javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
網上基本上都是信任所有證書來解決 SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER

這個方法的程式碼如下:

public static String httpsPostInvoke(String url,Map<String, Object> map) throws IOException, ServiceException {
		
    	HttpClient client = new DefaultHttpClient();
    	String str = "";
    	
        try { 
        	X509TrustManager xtm = new X509TrustManager(){   //建立TrustManager 
                public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {} 
                public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {} 
                public X509Certificate[] getAcceptedIssuers() { return null; }
            };
            SSLContext ctx = SSLContext.getInstance("TLS"); 
            ctx.init(null, new TrustManager[]{xtm}, null); 
            SSLSocketFactory socketFactory = new SSLSocketFactory(ctx,SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 
            client.getConnectionManager().getSchemeRegistry().register(new Scheme("https", 443, socketFactory)); 

            List<NameValuePair> params = new ArrayList<NameValuePair>();//構建POST請求的引數
    		for (String key : map.keySet()) {
    			String value = null;
    			Object obj = null;
    			if((obj = map.get(key)) != null){
    				value = obj.toString();
    			}
    			params.add(new BasicNameValuePair(key, value));
    		}
            UrlEncodedFormEntity entity = new UrlEncodedFormEntity(params, "UTF-8");
    		HttpPost post = new HttpPost(url);//建立HttpPost 
    		post.setEntity(entity);
            
             
    		HttpResponse response = client.execute(post);
			if (response.getStatusLine().getStatusCode() != HttpStatus.SC_OK) {
				throw new ServiceException("Http介面狀態出錯("
						+ response.getStatusLine().getStatusCode() + ")");
			}
			str = EntityUtils.toString(response.getEntity());
        } catch (NoSuchAlgorithmException e) {
			e.printStackTrace();
		} catch (KeyManagementException e) {
			e.printStackTrace();
		} catch (Exception e) {
			e.printStackTrace();
		}finally { 
        	client.getConnectionManager().shutdown(); 
        	return str;
        } 
    } 
 

執行，ok，沒報javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated

但是，信任所有的證書，對於強迫症的我和程式猿絕對不能寫死的一貫原則，我...又TM花了很長時間，腦補了很多ssl、https的知識，結合網上的程式碼，發現是可以信任指定證書的，如下程式碼:

public static String httpsPostInvoke(String url,Map<String, Object> map) throws IOException, ServiceException {
    	
    	InputStream inputStream = null;
    	HttpClient httpClient = new DefaultHttpClient();
    	String result = "";
    	
    	try{
    		//從 inputStream 載入 CA 證書
    		inputStream = NetworkUtil.class.getResourceAsStream("/testCa.cer");
    		CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
    		Certificate certificate = certificateFactory.generateCertificate(inputStream);
    		
    		//構造含有信任 CA 證書的 KeyStore
        	KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        	trustStore.load(null, null);
        	trustStore.setCertificateEntry("myalias", certificate);
        	
        	SSLSocketFactory socketFactory = new SSLSocketFactory(trustStore);
            httpClient.getConnectionManager().getSchemeRegistry().register(new Scheme("https", 443, socketFactory));
        	
            List<NameValuePair> params = new ArrayList<NameValuePair>();//構建POST請求的引數
    		for (String key : map.keySet()) {
    			String value = null;
    			Object obj = null;
    			if((obj = map.get(key)) != null){
    				value = obj.toString();
    			}
    			params.add(new BasicNameValuePair(key, value));
    		}
            UrlEncodedFormEntity entity = new UrlEncodedFormEntity(params, "UTF-8");
    		HttpPost post = new HttpPost(url);
    		post.setEntity(entity);
    		
