java 使用 HTTPS Web 服务
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/1255083/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Consuming HTTPS web services
提问by
We needed to consume MOSS out of the box web services hosted on HTTPS protocol from a Java application running on WebLogic server. Do we need to import SSL certificate of the MOSS website into WebLogic server or can we simply bypass certificate validation? What is the best approach? We may need to support more than one web site as more MOSS web sites can be configured in future.
我们需要从运行在 WebLogic 服务器上的 Java 应用程序使用托管在 HTTPS 协议上的开箱即用的 MOSS Web 服务。是否需要将MOSS网站的SSL证书导入到WebLogic服务器中，还是直接绕过证书验证？最好的方法是什么？我们可能需要支持多个网站，因为未来可以配置更多的 MOSS 网站。
Thanks.
谢谢。
回答by Tommy
You can do that, or you can disable the SSL validation with a fake trust-manager. I think both subjects are described in this similar question:
您可以这样做，或者您可以使用虚假的信任管理器禁用 SSL 验证。我认为这两个主题都在这个类似的问题中有所描述：
Java client certificates over HTTPS/SSL
It can be a hassle to manage many SSL cerificates: expiration, changed domains, changed issuer ++ If SSL is not that important to you I say skip it
管理许多 SSL 证书可能很麻烦：过期、更改域、更改颁发者 ++ 如果 SSL 对您来说不是那么重要，我说跳过它
回答by Chris Nava
Not necessarily. Your java app will need to establish a chain of trust from the server cert to the JVM's own trusted CA certs. As long as a CA cert is available that starts that chain, you should be fine. If you self sign certs, you will need to add your signing CA to the java's keystore. You do not need to import every server's certificate. Just the trusted CA certificate that signed them all if it is not already trusted.
不必要。您的 Java 应用程序将需要建立从服务器证书到 JVM 自己的可信 CA 证书的信任链。只要可以启动该链的 CA 证书，您就应该没问题。如果您对证书进行自签名，则需要将签名 CA 添加到 Java 的密钥库中。您不需要导入每个服务器的证书。如果尚未受信任，则只是对它们进行签名的受信任 CA 证书。
Import a root or intermediate CA certificate to an existing Java keystore:
将根或中间 CA 证书导入现有的 Java 密钥库：
keytool -import -trustcacerts -alias root -file Thawte.crt -keystore keystore.jks
