Databases
StackOverflow2013
Postsdbo
POJava and HTTPS url connection without downloading certificate
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POJava and HTTPS url connection without downloading certificate
    primarykey
    data
    text
    <p>This code connects to a HTTPS site and I am assuming I am not verifying the certificate. But why don't I have to install a certificate locally for the site? Shouldn't I have to install a certificate locally and load it for this program or is it downloaded behind the covers? Is the traffic between the client to the remote site still encrypted in transmission?</p> <pre><code>import java.io.BufferedReader; import java.io.InputStreamReader; import java.io.Reader; import java.net.URL; import java.net.URLConnection; import java.security.cert.X509Certificate; import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLContext; import javax.net.ssl.SSLSession; import javax.net.ssl.TrustManager; import javax.net.ssl.X509TrustManager; public class TestSSL { public static void main(String[] args) throws Exception { // Create a trust manager that does not validate certificate chains TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() { public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } public void checkClientTrusted(X509Certificate[] certs, String authType) { } public void checkServerTrusted(X509Certificate[] certs, String authType) { } } }; // Install the all-trusting trust manager final SSLContext sc = SSLContext.getInstance("SSL"); sc.init(null, trustAllCerts, new java.security.SecureRandom()); HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); // Create all-trusting host name verifier HostnameVerifier allHostsValid = new HostnameVerifier() { public boolean verify(String hostname, SSLSession session) { return true; } }; // Install the all-trusting host verifier HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid); URL url = new URL("https://www.google.com"); URLConnection con = url.openConnection(); final Reader reader = new InputStreamReader(con.getInputStream()); final BufferedReader br = new BufferedReader(reader); String line = ""; while ((line = br.readLine()) != null) { System.out.println(line); } br.close(); } // End of main } // End of the class // </code></pre>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. This table or related slice is empty.
    1. USBerlin Brown
    plurals
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    1. PL
      singulars
      1. LTLinked
    2. PL
      singulars
      1. LTLinked
    3. PL
      singulars
      1. LTLinked
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    1. VO
      singulars
      1. POJava and HTTPS url connection without downloading certificate
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. POJava and HTTPS url connection without downloading certificate
      1. This table or related slice is empty.
      1. VTUpMod
    3. VO
      singulars
      1. POJava and HTTPS url connection without downloading certificate
      1. USJensen Ching
      1. VTFavorite
    1. COThat radically insecure `TrustManager` implementation doesn't even comply with its own specification. Check the Javadoc.
      singulars
      1. POJava and HTTPS url connection without downloading certificate
      1. USuser207421
    2. CO@EliteOctagon Don't use this in production code! This TrustManager simply ignores invalid certificates and makes MITM attacks very easy.
      singulars
      1. POJava and HTTPS url connection without downloading certificate
      1. USbinwiederhier
    3. COThanks @binwiederhier , I'll keep that in mind. Does that even go for URLs that no one will ever see as they are ones only I know of? Can you elaborate on the Man in the Middle attack in this situation?
      singulars
      1. POJava and HTTPS url connection without downloading certificate
      1. USSoluableNonagon
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload