java - Skip only hostname verification with Apache HttpClient -
i need skip hostname verification httpclient 4.2.1 without changing trustmanager. archived this:
httpclient = new defaulthttpclient(a, b); sslsocketfactory socketfactory = (sslsocketfactory) httpclient.getconnectionmanager().getschemeregistry().get("https").getschemesocketfactory(); socketfactory.sethostnameverifier(sslsocketfactory.allow_all_hostname_verifier);
... sethostnameverifier method used deprecated. how can achieve same thing using not deprecated methods?
as previous people have said should when have reason so. have closed testing environments , disable hostname verification when absolutely needed. place disabled in application running tests never in application deployed user facing servers.
this can accomplished implementing own hostnameverifier.
sslcontext sslcontext = sslcontext.getdefault(); hostnameverifier allowall = new hostnameverifier() { @override public boolean verify(string hostname, sslsession session) { return true; } }; registry<connectionsocketfactory> socketfactoryregistry = registrybuilder.<connectionsocketfactory>create() .register("https", new sslconnectionsocketfactory(sslcontext, allowall)) .build(); poolinghttpclientconnectionmanager cm = new poolinghttpclientconnectionmanager(socketfactoryregistry);