如何让Java/HtmlUnit接受旧的或坏的网站证书?

Question

如果您在Linux上使用Firefox访问https://eagletw.mohavecounty.us/treasurer/treasurerweb/search.jsp，您将看到您可以正常浏览该网站。

但是当我编译并运行以下程序时:

import com.gargoylesoftware.htmlunit.html.*;
import com.gargoylesoftware.htmlunit.javascript.*;
import java.io.*;
public class BadWebsiteCertificate {
public static void BadWebsiteCertificate () {
try (final WebClient webClient = new WebClient()) {
System.getProperties().put("org.apache.commons.logging.simplelog.defaultlog", "fatal");
webClient.getOptions().setThrowExceptionOnScriptError(false);
webClient.getOptions().setThrowExceptionOnFailingStatusCode(false);
webClient.getOptions().setCssEnabled(false);
webClient.setJavaScriptErrorListener(new SilentJavaScriptErrorListener());
webClient.setCssErrorHandler(new SilentCssErrorHandler());
webClient.setAjaxController(new NicelyResynchronizingAjaxController());
HtmlPage page = webClient.getPage("https://eagletw.mohavecounty.us/treasurer/treasurerweb/search.jsp");
webClient.waitForBackgroundJavaScriptStartingBefore(10000);
page = (HtmlPage) page.getEnclosingWindow().getEnclosedPage();
webClient.getOptions().setThrowExceptionOnScriptError(false);
webClient.setJavaScriptErrorListener(new SilentJavaScriptErrorListener());
HtmlTable grdTaxHistory = (HtmlTable) page.getElementById("grdTaxHistory");
HtmlTableDataCell cpCell = (HtmlTableDataCell) grdTaxHistory.getCellAt(4,6);
((HtmlAnchor) cpCell.getFirstChild().getNextSibling()).click();
webClient.waitForBackgroundJavaScriptStartingBefore(1_000);
page = (HtmlPage) page.getEnclosingWindow().getEnclosedPage();
}
catch (Exception e) {
System.out.println("Error: "+ e);
}
}
public static void main(String[] args) {
File file = new File("validParcelIDs.txt");
BadWebsiteCertificate();
}
}

javac -classpath ".:/opt/htmlunit_2.69.0/*" BadWebsiteCertificate.java
java -classpath ".:/opt/htmlunit_2.69.0/*" BadWebsiteCertificate

我得到以下运行时错误消息:

Error: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

我尝试了以下的解决方案解决javax.net.ssl.SSLHandshakeException: sun.security.validator. validatoreexception: PKIX路径构建失败错误?

echo -n | openssl s_client -connect eagletw.mohavecounty.us:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > ~/eagletw.mohavecounty.us.crt
sudo keytool -import -v -trustcacerts -alias eagletw.mohavecounty.us -file ~/eagletw.mohavecounty.us.crt -keystore /usr/lib/jvm/java-11-openjdk-amd64/lib/security/cacerts -keypass changeit -storepass changeit

但这并没有解决问题。我仍然得到相同的运行时错误信息。

你知道我还可以尝试什么吗?

Answer 1

由于某些原因，您的Java运行时环境不信任该证书。您可以尝试以下两种方法:

• 手动将该网站的证书添加到您的信任库
• 升级到最新的JVM，看看该版本的信任库是否已经解决了您的问题

我将首先进行升级，如果这不起作用，请检查如何将证书添加到Java的信任库。参见

• https://www.tutorialworks.com/java-trust-ssl/
• SSL和证书密钥库
• https://docs.oracle.com/javase/tutorial/security/toolsign/rstep2.html

Answer 2

您可以通过

禁用SSL检查

webClient.getOptions().setUseInsecureSSL(true);

如果您使用像Charles Web proxy这样的代理来检查流量，这可能也会有所帮助。