JavaSSL-没有SAN的证书的IP主机验证

当使用Java SSL进行连接时，如果证书中没有SubjectAlternativeName（SAN）字段，则需要进行额外的代码验证来确保连接的IP主机与证书中的主机名匹配。

以下是示例代码，其中假设证书中的主机名为example.com，连接的IP主机为192.168.0.1：

import javax.net.ssl.*;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import java.net.Socket;
import java.net.InetSocketAddress;

public class SSLHostnameVerifier implements HostnameVerifier {
    @Override
    public boolean verify(String hostname, SSLSession session) {
        try {
            // If the certificate has a SubjectAlternativeName extension, use it for validation
            if (session.getPeerCertificates()[0] instanceof X509Certificate) {
                X509Certificate cert = (X509Certificate) session.getPeerCertificates()[0];
                Collection<List<?>> sans = cert.getSubjectAlternativeNames();
                if (sans != null) {
                    for (List<?> san : sans) {
                        if (san.get(1).equals(hostname)) {
                            return true;
                        }
                    }
                }
            }

            // If the certificate does not have a SubjectAlternativeName extension, verify against CN
            SSLSocket socket = (SSLSocket)session.getSocket();
            Socket underlyingSocket = socket.getUnderlyingSocket();
            if (underlyingSocket instanceof java.net.InetSocketImpl) {
                InetSocketAddress remoteAddress = (InetSocketAddress)underlyingSocket.getRemoteSocketAddress();
                String remoteIP = remoteAddress.getAddress().getHostAddress();
          
                if (remoteIP.equals("192.168.0.1") && cert.getSubjectX500Principal().getName().contains("example.com")) {
                    return true;
                }
            }
  
            return false;
        } catch (SSLPeerUnverifiedException ex) {
            return false;
        }
    }
}

使用该代码的方法如下：

SSLContext context = SSLContext.getInstance("TLS");
TrustManager[] trustManagerArray = {new X509TrustManager() {
    public X509Certificate[] getAcceptedIssuers() {
        return null;
    }

    public void checkClientTrusted(X509Certificate