Method enableAnonymousSSL

src/main/java/com/trsst/Common.java:790–832

Most trsst nodes run with self-signed certificates, so by default we accept them. While posts are still signed and/or encrypted, a MITM can still refuse our out-going posts and suppress incoming new ones, but this the reason to relay with many trsst servers. Use the -strict option to require CA-sign

()

     * guarantee either.
     */
    public static void enableAnonymousSSL() {
        TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                return null;
            }

            public void checkClientTrusted(X509Certificate[] certs,
                    String authType) {
            }

            public void checkServerTrusted(X509Certificate[] certs,
                    String authType) {
            }

        } };

        SSLContext sc;
        try {
            sc = SSLContext.getInstance("SSL");
            sc.init(null, trustAllCerts, new java.security.SecureRandom());
            HttpsURLConnection
                    .setDefaultSSLSocketFactory(sc.getSocketFactory());
        } catch (NoSuchAlgorithmException e) {
            log.error("Can't get SSL context", e);
        } catch (KeyManagementException e) {
            log.error("Can't set SSL socket factory", e);
        }

        // Create all-trusting host name verifier
        HostnameVerifier allHostsValid = new HostnameVerifier() {
            public boolean verify(String hostname, SSLSession session) {
                return true;
            }
        };

        // Install the all-trusting host verifier
        HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);

        // For apache http client
        Protocol anonhttps = new Protocol("https",
                (ProtocolSocketFactory) new AnonymSSLSocketFactory(), 443); //
        Protocol.registerProtocol("https", anonhttps);
    }
}