JSP如何打开随机HTTPS URL及无证书读取用户输入HTTPS内容

Hi there! Let's tackle your problem step by step. You want to take a user-input HTTPS URL from your form, fetch its content in a JSP, and do this without needing any certificate keys or JKS files. Here's how to make it work properly:

First off, your existing HTML form is already set up to send the URL to testSSL.jsp—that's a solid start. The main hurdle here is that Java's default HTTPS client rejects untrusted certificates (like self-signed ones or those not in the system truststore), and you don't have the cert files to work around that natively. So we'll create a custom SSL context that temporarily trusts all certificates, then use it to fetch the URL content.

Full Working JSP Code (testSSL.jsp) #

<%@ page import="java.net.URL" %>
<%@ page import="java.net.HttpURLConnection" %>
<%@ page import="java.io.BufferedReader" %>
<%@ page import="java.io.InputStreamReader" %>
<%@ page import="javax.net.ssl.SSLContext" %>
<%@ page import="javax.net.ssl.TrustManager" %>
<%@ page import="javax.net.ssl.X509TrustManager" %>
<%@ page import="javax.net.ssl.HttpsURLConnection" %>
<%@ page import="javax.net.ssl.HostnameVerifier" %>
<%@ page import="java.security.cert.X509Certificate" %>
<%@ page contentType="text/html;charset=UTF-8" language="java" %>

<html>
<head>
    <title>HTTPS URL Content Fetcher</title>
</head>
<body>
    <%
        String urlStr = request.getParameter("sslRandomUrl");
        if (urlStr != null && !urlStr.trim().isEmpty()) {
            // 1. Create a TrustManager that trusts all certificates
            TrustManager[] trustAllCerts = new TrustManager[]{
                new X509TrustManager() {
                    public X509Certificate[] getAcceptedIssuers() {
                        return null;
                    }
                    public void checkClientTrusted(X509Certificate[] certs, String authType) {}
                    public void checkServerTrusted(X509Certificate[] certs, String authType) {}
                }
            };

            // 2. Initialize SSL context with our trust-all manager
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, trustAllCerts, new java.security.SecureRandom());

            // 3. Create a HostnameVerifier that accepts all hostnames (avoids mismatched cert errors)
            HostnameVerifier allHostsValid = (hostname, session) -> true;

            try {
                URL url = new URL(urlStr);
                HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
                
                // Apply our custom SSL settings to the connection
                connection.setSSLSocketFactory(sslContext.getSocketFactory());
                connection.setHostnameVerifier(allHostsValid);
                
                // Read the URL content line by line
                BufferedReader in = new BufferedReader(new InputStreamReader(connection.getInputStream()));
                String inputLine;
                StringBuilder content = new StringBuilder();
                
                while ((inputLine = in.readLine()) != null) {
                    content.append(inputLine);
                }
                
                in.close();
                connection.disconnect();

                // Display the fetched content to the user
                out.println("<h3>Fetched Content from " + urlStr + "</h3>");
                out.println("<pre>" + content.toString() + "</pre>");
            } catch (Exception e) {
                out.println("<h3>Error fetching URL:</h3>");
                out.println("<p>" + e.getMessage() + "</p>");
                e.printStackTrace(new java.io.PrintWriter(out));
            }
        } else {
            out.println("<p>Please enter a valid HTTPS URL in the form below.</p>");
        }
    %>

    <!-- Re-display the form for easy repeated use -->
    <form action="testSSL.jsp">
        <input name="sslRandomUrl" type="text" placeholder="Enter HTTPS URL" value="<%= urlStr != null ? urlStr : "" %>">
        <input type="submit" value="Fetch URL Content">
    </form>
</body>
</html>

Key Details Explained #

• Custom TrustManager: This component tells Java to trust every certificate it encounters, regardless of whether it's signed by a trusted authority. This is what lets us skip needing JKS files or certificate keys.
• SSLContext: We initialize it with our trust-all manager, so any HTTPS connection using this context will follow our relaxed trust rules.
• HostnameVerifier: Some test sites have certificates that don't match their domain name. This verifier accepts all hostnames to avoid those validation errors.
• Content Fetching: We cast the connection to HttpsURLConnection to apply our SSL settings, then read the input stream to capture the page's raw content.

Critical Security Warning #

⚠️ This approach is only for testing/development environments. Disabling certificate validation and hostname checks removes critical protections against man-in-the-middle attacks. In production, always use valid, trusted certificates and rely on Java's default SSL settings (or configure a custom truststore with the necessary certificates).

内容的提问来源于stack exchange，提问作者MrSalesi