    		HttpResponse response = httpClient.execute(post);
			if (response.getStatusLine().getStatusCode() != HttpStatus.SC_OK) {
				throw new ServiceException("Http介面狀態出錯("
						+ response.getStatusLine().getStatusCode() + ")");
			}
			result = EntityUtils.toString(response.getEntity());
    	} catch (CertificateException e) {
			e.printStackTrace();
		} catch (KeyStoreException e) {
			e.printStackTrace();
		} catch (NoSuchAlgorithmException e) {
			e.printStackTrace();
		} catch (KeyManagementException e) {
			e.printStackTrace();
		} catch (UnrecoverableKeyException e) {
			e.printStackTrace();
		} finally {
    		
    		if(null != inputStream){
    			inputStream.close();
    		}
    		
    		httpClient.getConnectionManager().shutdown(); 
    	}
    	
    	return result;
    	
    }
 

執行......還是javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
想死的心都有了，繼續度娘...沒有啥進展...又過了一段時間，在stackoverflow(英語渣渣的我遇到問題，頓時感覺自己英語可以達到了8級！！)找到如下說明和命令

要把證書匯入到jdk的KeyStore中，如下命令(相信聰明的你看路徑和檔名知道怎麼修改相應的引數了吧):

keytool -importcert -alias myalias -file "C:\Users\zhangxiaoning\Desktop\testCa.cer" -keystore "D:\Java\jdk1.6.0_45\jre\lib\security\cacerts" -storepass changeit
 

另外，騷年們想看命令的說明可以參考一下blog,傳送門:
http://www.cnblogs.com/benio/archive/2010/09/15/1826990.html

繼續執行程式碼...javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated，我已掛了......
繼續百度、實驗、驗證，排除一系列可能性，發現...好像匯出的證書有問題...
我居然把介面的URL在瀏覽器輸入錯了，原先匯出的證書不是介面url的證書，是兩個不同的url！不同的域名！該死的供應商，給了我錯誤的URL，我也沒注意，怪我！
好吧重新匯出證書.順便記錄chrome怎麼匯出。如圖：

其他預設就行了。

執行程式...
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated


我也不知道怎麼表述我的心情了。
找資料，看到了一個blog說好像是jdk版本問題，把jdk1.6.0_45\jre\lib\security下的兩個jar包換成jdk1.6以上的jar包，換了後執行直接報了classnotfound
算了，先用jdk1.7的執行，呼叫成功 = =
但是公司的很多系統都是用jdk1.6的，用jdk1.7的話，可能會有問題，所以繼續找資料。

在無意中，百度到了一句，java ssl網路的debug log列印,在你要呼叫介面前加入以下一句：

System.setProperty("javax.net.debug", "ssl,handshake");

呼叫https介面前會列印一系列log,前面一堆的可以忽略，直接看最下面的，比如我的:

知道了問題，搜尋的範圍變小了很多了，直接百度:javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair

查看了很多資料，終於找到了原因，jdk1.6只支援1024位元組的DH，我發現我證書的公鑰是2048位元組的，所以報錯了，jdk1.7以上支援，所以成功。

可以檢視詳細的說明：

傳送門：https://stackoverflow.com/questions/6851461/java-why-does-ssl-handshake-give-could-not-generate-dh-keypair-exception

https://github.com/syncany/syncany/issues/483

所以解決方法是：

1.下載jar包：傳送門：http://download.csdn.net/detail/nk_tf/9609842   (先前在csdn上下載了一份，發現是壞的jar包，我的1分沒了，氣死我了~~)

2.複製這兩個jar包到: $JAVA_HOME/jre/lib/ext 

3.編輯$JAVA_HOME/jre/lib/security/java.security，在9下面加入這句:

security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider

security.provider.1=sun.security.provider.Sun
security.provider.2=sun.security.rsa.SunRsaSign
security.provider.3=com.sun.net.ssl.internal.ssl.Provider
security.provider.4=com.sun.crypto.provider.SunJCE
security.provider.5=sun.security.jgss.SunProvider
security.provider.6=com.sun.security.sasl.Provider
security.provider.7=org.jcp.xml.dsig.internal.dom.XMLDSigRI
security.provider.8=sun.security.smartcardio.SunPCSC
security.provider.9=sun.security.mscapi.SunMSCAPI
security.provider.10=org.bouncycastle.jce.provider.BouncyCastleProvider

重新呼叫，沒報錯，OK!!