接口X509TrustManager的不安全实现-Google Play

十天

当我尝试将应用程序上传到Google Play时，我收到一条消息。“接口x509trustmanager的不安全实现”。在来自Google Play的消息中说：

为避免在验证SSL证书时出现问题，请在X509TrustManager界面中更改checkServerTrusted方法的代码，以便在检测到可疑证书时抛出CertificateException或IllegalArgumentException。

我找到的所有选项都使用checkValidity方法来验证证书，但Google还会添加：

不要使用checkValidity来验证服务器的证书。此方法检查证书的有效性，而不是其安全性。

如何正确更改checkServerTrusted方法的代码？我当前的x509TrustManager实现：

X509TrustManager trustManager = new X509TrustManager() {
        @Override
        public X509Certificate[] getAcceptedIssuers() {
            X509Certificate[] cArrr = new X509Certificate[0];
            return cArrr;
        }

        @Override
        public void checkServerTrusted(final X509Certificate[] chain,
                                       final String authType) throws CertificateException {
            try {
                chain[0].checkValidity();
            } catch (Exception e) {
                throw new CertificateException("Certificate not valid or trusted.");
            }
        }

        @Override
        public void checkClientTrusted(final X509Certificate[] chain,
                                       final String authType) throws CertificateException {
        }
    };

十天

我以这种方式更改了X509TrustManager的实现，并且该应用通过了Google Play验证：

TrustManager[] victimizedManager = new TrustManager[]{

                new X509TrustManager() {

                    public X509Certificate[] getAcceptedIssuers() {

                        X509Certificate[] myTrustedAnchors = new X509Certificate[0];

                        return myTrustedAnchors;
                    }

                    @Override
                    public void checkClientTrusted(X509Certificate[] certs, String authType) {
                    }

                    @Override
                    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
                        if(chain == null || chain.length == 0)throw new IllegalArgumentException("Certificate is null or empty");
                        if(authType == null || authType.length() == 0) throw new IllegalArgumentException("Authtype is null or empty");
                        if(!authType.equalsIgnoreCase("ECDHE_RSA") &&
                                !authType.equalsIgnoreCase("ECDHE_ECDSA") &&
                                !authType.equalsIgnoreCase("RSA") &&
                                !authType.equalsIgnoreCase("ECDSA")) throw new CertificateException("Certificate is not trust");
                        try {
                            chain[0].checkValidity();
                        } catch (Exception e) {
                            throw new CertificateException("Certificate is not valid or trusted");
                        }
                    }
                }
        };

本文收集自互联网，转载请注明来源。

如有侵权，请联系 [email protected] 删除。