Disabling Certificate Validation in an HTTPS Connection
By default, accessing an HTTPS URL using the URL class results in an
exception if the server's certificate chain cannot be validated has
not previously been installed in the truststore. If you want to
disable the validation of certificates for testing purposes, you need
to override the default trust manager with one that trusts all
certificates.
// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return null;
}
public void checkClientTrusted(
java.security.cert.X509Certificate[] certs, String authType) {
}
public void checkServerTrusted(
java.security.cert.X509Certificate[] certs, String authType) {
}
}
};
// Install the all-trusting trust manager
try {
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new java.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
}
// Now you can access an https URL without having the certificate in the truststore
try {
URL url = new URL("https://hostname/index.html");
} catch (MalformedURLException e) {
}
good page
Not verifying the server's certificate makes such an SSL connection vulnerable to MITM attacks (just like anonymous cipher suites), so SSL isn't really useful in this case...
I think the point is testing, against servers that have either self-signed certificates or are borrowing ones from other servers (for testing). Yes you lose some security, but your testing works.
This is a god page. I would like to recomend the SSLUtilities from http://en.wikibooks.org/wiki/WebObjects/Web_Services/How_to_Trust_Any_SS....
This Helper class is nice when testing against self-signed servers.
Yes cool, too bad that is not working for me, until one day ago the certificates was ok now I'm stuck with this certificate error.
Ok this page code is ok if i replace
SSLContext sc = SSLContext.getInstance("SSL");
with
SSLContext sc = SSLContext.getInstance("TLS");
and is working.