Disable SSL Certificate check

[aemreunal]

Hello,

I'm writing a server on Spring and I'm using Spring Security to limit connections to HTTPS, running the WAR on Tomcat. The server auto-generates a self-signed certificate and as I am using it in a development environment, I don't want to go through the hassle of obtaining proper certificates or something. This means that Unirest (or rather the underlying HTTP client) rejects the certificate with the following exception:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

It's a pretty frustrating situation to be in, as I genuinely believe many people are using Unirest with these certificates. I think I can circumvent this issue by creating a custom HttpClient object and giving it to Unirest as the default, but I'd rather not mess with Unirest, in order to avoid any future issues down the line.

I've noticed that the PHP version got this option (Kong/unirest-php#27) quite some time ago.

My questions are:

1. Am I missing something obvious that would let me disable SSL certificate check? If so, would you kindly point me in the direction?
2. If not, are there any plans to introduce this setting to the Java version as well?

Thanks in advance for your time.

[aemreunal]

I achieved self-signed certificate trusting with the following code:

SSLContext sslcontext = SSLContexts.custom()
                                   .loadTrustMaterial(null, new TrustSelfSignedStrategy())
                                   .build();

SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext);
CloseableHttpClient httpclient = HttpClients.custom()
                                            .setSSLSocketFactory(sslsf)
                                            .build();
Unirest.setHttpClient(httpclient);

However, the requests are incredibly slow (~10 seconds with custom HttpClient and Unirest, on the localhost) compared to a regular REST client (~0.14 second with CocoaRestClient, on the localhost). You might imagine that with such a speed, Unirest becomes unusable.

[aemreunal]

The issue seems to be resolved when a bunch of packages were updated. I don't know what caused the issue.

[monarchwadia]

I'm also having trouble with this issue. It would be nice to be able to ignore SSL certificate checks in Java.
@aemreunal could you please tell me what packages were updated, if you still remember? It would help :-)

[aemreunal]

@monarchjhaveri I'm so sorry, I really don't remember :( Maybe it was a Java update that seemingly resolved this speed issue. Are you having that speed issue as well?

[monarchwadia]

Hi @aemreunal , thanks for replying, I managed to resolve that speed issue :-) it was a problem with my code

[kamaljeetrathi]

How to set X509Certificate in unirest request.

[boodskap]

import java.security.cert.X509Certificate;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;
import com.mashape.unirest.http.exceptions.UnirestException;

static {
	try {

		TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
			public java.security.cert.X509Certificate[] getAcceptedIssuers() {
				return null;
			}

			public void checkClientTrusted(X509Certificate[] certs, String authType) {
			}

			public void checkServerTrusted(X509Certificate[] certs, String authType) {
			}

		} };
		

		SSLContext sslcontext = SSLContext.getInstance("SSL");
		sslcontext.init(null, trustAllCerts, new java.security.SecureRandom());
		HttpsURLConnection.setDefaultSSLSocketFactory(sslcontext.getSocketFactory());
		SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext);
		CloseableHttpClient httpclient = HttpClients.custom().setSSLSocketFactory(sslsf).build();
		Unirest.setHttpClient(httpclient);

	} catch (Exception e) {
		e.printStackTrace();
	}
}

[peasunseries]

@boodskap It's worked well, thanks.

[Jofairden]

Im still getting com.mashape.unirest.http.exceptions.UnirestException: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure with all of this.

[wanghuanjing]

@Jofairden , it may be you don't set proxy. and I found you must set the proxy through httpclient instead of unirest. which like:
CloseableHttpClient httpclient = HttpClients.custom().setSSLSocketFactory(sslsf). setProxy(new HttpHost("proxy_url", proxy_port))build();
Unirest.setHttpClient(httpclient)

It works for me!

[arthur-dai-618]

@wanghuanjing Works for me too, poor chinese~

[ryber]

This is actually built into Unirest now with Unirest.config().verifySsl(false);

[javase]

This is actually built into Unirest now with Unirest.config().verifySsl(false);

thank you so much , it works

[josegabrielx]

Thank you it works for me!

[yuvikrishnaios1]

Thanks it work for me also.

[atilioch]

Excelent!! Thank you very much!!

[ryber]

Just don't do that prod please