解决ImageLoader加载HTTPS图片证书校验异常问题

 1 public class AuthImageDownloader extends BaseImageDownloader {
 2 
 3     public static final String TAG = AuthImageDownloader.class.getName();
 4 
 5     /**
 6      * {@value}
 7      */
 8     public static final int DEFAULT_HTTP_CONNECT_TIMEOUT = 5 * 1000; // milliseconds
 9     /**
10      * {@value}
11      */
12     public static final int DEFAULT_HTTP_READ_TIMEOUT = 20 * 1000; // milliseconds
13 
14     public AuthImageDownloader(Context context) {
15         this(context, DEFAULT_HTTP_CONNECT_TIMEOUT, DEFAULT_HTTP_READ_TIMEOUT);
16     }
17 
18     public AuthImageDownloader(Context context, int connectTimeout, int readTimeout) {
19         super(context, connectTimeout, readTimeout);
20     }
21 
22     @Override
23     protected InputStream getStreamFromNetwork(String imageUri, Object extra) throws IOException {
24 
25         URL url = null;
26         try {
27             url = new URL(imageUri);
28         } catch (MalformedURLException e) {
29             Log.e(TAG, e.getMessage(), e);
30         }
31         HttpURLConnection http = null;
32 
33         if (Scheme.ofUri(imageUri) == Scheme.HTTPS) {
34             trustAllHosts();
35             HttpsURLConnection https = (HttpsURLConnection) url
36                     .openConnection();
37             https.setHostnameVerifier(DO_NOT_VERIFY);
38             http = https;
39             http.connect();
40         } else {
41             http = (HttpURLConnection) url.openConnection();
42         }
43 
44         http.setConnectTimeout(connectTimeout);
45         http.setReadTimeout(readTimeout);
46         return new FlushedInputStream(new BufferedInputStream(
47                 http.getInputStream()));
48     }
49 
50     // always verify the host - dont check for certificate
51     final static HostnameVerifier DO_NOT_VERIFY = new HostnameVerifier() {
52         @Override
53         public boolean verify(String hostname, SSLSession session) {
54             return true;
55         }
56     };
57 
58     /**
59      * Trust every server - dont check for any certificate
60      */
61     private static void trustAllHosts() {
62         // Create a trust manager that does not validate certificate chains
63         TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
64             @Override
65             public void checkClientTrusted(
66                     java.security.cert.X509Certificate[] x509Certificates,
67                     String s) throws java.security.cert.CertificateException {
68             }
69 
70             @Override
71             public void checkServerTrusted(
72                     java.security.cert.X509Certificate[] x509Certificates,
73                     String s) throws java.security.cert.CertificateException {
74             }
75 
76             @Override
77             public java.security.cert.X509Certificate[] getAcceptedIssuers() {
78                 return new java.security.cert.X509Certificate[]{};
79             }
80         }};
81 
82         // Install the all-trusting trust manager
83         try {
84             SSLContext sc = SSLContext.getInstance("TLS");
85             sc.init(null, trustAllCerts, new java.security.SecureRandom());
86             HttpsURLConnection
87                     .setDefaultSSLSocketFactory(sc.getSocketFactory());
88         } catch (Exception e) {
89             e.printStackTrace();
90         }
91     }
92 }