在Android开发中，有时我们需要与HTTPS服务器进行通信。为了确保通信的安全性，服务器端通常会使用SSL/TLS协议进行加密。而客户端需要导入服务器端的证书以验证服务器的身份，以确保连接的安全性。下面我将详细介绍如何在Android中导入crt证书。
1. 首先，获取服务器端的crt证书。你可以通过浏览器访问服务器，然后导出证书。通常情况下，浏览器会将证书以.crt或.pem的格式导出。
2. 将证书拷贝到Android项目的res/raw目录下。如果该目录不存在，可以手动创建。
3. 在Android项目的build.gradle文件中添加以下代码，以确保证书文件会被打包到apk中：
```groovy
android {
// ...
sourceSets {
main {
assets.srcDirs += ['src/main/res/raw']
}
}
}
```
4. 在项目中创建一个TrustManager类，用于验证服务器证书的合法性。示例代码如下：
```java
import android.content.Context;
import java.io.InputStream;
import java.security.KeyStore;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
public class CustomTrustManager implements X509TrustManager {
private X509TrustManager defaultTrustManager;
private X509TrustManager localTrustManager;
public CustomTrustManager(Context context) {
try {
InputStream inputStream = context.getResources().openRawResource(R.raw.server_certificate);
CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
X509Certificate certificate = (X509Certificate) certificateFactory.generateCertificate(inputStream);
inputStream.close();
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
keyStore.load(null, null);
keyStore.setCertificateEntry("server_certificate", certificate);
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init(keyStore);
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
if (trustManagers.length == 0) {
throw new RuntimeException("Unable to initialize trust manager");
}
defaultTrustManager = (X509TrustManager) trustManagers[0];
localTrustManager = new LocalTrustManager();
} catch (Exception e) {
e.printStackTrace();
}
}
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) {
try {
defaultTrustManager.checkClientTrusted(chain, authType);
} catch (Exception e) {
localTrustManager.checkClientTrusted(chain, authType);
}
}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) {
try {
defaultTrustManager.checkServerTrusted(chain, authType);
} catch (Exception e) {
localTrustManager.checkServerTrusted(chain, authType);
}
}
@Override
public X509Certificate[] getAcceptedIssuers() {
return defaultTrustManager.getAcceptedIssuers();
}
private static class LocalTrustManager implements X509TrustManager {
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) {
throw new UnsupportedOperationException();
}
@Override
public void checkServerTrusted(X509Certificate[] chain, String authType) {
// TODO: 在这里添加对自签名证书的验证逻辑
}
@Override
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
}
}
}
```
5. 在需要使用HTTPS的网络请求中，创建一个OkHttpClient对象，并设置TrustManager。示例代码如下：
```java
OkHttpClient.Builder builder = new OkHttpClient.Builder();
try {
CustomTrustManager trustManager = new CustomTrustManager(context);
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, new TrustManager[]{trustManager}, null);
SSLSocketFactory sslSocketFactory = sslContext.getSocketFactory();
builder.sslSocketFactory(sslSocketFactory, trustManager);
} catch (Exception e) {
e.printStackTrace();
}
OkHttpClient client = builder.build();
```
至此，我们已经成功在Android中导入了crt证书，并完成了合法性验证。现在你可以使用这个OkHttpClient对象来发送HTTPS请求，保证通信的安全性。
需要注意的是，在以上示例代码中，为了方便起见，我将证书文件命名为server_certificate.crt，并放在了res/raw目录下。你可以根据实际情况修改代码。
导入证书是确保与HTTPS服务器通信安全的重要步骤，希望上述介绍对你有所帮助。
