How to ignore SSL certificate errors in Apache HttpClient 4.0

Asked 24/4, 2010 at 3:59 Answered 10/5, 2023 at 22:1

166

How do I bypass invalid SSL certificate errors with Apache HttpClient 4.0?

Flaherty answered 24/4, 2010 at 3:59 Comment(9)

It should be noted that the answers to this question don't do more than what's asked: they let you ignore the error but don't fix the underlying problem (a bit like removing the batteries from a smoke alarm instead of putting out the fire). Certificates have a purpose in ensuring the security of the SSL/TLS connection, ignoring those errors introduces a vulnerability to MITM attack. Use test certificates instead of ignoring the error. – Ricarda 13/5, 2012 at 22:42

Related to #1829275 – Osullivan 17/5, 2012 at 17:14

"like removing the batteries from a smoke alarm" You might give other developers the benefit of the doubt and assume they know what they're doing. Perhaps the motivation for this question is local testing and the OP wishes to run a quick test without going through the horrible amounts of Java boilerplate necessary to set up even a simple SSL environment. Maybe someone could just answer the question without going into a "holier than thou" lecture. – Delius 16/1, 2014 at 18:42

I.e in our company internal JIRA server has some "windows security policy based cert" which is valid on Windows machines included in domain and not valid on other. I can't control this policy and still want to call JIRA REST API. – Sememe 5/4, 2016 at 13:8

@Ricarda The inability to disable smoke detectors for a period of 30-60 minutes while dealing with a small kitchen fire shows an insane lack of insight into usage patterns by some legal official at some point that I feel borders on criminal. The fact that there is a concept of "removing batteries from a smoke alarm" proves this. I feel about the same level of anger about having to get certificates to work for a simple test that I know doesn't have security ramifications. The existence of this question proves this. – Denature 21/3, 2017 at 18:54

@BillK Sure, don't get me wrong, I've disabled that sort of verification myself for simple tests once in a while. The real problem is that most people understand the why it's a problem with smoke alarms. That's not so much the case in software development: these lines of codes won't generate errors, and it's very easy for various project stakeholders (especially those who don't get near the code) to push for a product release without realising the consequences. Fixing things that don't cause errors is generally not a priority, especially when you have a deadline. – Ricarda 21/3, 2017 at 20:26

@Ricarda Sounds like I agree--My point would be that to not recognize that this is an issue is a design flaw. If the designers were more aware of this issue they might have given us a command line -Dignore_certs_unsafe=true to disable cert checking completely. This is a pretty exact match to the fire alarm analogy where they should just have a button to disable it for 30 minutes instead of a law that it can't be disabled. Sometimes what is perceived as more security is actually less security in practice :) – Denature 24/3, 2017 at 21:11

Hmm, and actually that might be a good way to implement this hack--setting a -D variable that you enable in your dev launch environment but never prod which would eliminate your concern about forgetting it. – Denature 24/3, 2017 at 21:12

If you don't want it secure why are you using SSL at all? – Consort 11/5, 2017 at 12:20

You need to create a SSLContext with your own TrustManager and create HTTPS scheme using this context. Here is the code,

SSLContext sslContext = SSLContext.getInstance("SSL");

// set up a TrustManager that trusts everything
sslContext.init(null, new TrustManager[] { new X509TrustManager() {
            public X509Certificate[] getAcceptedIssuers() {
                    System.out.println("getAcceptedIssuers =============");
                    return null;
            }

            public void checkClientTrusted(X509Certificate[] certs,
                            String authType) {
                    System.out.println("checkClientTrusted =============");
            }

            public void checkServerTrusted(X509Certificate[] certs,
                            String authType) {
                    System.out.println("checkServerTrusted =============");
            }
} }, new SecureRandom());

SSLSocketFactory sf = new SSLSocketFactory(sslContext);
Scheme httpsScheme = new Scheme("https", 443, sf);
SchemeRegistry schemeRegistry = new SchemeRegistry();
schemeRegistry.register(httpsScheme);

// apache HttpClient version >4.2 should use BasicClientConnectionManager
ClientConnectionManager cm = new SingleClientConnManager(schemeRegistry);
HttpClient httpClient = new DefaultHttpClient(cm);

Nuri answered 24/4, 2010 at 4:32 Comment(12)

