使用com.squareup.okhttp：okhttp：2.4.0 with com.squareup.retrofit：retrofit：1.9.0在

Android应用程序,尝试通过HTTPS与使用自签名证书的HTTPS上的服务器REST API进行通信.

服务器密钥库具有私钥和2个证书,服务器和根证书. openssl s_client输出 –

Certificate chain

0 s:/C=...OU=Dev/CN=example.com

i:/C=... My CA/emailAddress=info@example.com

1 s:/C=... My CA/emailAddress=info@example.com

i:/C=... My CA/emailAddress=info@example.com

在Android应用程序中,OkHttp已使用根证书的SHA1签名进行初始化 –

CertificatePinner certificatePinner = new CertificatePinner.Builder()

.add("example.com", "sha1/5d...3b=")

.build();

OkHttpClient client = new OkHttpClient();

client.setCertificatePinner(certificatePinner);

RestAdapter restAdapter = new RestAdapter.Builder()

.setEndpoint("https://example.com")

.setClient(new OkClient(client))

.build();

但是当尝试发送请求失败时出现异常 –

retrofit.RetrofitError: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

at retrofit.RestAdapter$RestHandler.invokeRequest(RestAdapter.java:395)

at retrofit.RestAdapter$RestHandler.invoke(RestAdapter.java:240)

at java.lang.reflect.Proxy.invoke(Proxy.java:397)

at $Proxy1.report(Unknown Source)

...

at android.os.AsyncTask$2.call(AsyncTask.java:288)

at java.util.concurrent.FutureTask.run(FutureTask.java:237)

at android.os.AsyncTask$SerialExecutor$1.run(AsyncTask.java:231)

at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1112)

at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:587)

at java.lang.Thread.run(Thread.java:818)

Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.

at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:306)

at com.squareup.okhttp.internal.http.SocketConnector.connectTls(SocketConnector.java:103)

at com.squareup.okhttp.Connection.connect(Connection.java:143)

at com.squareup.okhttp.Connection.connectAndSetOwner(Connection.java:185)

at com.squareup.okhttp.OkHttpClient$1.connectAndSetOwner(OkHttpClient.java:128)

at com.squareup.okhttp.internal.http.HttpEngine.nextConnection(HttpEngine.java:341)

尝试使用sslSocket.startHandshake()时,它会抛出com.squareup.okhttp.internal.http.SocketConnector,甚至在使用CertificatePinner检查收到的证书之前.

我确保服务器使用openssl和curl –cacert root.pem正确安装证书.

那么为什么OkHttp在尝试检查提供的证书是否正常之前抛出异常呢？