CXF RESTful Client - How to do trust all certs?
This is from the CXF mailing list. Note that I didn't have to implement it due to other system updates, so this is theoretical:
WebClient webClient = WebClient.create(this.serviceURL,
this.username,
this.password,
null); // Spring config file - we don't use this
if (trustAllCerts)
{
HTTPConduit conduit = WebClient.getConfig(webClient)
.getHttpConduit();
TLSClientParameters params =
conduit.getTlsClientParameters();
if (params == null)
{
params = new TLSClientParameters();
conduit.setTlsClientParameters(params);
}
params.setTrustManagers(new TrustManager[] { new
DumbX509TrustManager() });
params.setDisableCNCheck(true);
}
To complete the answer from sdoca, here is an implementation with a dumb X509 trust manager:
import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.jaxrs.client.WebClient;
import org.apache.cxf.transport.http.HTTPConduit;
[...]
public class ApiClient {
private WebClient webClient;
[...]
public void init() {
webClient = createWebClient(URI).accept(MediaType.APPLICATION_JSON).type(MediaType.APPLICATION_JSON);
addX509TrustManager();
}
private void addX509TrustManager() {
Assert.notNull(webClient, "Client needs to be initialized");
HTTPConduit conduit = WebClient.getConfig(webClient).getHttpConduit();
TLSClientParameters params = conduit.getTlsClientParameters();
if (params == null) {
params = new TLSClientParameters();
conduit.setTlsClientParameters(params);
}
params.setTrustManagers(new TrustManager[] { new BlindTrustManager() });
params.setDisableCNCheck(true);
}
}
Where BlindTrustManager is defined as follows:
import java.security.cert.X509Certificate;
import javax.net.ssl.X509TrustManager;
/**
* This dumb X509TrustManager trusts all certificate. TThis SHOULD NOT be used in Production.
*/
public class BlindTrustManager implements X509TrustManager {
@Override
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws java.security.cert.CertificateException {
}
@Override
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws java.security.cert.CertificateException {
}
@Override
public X509Certificate[] getAcceptedIssuers() {
return null;
}
}
It may be useful to check this links for a better understanding:
- Accept server's self-signed ssl certificate in Java client
- https://docs.oracle.com/javase/7/docs/api/javax/net/ssl/X509TrustManager.html