如何为OkHttp添加自定义证书路径？

假设你的CA证书路径为/etc/lipki/ca-bundle.crt，对应Python requests里通过verify参数指定证书的用法，在OkHttp中需要通过自定义SSL配置来实现，同时可以搭配Basic认证，具体步骤和代码如下：

实现步骤 #

1. 加载指定路径的CA证书文件，转换为可信任的证书对象
2. 创建包含该证书的自定义信任管理器
3. 基于自定义信任管理器初始化SSL上下文
4. 将SSL上下文配置到OkHttpClient中，同时添加Basic认证逻辑

Java代码示例 #

import okhttp3.OkHttpClient;
import okhttp3.Request;
import okhttp3.Response;

import javax.net.ssl.*;
import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;

public class OkHttpCustomCaExample {
    public static void main(String[] args) throws Exception {
        // 指定CA证书路径
        String caCertPath = "/etc/lipki/ca-bundle.crt";
        
        // 加载CA证书
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        X509Certificate caCert = (X509Certificate) cf.generateCertificate(new FileInputStream(caCertPath));

        // 创建存储证书的KeyStore
        KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
        keyStore.load(null, null);
        keyStore.setCertificateEntry("ca-cert", caCert);

        // 初始化信任管理器
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(keyStore);
        TrustManager[] trustManagers = tmf.getTrustManagers();

        // 构建SSL上下文
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustManagers, null);

        // 配置OkHttpClient，添加SSL和Basic认证
        OkHttpClient client = new OkHttpClient.Builder()
                .sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustManagers[0])
                .authenticator((route, response) -> {
                    String credential = okhttp3.Credentials.basic("my_basic_username", "my_basic_password");
                    return response.request().newBuilder()
                            .header("Authorization", credential)
                            .build();
                })
                .build();

        // 发送POST请求（对应requests的post调用）
        Request request = new Request.Builder()
                .url("my_url")
                .post(okhttp3.RequestBody.create(new byte[0])) // 空请求体对应data={}
                .build();

        try (Response response = client.newCall(request).execute()) {
            System.out.println(response.body().string());
        }
    }
}

Kotlin代码示例（简化版） #

import okhttp3.Credentials
import okhttp3.OkHttpClient
import okhttp3.Request
import java.io.FileInputStream
import java.security.KeyStore
import java.security.cert.CertificateFactory
import javax.net.ssl.SSLContext
import javax.net.ssl.TrustManagerFactory

fun main() {
    val caCertPath = "/etc/lipki/ca-bundle.crt"
    
    // 加载CA证书
    val cf = CertificateFactory.getInstance("X.509")
    val caCert = cf.generateCertificate(FileInputStream(caCertPath)) as java.security.cert.X509Certificate

    // 初始化KeyStore存储证书
    val keyStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
        load(null, null)
        setCertificateEntry("ca-cert", caCert)
    }

    // 构建信任管理器
    val tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).apply {
        init(keyStore)
    }

    // 初始化SSL上下文
    val sslContext = SSLContext.getInstance("TLS").apply {
        init(null, tmf.trustManagers, null)
    }

    // 配置OkHttpClient
    val client = OkHttpClient.Builder()
        .sslSocketFactory(sslContext.socketFactory, tmf.trustManagers[0] as javax.net.ssl.X509TrustManager)
        .authenticator { _, response ->
            val credential = Credentials.basic("my_basic_username", "my_basic_password")
            response.request.newBuilder()
                .header("Authorization", credential)
                .build()
        }
        .build()

    // 发送请求
    val request = Request.Builder()
        .url("my_url")
        .post(okhttp3.RequestBody.create(null, ByteArray(0)))
        .build()

    client.newCall(request).execute().use { response ->
        println(response.body?.string())
    }
}

说明 #

• 代码中通过sslSocketFactory方法将自定义SSL上下文配置到OkHttpClient，实现信任指定CA证书的效果，对应requests的verify参数
• authenticator逻辑实现了Basic认证，对应requests的auth参数
• 实际项目中需要添加完善的异常捕获逻辑，处理文件读取、SSL初始化等可能出现的错误

内容的提问来源于stack exchange，提问作者olaf