Java版Eclipse Paho如何关闭TLS证书验证？

要实现和Python版Paho等价的证书验证关闭逻辑，你需要通过自定义SSL上下文忽略证书有效性检查，并关闭主机名验证，具体实现如下：

核心逻辑对应 #

Python中的cert_reqs=ssl.CERT_NONE对应Java中信任所有证书的TrustManager，tls_insecure_set(True)对应关闭SSL连接的主机名验证。

1. 实现信任所有证书的TrustManager #

import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;

public class TrustAllCertificates implements X509TrustManager {
    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) {}

    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) {}

    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
}

2. 构建忽略验证的SSLSocketFactory #

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import java.security.NoSuchAlgorithmException;
import java.security.SecureRandom;

public class SslUtils {
    public static SSLSocketFactory createTrustAllSslSocketFactory() throws NoSuchAlgorithmException {
        // 创建信任所有证书的SSL上下文
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, new TrustManager[]{new TrustAllCertificates()}, new SecureRandom());
        
        SSLSocketFactory socketFactory = sslContext.getSocketFactory();
        
        // 关闭主机名验证，对应Python的tls_insecure_set(True)
        try {
            // 通过反射修改SunJSSE实现的主机名验证配置
            Class<?> factoryClass = socketFactory.getClass();
            if (factoryClass.getName().contains("SunJSSE")) {
                Object delegate = factoryClass.getDeclaredField("delegate").get(socketFactory);
                factoryClass = delegate.getClass();
            }
            factoryClass.getDeclaredMethod("setEndpointIdentificationAlgorithm", String.class)
                    .invoke(socketFactory, (String) null);
        } catch (Exception e) {
            // 部分环境反射失败可忽略，不影响核心证书验证关闭
        }
        
        return socketFactory;
    }
}

3. 配置MQTT客户端（含WebSocket传输） #

import org.eclipse.paho.client.mqttv3.MqttAsyncClient;
import org.eclipse.paho.client.mqttv3.MqttConnectOptions;
import org.eclipse.paho.client.mqttv3.persist.MemoryPersistence;

public class MqttClientExample {
    public static void main(String[] args) throws Exception {
        String brokerUrl = "wss://your-mqtt-server:8083/mqtt"; // WebSocket的WSS地址
        String clientId = "java-mqtt-client";
        
        // 初始化客户端
        MqttAsyncClient client = new MqttAsyncClient(brokerUrl, clientId, new MemoryPersistence());
        
        // 设置连接选项
        MqttConnectOptions options = new MqttConnectOptions();
        options.setSocketFactory(SslUtils.createTrustAllSslSocketFactory());
        
        // 发起连接
        client.connect(options).waitForCompletion();
        System.out.println("已连接到MQTT服务器");
    }
}

注意事项 #

• 该配置仅适合测试环境，生产环境必须启用证书验证，避免中间人攻击风险。
• 如果使用TCP连接（ssl://开头地址），只需修改brokerUrl即可，代码逻辑完全一致。
• 若反射关闭主机名验证失败，可尝试在创建Socket后直接设置参数：

SSLSocket socket = (SSLSocket) socketFactory.createSocket("your-server", 8883);
socket.getSSLParameters().setEndpointIdentificationAlgorithm(null);

内容的提问来源于stack exchange，提问作者Westy