某種情況下需要動態下載證書檔案後使用 SSL 訪問某服務，但由於 JVM 使用預設的證書訪問新服務，該證書在 JVM 啟動的時候載入，那時還沒有新服務的證書，所以會報 ValidatorException，詳情：

		URL localURL = new URL(urlPath);
		URLConnection connection = localURL.openConnection();
		HttpURLConnection httpURLConnection = (HttpURLConnection) connection;
		if (connection instanceof HttpsURLConnection) {
			SSLSocketFactory sslSocketFactory = getSSLFactoryInstance();
		    ((HttpsURLConnection) httpURLConnection).setSSLSocketFactory(sslSocketFactory);
		}
		httpURLConnection.setDoOutput(true);
		httpURLConnection.setRequestMethod("POST");
		httpURLConnection.setRequestProperty("Content-Type", "application/octet-stream");
		httpURLConnection.setRequestProperty("Accept-Encoding", "chunck");
		httpURLConnection.setConnectTimeout(3000);
		//httpURLConnection.setReadTimeout(18000);
		
		outputStream = httpURLConnection.getOutputStream();
		baos = new ByteArrayOutputStream(8196);
		ObjectOutputStream oos = new ObjectOutputStream(baos);
		oos.writeObject(e);
		oos.flush();
		oos.close();
		outputStream.write(baos.toByteArray());
		outputStream.flush();
		
		if (HttpStatus.SC_OK == httpURLConnection.getResponseCode()) {
 

呼叫到的 getSSLFactoryInstance 方法：

    private static SSLSocketFactory selfSSLSocketFactoryInstance = null;
    
    private static synchronized SSLSocketFactory getSSLFactoryInstance() throws ALSAppException {
    	if (null == selfSSLSocketFactoryInstance) {
    		KeyStore keyStore = null;
    		TrustManagerFactory tmf = null;
    		SSLContext ctx = null;
    		InputStream is = null;
    		String strJnlpHome = System.getProperty("jnlpx.home");
    		try {
    			keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
    			if (StringUtil.isNotEmpty(strJnlpHome)) {
    				is = fullStream(strJnlpHome + "/../lib/security/cacerts");
    			}
    			keyStore.load(is, "changeit".toCharArray());
    			tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        	    tmf.init(keyStore);
        	    ctx = SSLContext.getInstance("TLSv1");
        	    ctx.init(null, tmf.getTrustManagers(), null);
        	    selfSSLSocketFactoryInstance = ctx.getSocketFactory();
    		} catch (Exception e) {
        	    throw new ALSAppException(ExceptionKey.RUN_TIME_EXCEPTION, e);
      	  }
    	}
    	return selfSSLSocketFactoryInstance;
    }
 

呼叫到的 fullStream 方法：

    private static InputStream fullStream(String fname) throws IOException {
        FileInputStream fis = new FileInputStream(fname);
        DataInputStream dis = new DataInputStream(fis);
        byte[] bytes = new byte[dis.available()];
        dis.readFully(bytes);
        ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
        return bais;
    }

還有一種解決方案是實現 X509TrustManager 介面，以下為網際網路上流行的一種寫法：

TrustManager tm = new X509TrustManager() {
    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
    }

    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {

    }

    public X509Certificate[] getAcceptedIssuers() {
        return null;
    }
};

但是很明顯以上寫法忽略了任何 SSL 證書校驗，雖然走的還是 https 協議即密文傳輸，但是在中間人劫持面前失去了 SSL 應有的保護作用，所以還是要謹慎使用。起碼的 server 端校驗、證書域名校驗還是要有的，不能偷懶。

參考資料

• Access java keystore programattically to create SSLSocketFactory
• How can I use different certificates on specific connections?
• JBoss reload certificate truststore without restart
• Clearing Java certificates cache (force reload certificates)
• an unsafe implementation of the interface X509TrustManager from google