Javascript XMLHttpRequest：忽略无效的 SSL 证书
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/4490723/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Javascript XMLHttpRequest: Ignore invalid SSL Certificate
提问by user535617
so I have been having trouble with grabbing information from a device that is interfaced with via https due to the fact that it has an invalid security certificate. I know the device is to be trusted and I don't have access to the server-side so I can't change it. I was wondering if there was any way to set up an XMLHttpRequest object in Javascript to just ignore an invalid SSL certificate and just grab the information anyway. As it is now it seems to just reject the certificate and stop. Thanks.
所以我在从通过 https 连接的设备中获取信息时遇到了麻烦，因为它具有无效的安全证书。我知道该设备是值得信任的，而且我无权访问服务器端，因此我无法更改它。我想知道是否有任何方法可以在 Javascript 中设置一个 XMLHttpRequest 对象来忽略无效的 SSL 证书并且无论如何都只是获取信息。就像现在一样，它似乎只是拒绝证书并停止。谢谢。
采纳答案by user535617
Well I had found this solution before but it didn't work, this was because I was still using actual XMLHttpRequest though. When creating it using this statement:
好吧，我之前找到了这个解决方案，但它没有用，这是因为我仍在使用实际的 XMLHttpRequest。使用此语句创建它时：
httpreq = new ActiveXObject("Msxml2.ServerXMLHTTP.3.0");
There is a method called setOption that is opened up for use:
有一个名为 setOption 的方法被打开使用：
httpreq.setOption(2, 13056);
With those parameters, the request now ignores the invalid certificate and grabs the information anyway. If I understand correctly this won't work with any non-Microsoft technology trying to run the script, but that's ok for the scope of my project.
使用这些参数，请求现在会忽略无效证书并获取信息。如果我理解正确，这将不适用于尝试运行脚本的任何非 Microsoft 技术，但这对于我的项目范围来说是可以的。
回答by user207421
I know the device is to be trusted
我知道该设备值得信任
Yes but you don't know whether you are really connected to the device.
是的，但您不知道您是否真的连接到设备。
Thatis the purpose of the certificate. That's why it has to be valid.
这就是证书的目的。这就是为什么它必须是有效的。
回答by ConsultUtah
No, there isn't. XMLHTTPRequest doesn't allow you to override that. Being able to override SSL security might make sense in your case, but if you think about it, it would be a bad idea in general. You'd never want to allow arbitrary javascript code on the internet to connect to a supposedly secure service that the js host (the browser) knows has a possible MITM issue.
不，没有。XMLHTTPRequest 不允许您覆盖它。能够覆盖 SSL 安全性在您的情况下可能是有意义的，但如果您考虑一下，一般来说这将是一个坏主意。您永远不会希望互联网上的任意 javascript 代码连接到 js 主机（浏览器）知道可能存在 MITM 问题的所谓安全服务。
