Java环境下WebSocket连接禁用SSL证书校验的实现咨询

云上老周

2026-10-2

注意：禁用SSL证书校验会带来严重的中间人攻击风险，仅可用于测试环境，生产环境禁止使用该配置

实现步骤

首先实现信任所有证书的SSL上下文工具方法，以及无校验的主机名验证器

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;
import java.security.cert.X509Certificate;

// 生成跳过证书校验的SSL上下文
private static SSLContext getUnsafeSSLContext() throws Exception {
    X509TrustManager trustAllManager = new X509TrustManager() {
        @Override
        public void checkClientTrusted(X509Certificate[] x509Certificates, String s) {}
        @Override
        public void checkServerTrusted(X509Certificate[] x509Certificates, String s) {}
        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
    };
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, new TrustManager[]{trustAllManager}, null);
    return sslContext;
}

// 生成跳过主机名校验的验证器
private static HostnameVerifier getUnsafeHostnameVerifier() {
    return (hostname, sslSession) -> true;
}

修改原有WebSocket连接逻辑，在调用connect()之前注入无校验的SSL配置

注：你原有代码存在笔误 client.setServerWebSocketUrlPathsockPath); 已修正为 client.setServerWebSocketUrlPath(sockPath);

socketUri = new URI(sockPath);
Map<String, String> head = new HashMap<>();
head.put("Authorization", "Bearer ".concat(headerToken));
client = new WebSocket(websocketUri, head);
client.setServerWebSocketUrlPath(sockPath);

// 注入无校验SSL配置
SSLContext unsafeSslContext = getUnsafeSSLContext();
client.setSocketFactory(unsafeSslContext.getSocketFactory());
client.setHostnameVerifier(getUnsafeHostnameVerifier());

client.connect();