一些知识点

1.服务端生成证书文件，其实只需要利用keyTool工具生成jks后，再利用KeyTool工具根据这个jks去签发出来一个证书就可以了。具体步骤为

1. 通过keytool命令生成 jks 秘钥文件
keytool -genkey -alias zhy_server
 -keyalg RSA -keystore zhy_server.jks
 -validity 3600 -storepass 123456

2. 通过keytool命令对 jks 进行签发证书
keytool -export -alias zhy_server 
 -file zhy_server.cer  
 -keystore zhy_server.jks  
 -storepass 123456 

2.在加载证书的代码中，Java平台默认识别jks格式的证书文件，但是android平台只识别bks格式的证书文件。所以你需要将'jks'转换成bks文件，放入项目中。

3.加载证书有两种实现方式(访问自签名的网站，单向验证)：

1.你可以通过将证书文件.cer放入到项目可读取的位置，如'assest'文件夹。

private static SSLSocketFactory getSSLSocketFactory_Certificate(Context context, String keyStoreType, int keystoreResId)
            throws CertificateException, KeyStoreException, IOException, NoSuchAlgorithmException, KeyManagementException {

        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        InputStream caInput = context.getResources().openRawResource(keystoreResId);

        Certificate ca = cf.generateCertificate(caInput);

        caInput.close();

        if (keyStoreType == null || keyStoreType.length() == 0) {

            keyStoreType = KeyStore.getDefaultType();

        }

        KeyStore keyStore = KeyStore.getInstance(keyStoreType);

        keyStore.load(null, null);

        keyStore.setCertificateEntry("ca", ca);

        String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);

        tmf.init(keyStore);

        TrustManager[] wrappedTrustManagers = getWrappedTrustManagers(tmf.getTrustManagers());

        SSLContext sslContext = SSLContext.getInstance("TLS");

        sslContext.init(null, wrappedTrustManagers, null);

        return sslContext.getSocketFactory();

    }

2.你可以通过keytool命令，将.cer文件以.rfc格式输出(其实也就是文本格式)，然后加载这段文本就行。

keytool -printcert -rfc -file srca.cer

4.Android中 自带的SSLContext的TrustManager无法进行工作，具体原因目前不清楚，可能是自带的TrustManager的内部实现不符合场景需求。

TrustManager的主要责任是去决定提出的认证证书应该是可信任的。如果证书是不可信任的，那么连接将会被终止

完整加载证书代码：

 private static TrustManager[] getWrappedTrustManagers(TrustManager[] trustManagers) {

        final X509TrustManager originalTrustManager = (X509TrustManager) trustManagers[0];

        return new TrustManager[]{

                new X509TrustManager() {

                    public X509Certificate[] getAcceptedIssuers() {

                        return originalTrustManager.getAcceptedIssuers();

                    }

                    public void checkClientTrusted(X509Certificate[] certs, String authType) {

                        try {

                            originalTrustManager.checkClientTrusted(certs, authType);

                        } catch (CertificateException e) {

                            e.printStackTrace();

                        }

                    }

                    public void checkServerTrusted(X509Certificate[] certs, String authType) {

                        try {

                            originalTrustManager.checkServerTrusted(certs, authType);

                        } catch (CertificateException e) {

                            e.printStackTrace();

                        }

                    }

                }

        };

    }
    /**
     *
     * @param context
     * @param keyStoreType   Keystore类型，一般都是jks 或者 bks，but，Android平台只识别bks，所以如果你要做这种
     *                       加密通信的话，你需要将你的秘钥转成bks格式
     * @param keystoreResId
     * @return
     * @throws CertificateException
     * @throws KeyStoreException
     * @throws IOException
     * @throws NoSuchAlgorithmException
     * @throws KeyManagementException
     */
    private static SSLSocketFactory getSSLSocketFactory_Certificate(Context context, String keyStoreType, int keystoreResId)
            throws CertificateException, KeyStoreException, IOException, NoSuchAlgorithmException, KeyManagementException {

        CertificateFactory cf = CertificateFactory.getInstance("X.509");

        InputStream caInput = context.getResources().openRawResource(keystoreResId);

        Certificate ca = cf.generateCertificate(caInput);

        caInput.close();

        if (keyStoreType == null || keyStoreType.length() == 0) {

            keyStoreType = KeyStore.getDefaultType();

        }

        KeyStore keyStore = KeyStore.getInstance(keyStoreType);

        keyStore.load(null, null);

        keyStore.setCertificateEntry("ca", ca);

        String tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(tmfAlgorithm);

        tmf.init(keyStore);

        TrustManager[] wrappedTrustManagers = getWrappedTrustManagers(tmf.getTrustManagers());

        SSLContext sslContext = SSLContext.getInstance("TLS");

        sslContext.init(null, wrappedTrustManagers, null);

        return sslContext.getSocketFactory();

    }

5. 默认信任所有证书

上面的代码都是在有证书的条件下，而如果没有证书呢？如果跳过这个环节还保证不出错？那么只能信任所有的证书

 client.sslSocketFactory(createSSLSocketFactory());
        client.hostnameVerifier(new TrustAllHostnameVerifier());
        
        
        
          private static class TrustAllManager implements X509TrustManager {
        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
        }

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType)

                throws CertificateException {
        }

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
    }

    private static class TrustAllHostnameVerifier implements HostnameVerifier {
        @Override
        public boolean verify(String hostname, SSLSession session) {
            return true;
        }
    }