android – 接受自签名SSL证书 – >在哪里设置默认的TrustManager

首先,我不得不承认,我知道接受所有证书可以被视为没有安全性.我们有“真正的”Certs,但仅限于我们的现场系统.我们的测试系统上的证书是自签名的.因此,只要我们开发,我们必须使用测试服务器,这迫使我去禁用证书.

我在Stackoverflow上看到了很多toppics,而且整个网络都在尝试做同样的事情：
接受SSL证书.但是,这些答案似乎都不适用于我的问题,因为我没有弄乱HTTPSUrlConnections.

如果我正在请求代码通常看起来像这样(注释清除)：

//creates an HTTP-Post with an URL
HttpPost post = createBaseHttpPost();
//loads the request Data inside the httpPost
post.setEntity(getHttpPostEntity());
//appends some Headers like user-agend or Request UUIDs
appendHeaders(post);

HttpClient client = new DefaultHttpClient();
//mResponse is a custom Object which is returned 
//from the custom ResponseHandler(mResponseHandler) 
mResponse = client.execute(post,mResponseHandler);
return mResponse;

我读到我应该注入自己的TrustManager和X509HostnameVerivier.我创建了这样的：

private static final TrustManager[] TRUST_ALL_CERTS = new TrustManager[]{
        new X509TrustManager() {

            public X509Certificate[] getAcceptedIssuers() {
                return new X509Certificate[]{};
            }

            public void checkServerTrusted(X509Certificate[] chain,String authType)
                    throws CertificateException {
            }

            public void checkClientTrusted(X509Certificate[] chain,String authType)
                    throws CertificateException {
            }
        }

    };

    private static X509HostnameVerifier ACCEPT_ALL_HOSTNAMES = 
            new X509HostnameVerifier() {

                public void verify(String host,String[] cns,String[] subjectAlts)
                        throws SSLException {
                }

                public void verify(String host,X509Certificate cert) throws SSLException {
                }

                public void verify(String host,SSLSocket ssl) throws IOException {
                }

                public boolean verify(String host,SSLSession session) {
                    return true;
                }
            };

如果我在我的请求中注入HostnameVerifier像这样(客户端是上面的DefaultHttpClient)

SSLSocketFactory ssl = (SSLSocketFactory)client.getConnectionManager().getSchemeRegistry().getScheme("https").getSocketFactory();
ssl.setHostnameVerifier(ACCEPT_ALL_HOSTNAMES);

响应从“主机名**不匹配”变为“错误请求”.我想我必须设置TrustManager,但是我无法在我的请求中设置它,因为我没有使用HttpsUrlConnections在我看到它的任何地方.

KeyStore localTrustStore = KeyStore.getInstance("BKS");
InputStream in = getResources().openRawResource(R.raw.mytruststore);
localTrustStore.load(in,TRUSTSTORE_PASSWORD.toCharArray());

SchemeRegistry schemeRegistry = new SchemeRegistry();
schemeRegistry.register(new Scheme("http",PlainSocketFactory
                .getSocketFactory(),80));
SSLSocketFactory sslSocketFactory = new SSLSocketFactory(localTrustStore);
schemeRegistry.register(new Scheme("https",sslSocketFactory,443));
HttpParams params = new BasicHttpParams();
ClientConnectionManager cm = 
    new ThreadSafeClientConnManager(params,schemeRegistry);

HttpClient client = new DefaultHttpClient(cm,params);