使用 mitmproxy 代理 JAVA 應用 HTTPS 請求

背景問題

設置 -Dhttps.proxyHost=localhost -Dhttps.proxyPort=8080 使 JAVA 應用全部 HTTPS 請求通過 mitmproxy 代理髮出. 結果獲得下面的錯誤:

Server access Error: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested ...

環境

Mac OSX 10.10.2
java version "1.7.0_55"
Java(TM) SE Runtime Environment (build 1.7.0_55-b13)
Java HotSpot(TM) 64-Bit Server VM (build 24.55-b03, mixed mode)

解決方案

將 mitmproxy 的證書導入到 JDK 默認的 keystore 中:

sudo keytool -importcert -alias mitmproxy  \
-keystore <keystore_path> \
-storepass <password> \
-trustcacerts \
-file ~/.mitmproxy/mitmproxy-ca-cert.pem

password 默認是 changeit

查明 keystore 路徑

scala -e 'import java.net._; new URL("https://www.wacai.com").openConnection.asInstanceOf[HttpURLConnection].disconnect' -Djavax.net.debug=SSL | grep "trustStore is"