先來回顧一下
前面已分別介紹了https,SSL證書的生成宅楞，并完成了服務(wù)器端的https的部署 针姿，并提到一個重要的用于客戶端的證書：公鑰證書
在前面文章中，自簽名SSL證書對應(yīng)的公鑰證書為：mycer.cer（當然這名字是自己隨便定的）厌衙。在阿里云申請的CA證書中對應(yīng)的公鑰證書為：*.pem
如果有不清楚的距淫，請看我之前介紹過的文章
Android自帶的可信任的CA公鑰證書
還要說明一下，Android系統(tǒng)有自帶的安卓認可的證書頒發(fā)機構(gòu)（如:Wosign)頒發(fā)的可信任的CA公鑰證書婶希，大概有100多個榕暇， 可自己查看，各個手機的查看方法可能不一樣喻杈，在我的手機中彤枢，能在下面的位置中找到： “設(shè)置”->”更多設(shè)置“->”系統(tǒng)安全“->”信任的憑據(jù)”
也就是說，如果你服務(wù)器的證書是安卓認可的證書頒發(fā)機構(gòu)頒發(fā)的筒饰，那么你并不需要在Android端額外安裝公鑰證書缴啡，否則，你就需要安裝瓷们。
注：在不同版本的Android系統(tǒng)上业栅，可信任的CA證書可能是不一樣的，如果你擔心在別人的Android系統(tǒng)上可能此CA證書不被信任谬晕，那你統(tǒng)一都安裝也是沒問題的
我在阿里云上申請的免費型DV SSL證書碘裕，是屬于安卓認可的證書頒發(fā)機構(gòu)頒發(fā)的，不需要額外安裝固蚤，當然我們的自簽名證書娘汞，是必需要安裝的
其實我在測試的過程中，把自簽名證書和阿里云上申請的免費型DV SSL證書都用同樣的方法安裝了夕玩，都是OK的
我們下面就開始基于okhttp來安裝公鑰證書了
先看看我的okhttp和retrofit的gradle版本
compile 'com.squareup.okhttp3:okhttp:3.8.1'
compile 'com.squareup.retrofit2:retrofit:2.3.0'
增加一個OkhttpManager類
統(tǒng)一處理OkHttpClient的證書你弦，完整的代碼如下：
import android.content.Context;
import java.io.IOException;
import java.io.InputStream;
import java.security.GeneralSecurityException;
import java.security.KeyStore;
import java.security.cert.Certificate;
import java.security.cert.CertificateFactory;
import java.util.Arrays;
import java.util.Collection;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
import okhttp3.OkHttpClient;
public class OkhttpManager {
static private OkhttpManager mOkhttpManager=null;
private InputStream mTrustrCertificate;
static public OkhttpManager getInstance()
{
if(mOkhttpManager==null)
{
mOkhttpManager=new OkhttpManager();
}
return mOkhttpManager;
}
private KeyStore newEmptyKeyStore(char[] password) throws GeneralSecurityException {
try {
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
InputStream in = null; // By convention, 'null' creates an empty key store.
keyStore.load(in, password);
return keyStore;
} catch (IOException e) {
throw new AssertionError(e);
}
}
private X509TrustManager trustManagerForCertificates(InputStream in)
throws GeneralSecurityException {
CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
Collection<? extends Certificate> certificates = certificateFactory.generateCertificates(in);
if (certificates.isEmpty()) {
throw new IllegalArgumentException("expected non-empty set of trusted certificates");
}
// Put the certificates a key store.
char[] password = "password".toCharArray(); // Any password will work.
KeyStore keyStore = newEmptyKeyStore(password);
int index = 0;
for (Certificate certificate : certificates) {
String certificateAlias = Integer.toString(index++);
keyStore.setCertificateEntry(certificateAlias, certificate);
}
// Use it to build an X509 trust manager.
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(keyStore, password);
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init(keyStore);
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
throw new IllegalStateException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
}
return (X509TrustManager) trustManagers[0];
}
public void setTrustrCertificates(InputStream in)
{
mTrustrCertificate=in;
}
public InputStream getTrustrCertificates()
{
return mTrustrCertificate;
}
public OkHttpClient build()
{
OkHttpClient okHttpClient=null;
if(getTrustrCertificates()!=null)
{
X509TrustManager trustManager;
SSLSocketFactory sslSocketFactory;
try {
trustManager = trustManagerForCertificates(getTrustrCertificates());
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, new TrustManager[] { trustManager }, null);
sslSocketFactory = sslContext.getSocketFactory();
} catch (GeneralSecurityException e) {
throw new RuntimeException(e);
}
okHttpClient=new OkHttpClient.Builder()
.sslSocketFactory(sslSocketFactory, trustManager)
.build();
}
else
{
okHttpClient=new OkHttpClient.Builder()
.build();
}
return okHttpClient;
}
}
代碼解釋
代碼不少，其實最核心的代碼為：
public OkHttpClient build()
{
.......
trustManager = trustManagerForCertificates(getTrustrCertificates());
.......
okHttpClient=new OkHttpClient.Builder()
.sslSocketFactory(sslSocketFactory, trustManager)
.build();
..........
return okHttpClient;
}
也就是通過
void setTrustrCertificates(InputStream in)
把自己的證書對應(yīng)的文件set進去燎孟，然后通過
trustManager =trustManagerForCertificates(getTrustrCertificates());
再
okHttpClient=new OkHttpClient.Builder()
.sslSocketFactory(sslSocketFactory, trustManager)
.build();
就能生成安裝好了可信任證書的okHttpClient
OkhttpManager說完了禽作，接下來，就是：
Activity中使用OkhttpManager
- 先把公鑰證書文件（如：自簽名的mycer.cer或CA證書的：*.pem)放到assets下揩页，
如果使用AndroidStudio的同學(xué)旷偿，可能沒有assets文件夾，自己建此文件夾爆侣，如我的為：app\src\main\assets - 直接貼Activity主要的代碼：
public class MyActivity extends AppCompatActivity {
@Override
protected void onCreate(@Nullable Bundle savedInstanceState) {
super.onCreate(savedInstanceState);
try {
OkhttpManager.getInstance().setTrustrCertificates(getAssets().open("mycer.cer");
OkHttpClient mOkhttpClient= OkhttpManager.getInstance().build();
} catch (IOException e) {
e.printStackTrace();
}
}
簡單吧萍程，主要代碼就那兩句，就生成了已安裝公鑰證書”mycer.cer”的mOkhttpClient 兔仰，接下來的mOkhttpClient怎樣使用茫负，大家都應(yīng)該清楚了吧，如果不清楚只能看OkHttpClient的基礎(chǔ)內(nèi)容了
接下來就到Retrofit了
大家應(yīng)該知到Retrofit默認是以O(shè)kHttpClient來作為傳輸?shù)暮醺埃热籓kHttpClient搞掂了忍法，那Retrofit就簡單了
還是直接貼代碼：
Retrofit retrofit = new Retrofit.Builder()
.client(mOkhttpClient)
.baseUrl("your_serverl_url")
.build();
看潮尝，只需在Retrofit中多加一句
.client(mOkhttpClient)
就把已安裝了證書的mOkhttpClient作為Retrofit的傳輸了
