如何仅通过Java代码禁用SSL验证（向自有HTTPS服务器请求时）

在对接自有HTTPS服务器（比如使用自签名证书）时，若需要临时绕过SSL证书验证，可通过以下Java代码实现，分两种常用场景说明：

一、Java原生HttpsURLConnection实现 #

1. 工具类封装 #

import javax.net.ssl.*;
import java.security.cert.X509Certificate;

public class SSLIgnoreUtils {
    // 信任所有证书的TrustManager实现
    private static final TrustManager[] TRUST_ALL_CERTS = new TrustManager[]{
            new X509TrustManager() {
                @Override
                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }

                @Override
                public void checkClientTrusted(X509Certificate[] certs, String authType) {}

                @Override
                public void checkServerTrusted(X509Certificate[] certs, String authType) {}
            }
    };

    // 信任所有主机名的HostnameVerifier实现
    private static final HostnameVerifier TRUST_ALL_HOSTNAMES = (hostname, session) -> true;

    /**
     * 全局禁用SSL证书与主机名验证
     * 注意：会影响所有后续HTTPS请求
     */
    public static void disableGlobalSSLCertCheck() throws Exception {
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, TRUST_ALL_CERTS, new java.security.SecureRandom());
        
        HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
        HttpsURLConnection.setDefaultHostnameVerifier(TRUST_ALL_HOSTNAMES);
    }

    /**
     * 为单个请求设置SSL忽略验证
     * 仅影响当前连接，不全局生效
     */
    public static void setupSingleConnectionSSLIgnore(HttpsURLConnection conn) throws Exception {
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, TRUST_ALL_CERTS, new java.security.SecureRandom());
        
        conn.setSSLSocketFactory(sslContext.getSocketFactory());
        conn.setHostnameVerifier(TRUST_ALL_HOSTNAMES);
    }
}

2. 使用示例 #

全局禁用场景

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URL;
import javax.net.ssl.HttpsURLConnection;

public class NativeHttpsExample {
    public static void main(String[] args) {
        try {
            // 全局禁用SSL验证
            SSLIgnoreUtils.disableGlobalSSLCertCheck();
            
            // 发送HTTPS请求
            URL targetUrl = new URL("https://your-private-server.com/api/test");
            HttpsURLConnection connection = (HttpsURLConnection) targetUrl.openConnection();
            connection.setRequestMethod("GET");

            // 读取响应
            BufferedReader reader = new BufferedReader(new InputStreamReader(connection.getInputStream()));
            String line;
            StringBuilder response = new StringBuilder();
            while ((line = reader.readLine()) != null) {
                response.append(line);
            }
            reader.close();
            connection.disconnect();

            System.out.println("响应内容：" + response);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

单个请求禁用场景

// 省略重复代码，仅修改请求部分
URL targetUrl = new URL("https://your-private-server.com/api/test");
HttpsURLConnection connection = (HttpsURLConnection) targetUrl.openConnection();
// 不为全局设置，只为当前连接配置忽略
SSLIgnoreUtils.setupSingleConnectionSSLIgnore(connection);
connection.setRequestMethod("GET");
// 后续读取响应逻辑相同

二、Apache HttpClient（4.x版本）实现 #

如果项目使用Apache HttpClient，可针对性配置忽略SSL验证：

import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContextBuilder;

import java.io.BufferedReader;
import java.io.InputStreamReader;

public class ApacheHttpClientExample {
    public static void main(String[] args) {
        try {
            // 构建信任所有证书的SSL上下文
            SSLContext sslContext = new SSLContextBuilder()
                    .loadTrustMaterial(null, new TrustSelfSignedStrategy())
                    .build();

            // 创建忽略主机名验证的连接工厂
            SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
                    sslContext,
                    NoopHostnameVerifier.INSTANCE
            );

            // 构建自定义HttpClient
            try (CloseableHttpClient httpClient = HttpClients.custom()
                    .setSSLSocketFactory(sslSocketFactory)
                    .build()) {

                HttpGet request = new HttpGet("https://your-private-server.com/api/test");
                try (CloseableHttpResponse response = httpClient.execute(request)) {
                    // 读取响应
                    BufferedReader reader = new BufferedReader(
                            new InputStreamReader(response.getEntity().getContent())
                    );
                    String line;
                    StringBuilder result = new StringBuilder();
                    while ((line = reader.readLine()) != null) {
                        result.append(line);
                    }
                    reader.close();

                    System.out.println("响应内容：" + result);
                }
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

重要注意事项 #

• 禁止在生产环境使用：完全禁用SSL验证会彻底失去HTTPS的安全防护，极易遭受中间人攻击，仅适合测试环境或自有封闭环境临时使用。
• 更安全的替代方案：若为自有服务器，建议将服务器的自签名证书导入Java信任库（cacerts），而非直接禁用验证。
• 全局禁用的影响：使用disableGlobalSSLCertCheck()后，所有后续的HttpsURLConnection请求都会跳过SSL验证，如需仅针对特定请求生效，优先使用单个连接配置的方式。

内容的提问来源于stack exchange，提问作者NxN