry();
schemeRegistry.register(new Scheme("http", PlainSocketFactory
.getSocketFactory(), 80));
schemeRegistry.register(new Scheme("https", SSLSocketFactory
.getSocketFactory(), 443));
ClientConnectionManager manager = new ThreadSafeClientConnManager(
sDefaultHttpParams, schemeRegistry);
Recently, the web server updated their SSL certificates and this has caused our application to break. What can we do to avoid this problem?
Please help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您实际上无法采取任何措施来“避免”该问题，因为它并不是真正的问题，它是 SSL 证书和权威信任的核心“功能”。
这是一个相当广泛的问题，更多细节可以帮助查明确切的问题，但这里是首先要检查的两件事。
如果站点已升级为使用使用非标准根证书颁发机构的 SSL 证书，则您需要使用 keytool 导入特定的 SSL 证书，以告诉本地 JVM 该证书是可信的。如果他们使用新的证书颁发机构（并且您的组织信任该根证书颁发机构），那么您可能需要导入新的根证书颁发机构，默认情况下支持大多数专业，但我有时被迫导入新的证书颁发机构。
http://download.oracle.com/javase/1.4 .2/docs/tooldocs/windows/keytool.html
There is nothing you can really do to "avoid" the problem because it isn't really a problem, it is a core "feature" of SSL certificates and authority trust.
This is a pretty broad question, more detail could help pinpoint the exact problem, but here are the first 2 things to check.
If the site has been upgraded to use an SSL cert that either uses a non-standard root certificate authority then you need to either import the specific SSL cert using keytool to tell your local JVM that the cert is trusted. If they are using a new authority (and your organization trusts that root authority) then you may need to import a new root certificate authority, most majors are supported by default but I have been forced to import new ones on occasion.
http://download.oracle.com/javase/1.4.2/docs/tooldocs/windows/keytool.html