运行Groovy脚本访问HTTPS地址时如何禁用SSL验证？

注意事项 #

• 以下方案仅适用于本地测试环境，生产环境严禁关闭SSL验证，会带来严重的安全风险
• 生产环境建议将目标站点的SSL证书导入JDK信任库解决该问题

问题报错信息 #

触发报错的代码行：

def post = new URL("https://abc.deg.com").openConnection();

完整报错日志：

Caught: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at java_net_URLConnection$getOutputStream$1.call(Unknown Source)
    at url.processRequest(url.groovy:8)
    at url$processRequest.callCurrent(Unknown Source)
    at url.run(url.groovy:17)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:78)
    at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    ... 7 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    ... 7 more

解决方案1：全局关闭SSL验证（整个脚本生效） #

在网络请求代码前插入以下配置代码，原有请求逻辑无需修改即可直接运行：

import javax.net.ssl.HttpsURLConnection
import javax.net.ssl.SSLContext
import javax.net.ssl.TrustManager
import javax.net.ssl.X509TrustManager
import java.security.cert.X509Certificate

// 定义信任所有证书的信任管理器
def trustAllCerts = [
    getAcceptedIssuers: { null },
    checkClientTrusted: { X509Certificate[] certs, String authType -> },
    checkServerTrusted: { X509Certificate[] certs, String authType -> }
] as X509TrustManager

// 初始化SSL上下文
def sslContext = SSLContext.getInstance("TLS")
sslContext.init(null, [trustAllCerts] as TrustManager[], new java.security.SecureRandom())
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory())

// 关闭全局主机名验证
HttpsURLConnection.setDefaultHostnameVerifier({ hostname, session -> true })

解决方案2：仅针对单个请求关闭验证（更安全，不影响其他请求） #

修改原有请求代码，仅对当前目标连接单独配置忽略SSL验证：

import javax.net.ssl.HttpsURLConnection
import javax.net.ssl.SSLContext
import javax.net.ssl.TrustManager
import javax.net.ssl.X509TrustManager
import java.security.cert.X509Certificate

def url = new URL("https://abc.deg.com")
def connection = url.openConnection() as HttpsURLConnection

// 定义信任所有证书的信任管理器
def trustAllCerts = [
    getAcceptedIssuers: { null },
    checkClientTrusted: { X509Certificate[] certs, String authType -> },
    checkServerTrusted: { X509Certificate[] certs, String authType -> }
] as X509TrustManager

def sslContext = SSLContext.getInstance("TLS")
sslContext.init(null, [trustAllCerts] as TrustManager[], new java.security.SecureRandom())
connection.setSSLSocketFactory(sslContext.getSocketFactory())

// 仅关闭当前连接的主机名验证
connection.setHostnameVerifier({ hostname, session -> true })

// 后续原有请求逻辑不变，比如设置请求方法、写入参数、获取响应等
connection.setRequestMethod("POST")
// ...

内容的提问来源于stack exchange，提问作者user124