Android调用C# ASP.NET JSON接口遇SSL证书无效问题求助

一、临时方案：Android端跳过SSL验证（仅开发环境用） #

注意：绝对不能在生产环境用这个方法，会导致数据传输完全不安全

修改Retrofit的初始化逻辑，添加一个跳过SSL验证的OkHttpClient：

// 新增工具方法创建跳过SSL验证的OkHttpClient
private fun createUnsafeOkHttpClient(): OkHttpClient {
    return try {
        // 创建信任所有证书的TrustManager
        val trustAllCerts = arrayOf<TrustManager>(object : X509TrustManager {
            override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
            override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) {}
            override fun getAcceptedIssuers(): Array<X509Certificate> = arrayOf()
        })

        // 安装信任所有证书的SSLContext
        val sslContext = SSLContext.getInstance("SSL")
        sslContext.init(null, trustAllCerts, SecureRandom())
        val sslSocketFactory = sslContext.socketFactory

        OkHttpClient.Builder()
            .sslSocketFactory(sslSocketFactory, trustAllCerts[0] as X509TrustManager)
            .hostnameVerifier { _, _ -> true } // 跳过主机名验证
            .build()
    } catch (e: Exception) {
        throw RuntimeException(e)
    }
}

// 修改downloaddata方法中的Retrofit初始化
fun downloaddata(){
    println("retrofit önce")
    val retrofit = Retrofit.Builder()
        .baseUrl("https://192.168.1.44:5001")
        .client(createUnsafeOkHttpClient()) // 添加这一行
        .addConverterFactory(GsonConverterFactory.create())
        .build().create(ProductAPI::class.java)
    // 后续代码不变...
}

别忘了添加必要的导入：

import okhttp3.OkHttpClient
import java.security.SecureRandom
import java.security.cert.X509Certificate
import javax.net.ssl.SSLContext
import javax.net.ssl.TrustManager
import javax.net.ssl.X509TrustManager

二、推荐方案：给ASP.NET本地项目配置可信SSL证书 #

这个方法更安全，适合长期开发使用：

1. 在Visual Studio中配置ASP.NET项目的SSL
   打开项目的Properties -> Debug，勾选Enable SSL，复制生成的HTTPS地址（比如https://localhost:5001），确保Android代码中的baseUrl使用这个地址或对应的局域网IP。

2. 导出本地SSL证书

   • 用浏览器打开本地HTTPS地址，点击地址栏的锁图标
   • 选择「证书」->「详细信息」->「复制到文件」
   • 选择「Base64编码的X.509(.CER)」格式，保存证书文件（比如localhost.cer）

3. 在Android项目中导入证书

   • 在Android项目的res目录下新建raw文件夹，把导出的证书放进去

4. 配置Retrofit信任该证书
   编写代码让OkHttpClient信任导入的证书：

private fun getTrustedOkHttpClient(context: Context): OkHttpClient {
    return try {
        val certificateFactory = CertificateFactory.getInstance("X.509")
        val inputStream = context.resources.openRawResource(R.raw.localhost) // 替换成你的证书文件名
        val certificate = certificateFactory.generateCertificate(inputStream)
        inputStream.close()

        val keyStore = KeyStore.getInstance(KeyStore.getDefaultType())
        keyStore.load(null, null)
        keyStore.setCertificateEntry("localhost", certificate)

        val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
        trustManagerFactory.init(keyStore)

        val sslContext = SSLContext.getInstance("TLS")
        sslContext.init(null, trustManagerFactory.trustManagers, SecureRandom())

        OkHttpClient.Builder()
            .sslSocketFactory(sslContext.socketFactory, trustManagerFactory.trustManagers[0] as X509TrustManager)
            .build()
    } catch (e: Exception) {
        throw RuntimeException(e)
    }
}

// 修改downloaddata方法，注意要传入Context（比如从Activity/Fragment传递）
fun downloaddata(context: Context){
    println("retrofit önce")
    val retrofit = Retrofit.Builder()
        .baseUrl("https://192.168.1.44:5001")
        .client(getTrustedOkHttpClient(context)) // 添加这一行
        .addConverterFactory(GsonConverterFactory.create())
        .build().create(ProductAPI::class.java)
    // 后续代码不变...
}

内容的提问来源于stack exchange，提问作者Mehmet Fatih BİLGİN