Say I don't want to buy valid SSL certificate for my site and just want to use it, this piece of code can help? How come I don't see any part where a URL is needed or exception handling is needed? – Flaherty 24/4, 2010 at 10:56

As you can see the X509TrustManager doesn't check for anything and doesn't throw any exceptions so any cert is accepted. – Nuri 24/4, 2010 at 13:19

Hmm, it's telling me that 'new SSLSocketFactory(ssslCont)' is expecting a KeyStore, not an SSLContext. Am I missing something? – Momentary 5/4, 2012 at 15:20

For some reason the Jelatic and Heroku jetty and tomcat servers can't pick up on this code whereas AWS beanstalk's tomcat understands and runs it just fine ... strange. – Puree 3/1, 2013 at 17:8

I get the error that an X509TrustManager can't be cast to a TrustManager. – Psalms 16/1, 2013 at 19:36

Make sure that you import the correct packages, i.e. from org.apache.http. – Gamophyllous 21/6, 2013 at 19:48

The way to create and configure an SSLContext is revised in 4.3: SSLContext sslContext = SSLContexts.custom().loadTrustMaterial(null, new TrustSelfSignedStrategy()).useTLS().build(); – Wallace 17/12, 2013 at 0:44

Anyone know how to throw all this together using HttpClientBuilder? – Responser 13/2, 2014 at 5:10

It works for me and SSLContext, TrustManager and X509TrustManager are all from package javax.net.ssl – Fabulous 2/6, 2015 at 22:6

which version of HttpClient you're using ? – Maldon 7/1, 2016 at 13:54

This technique is totally and utterly insecure. Do not use. Import the sever certificate into the client trust store, or gets the server certificate signed by a CA. – Consort 11/5, 2017 at 12:17

Still getting Certificate for <....> doesn't match any of the.... – Devonadevondra 1/2, 2022 at 16:27

125

All of the other answers were either deprecated or didn't work for HttpClient 4.3.

Here is a way to allow all hostnames when building an http client.

CloseableHttpClient httpClient = HttpClients
    .custom()
    .setHostnameVerifier(new AllowAllHostnameVerifier())
    .build();

Or if you are using version 4.4 or later, the updated call looks like this:

CloseableHttpClient httpClient = HttpClients
    .custom()
    .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE)
    .build();

Maryrosemarys answered 23/6, 2014 at 15:47 Comment(5)

Thanks for the answer, I would like to know from which package is HttpsClients as I'm using in Android compile("org.apache.httpcomponents:httpclient:4.3.4") but this class doesn't appear. – Pignus 15/11, 2014 at 15:27

It's package is org.apache.http.impl.client.HttpClients . – Maryrosemarys 17/11, 2014 at 15:11

This works around a host name mismatch (I assume), but it doesn't seem to work when the certificate isn't signed by a trusted authority. – Centralize 25/1, 2017 at 17:56

@Centralize that's why it says it "allows all hostnames", trust issues require different configuration. – Echopraxia 30/8, 2017 at 6:15

@eis, I was pointing out that this answer addresses the original question in certain cases but not others. – Centralize 30/8, 2017 at 15:18

You need to create a SSLContext with your own TrustManager and create HTTPS scheme using this context. Here is the code,

SSLContext sslContext = SSLContext.getInstance("SSL");

// set up a TrustManager that trusts everything
sslContext.init(null, new TrustManager[] { new X509TrustManager() {
            public X509Certificate[] getAcceptedIssuers() {
                    System.out.println("getAcceptedIssuers =============");
                    return null;
            }

            public void checkClientTrusted(X509Certificate[] certs,
                            String authType) {
                    System.out.println("checkClientTrusted =============");
            }

            public void checkServerTrusted(X509Certificate[] certs,
                            String authType) {
                    System.out.println("checkServerTrusted =============");
            }
} }, new SecureRandom());

SSLSocketFactory sf = new SSLSocketFactory(sslContext);
Scheme httpsScheme = new Scheme("https", 443, sf);
SchemeRegistry schemeRegistry = new SchemeRegistry();
schemeRegistry.register(httpsScheme);

// apache HttpClient version >4.2 should use BasicClientConnectionManager
ClientConnectionManager cm = new SingleClientConnManager(schemeRegistry);
HttpClient httpClient = new DefaultHttpClient(cm);