android签名证书需要买吗,Android 使用自签名证书

离开体制的强哥

于 2021-05-28 09:28:38 发布

阅读量407

点赞数

文章标签： android签名证书需要买吗

本文详细介绍了在Android应用中如何使用自签名证书进行网络请求，并且讲解了从单向验证到双向SSL验证的实现过程，包括证书的加载、KeyStore的配置以及OkHttpClient的设置。同时，针对Android平台特性，提到了将jks证书转换为bks格式的处理方法。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Android SSL可以使用CA证书也可以使用自签名证书，自签名证书是通过keystore生成的，本文介绍android端使用自签名证书过程。

1，拷贝自签名证书到assert目录下，方便读取。

2，修改网络请求工具类OkHttpClientManager，如下所示:

public void setCertificates(InputStream... certificates)

{

try

{

CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");

KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());

keyStore.load(null);

int index = 0;

for (InputStream certificate : certificates)

{

String certificateAlias = Integer.toString(index++);

keyStore.setCertificateEntry(certificateAlias, certificateFactory.generateCertificate(certificate));

try

{

if (certificate != null)

certificate.close();

} catch (IOException e)

{

}

SSLContext sslContext = SSLContext.getInstance("TLS");

TrustManagerFactory trustManagerFactory =

TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

trustManagerFactory.init(keyStore);

sslContext.init

(

null,

trustManagerFactory.getTrustManagers(),

new SecureRandom()

);

mOkHttpClient.setSslSocketFactory(sslContext.getSocketFactory());

} catch (Exception e)

{

e.printStackTrace();

}

3，在application中使用，

public class MyApplication extends Application

{

@Override

public void onCreate()

{

super.onCreate();

try

{

OkHttpClientManager.getInstance()

.setCertificates(getAssets().open("srca.cer"));

} catch (IOException e)

{

e.printStackTrace();

}

以上是单向验证，只要客户端获取了包含服务端公钥的证书即可。

下面介绍双向验证，单向验证是服务端有"kjs文件"，客户端有" cer文件"，那么双向验证就是客户端也有一个"kjs文件"，服务端也有一个"cer文件"，实现步骤如下：

1，修改网络请求工具类：

public void setCertificates(InputStream... certificates)

{

try

{

CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");

KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());

keyStore.load(null);

int index = 0;

for (InputStream certificate : certificates)

{

String certificateAlias = Integer.toString(index++);

keyStore.setCertificateEntry(certificateAlias, certificateFactory.generateCertificate(certificate));

try

{

if (certificate != null)

certificate.close();

} catch (IOException e)

{

}

SSLContext sslContext = SSLContext.getInstance("TLS");

TrustManagerFactory trustManagerFactory = TrustManagerFactory.

getInstance(TrustManagerFactory.getDefaultAlgorithm());

trustManagerFactory.init(keyStore);

//初始化keystore

KeyStore clientKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());

clientKeyStore.load(mContext.getAssets().open("zhy_client.jks"), "123456".toCharArray());

KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());

keyManagerFactory.init(clientKeyStore, "123456".toCharArray());

sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), new SecureRandom());

mOkHttpClient.setSslSocketFactory(sslContext.getSocketFactory());

} catch (Exception e)

{

e.printStackTrace();

}

2，将"jks文件"改为"bks文件"，因为Java平台默认识别jks格式的证书文件，但是android平台只识别bks格式的证书文件。下载Download portecle-1.9.zip (3.4 MB)。

解压后，里面包含bcprov.jar文件，使用jave -jar bcprov.jar即可打开GUI界面。

然后修改代码为：

//初始化keystore

KeyStore clientKeyStore = KeyStore.getInstance("BKS");

clientKeyStore.load(mContext.getAssets().open("zhy_client.bks"), "123456".toCharArray());

KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());

keyManagerFactory.init(clientKeyStore, "123456".toCharArray());

sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), new SecureRandom());