如何在Apache HttpClient中仅信任代理端无效证书并验证目标端证书？

完全可以在客户端层面实现这种细粒度的证书验证控制，不需要依赖代理端配置。你提到的curl的--proxy-insecure和-k的区分逻辑，在HttpClient中同样可以通过自定义SocketFactory来实现。

为什么全局信任方案不可用 #

你给出的全局信任所有证书的代码会同时跳过代理连接和目标服务器连接的证书验证，这不符合你“仅忽略代理证书问题”的需求：

// 全局信任所有证书的示例（不符合需求）
SSLContext sslContext = new SSLContextBuilder()
  .loadTrustMaterial((chain, authType) -> true)
  .build();

SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
  sslContext,
  NoopHostnameVerifier.INSTANCE);

CloseableHttpClient httpClient = HttpClients.custom()
  .setSSLSocketFactory(sslSocketFactory)
  .build();

实现步骤：区分代理与目标服务器的SSL验证 #

核心思路是为代理连接和目标服务器连接分别创建不同的SSL上下文，然后通过自定义SocketFactory根据连接场景选择对应的验证规则：

1. 创建两类SSL上下文 #

• 宽松SSL上下文：用于代理连接，跳过证书验证
• 默认SSL上下文：用于目标服务器连接，使用系统默认的信任库严格验证证书

import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.ssl.SSLContextBuilder;

// 宽松SSL上下文：信任所有代理证书，跳过主机名验证
SSLContext proxySslContext = SSLContextBuilder.create()
        .loadTrustMaterial((chain, authType) -> true)
        .build();
SSLConnectionSocketFactory proxySocketFactory = new SSLConnectionSocketFactory(
        proxySslContext,
        NoopHostnameVerifier.INSTANCE
);

// 默认SSL上下文：使用系统默认信任规则验证目标服务器证书
SSLContext targetSslContext = SSLContext.getDefault();
SSLConnectionSocketFactory targetSocketFactory = new SSLConnectionSocketFactory(
        targetSslContext,
        SSLConnectionSocketFactory.getDefaultHostnameVerifier()
);

2. 自定义SocketFactory实现场景区分 #

创建一个代理感知的SocketFactory，根据当前连接的目标是代理还是服务器，自动切换对应的验证逻辑：

import org.apache.http.HttpHost;
import org.apache.http.HttpContext;
import org.apache.http.conn.socket.ConnectionSocketFactory;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.protocol.HttpClientContext;
import org.apache.http.conn.routing.RouteInfo;

import java.io.IOException;
import java.net.InetSocketAddress;
import java.net.Socket;

class ProxyAwareSocketFactory extends SSLConnectionSocketFactory {
    private final SSLConnectionSocketFactory proxySocketFactory;
    private final SSLConnectionSocketFactory targetSocketFactory;

    public ProxyAwareSocketFactory(SSLConnectionSocketFactory proxySocketFactory, SSLConnectionSocketFactory targetSocketFactory) {
        super(targetSocketFactory.getSslContext());
        this.proxySocketFactory = proxySocketFactory;
        this.targetSocketFactory = targetSocketFactory;
    }

    @Override
    public Socket createSocket(HttpContext context) throws IOException {
        HttpClientContext clientContext = HttpClientContext.adapt(context);
        RouteInfo route = clientContext.getHttpRoute();
        // 判断是否为HTTPS代理场景
        if (route.getProxyHost() != null && route.getTargetHost().getSchemeName().equalsIgnoreCase("https")) {
            return proxySocketFactory.createSocket(context);
        }
        return targetSocketFactory.createSocket(context);
    }

    @Override
    public Socket connectSocket(int connectTimeout, Socket socket, HttpHost host, InetSocketAddress remoteAddress, InetSocketAddress localAddress, HttpContext context) throws IOException {
        HttpClientContext clientContext = HttpClientContext.adapt(context);
        RouteInfo route = clientContext.getHttpRoute();
        // 连接代理服务器时使用宽松验证
        if (route.getProxyHost() != null && host.equals(route.getProxyHost())) {
            return proxySocketFactory.connectSocket(connectTimeout, socket, host, remoteAddress, localAddress, context);
        }
        // 连接目标服务器时使用严格验证
        return targetSocketFactory.connectSocket(connectTimeout, socket, host, remoteAddress, localAddress, context);
    }
}

3. 构建配置好的HttpClient #

将自定义的SocketFactory注入HttpClient，并设置HTTPS代理：

import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.HttpHost;

ProxyAwareSocketFactory awareSocketFactory = new ProxyAwareSocketFactory(proxySocketFactory, targetSocketFactory);

CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLSocketFactory(awareSocketFactory)
        .setProxy(new HttpHost("your-proxy-host", 443, "https")) // 替换为你的HTTPS代理地址
        .build();

效果说明 #

这段代码的行为完全匹配你的需求：

• 当客户端与HTTPS代理建立连接时：跳过证书和主机名验证（信任所有无效证书）
• 当通过代理隧道与目标服务器（如google.com）建立连接时：严格验证目标服务器的证书（拒绝无效证书）

这和curl中--proxy-insecure（仅跳过代理验证）的逻辑完全一致，不需要修改代理端的任何配置。

内容的提问来源于stack exchange，提问作者joseph