问题记录：app第首次安装报SSLHandshakeException，刷新后可以请求到数据

首次安装app是，retrofit会报出 javax.net.ssl.SSLHandshakeException: java.security.cert.CertPathValidatorException: Trust anchor for certification path not found.导致数据请求不到。

会报这个错误可能的原因有三个：

1. 颁发服务器证书的 CA 未知
2. 服务器证书不是由 CA 签署的，而是自签署
3. 服务器配置缺少中间 CA

假如是第三种原因是一直无法请求道数据的。而前两种可以使用同一种方式解决，就是在本地直接信任服务器证书。

[code] private KeyStore getKeyStore() {
KeyStore keyStore = null;
try {
CertificateFactory cf = CertificateFactory.getInstance("X.509");

InputStream caInput = Application.getContext().getResources().openRawResource(R.raw.trust_chain);
Certificate ca;
try {
ca = cf.generateCertificate(caInput);
Log.d("SslUtils", "ca=" + ((X509Certificate) ca).getSubjectDN());
} finally {
caInput.close();
}

String keyStoreType = KeyStore.getDefaultType();
keyStore = KeyStore.getInstance(keyStoreType);
keyStore.load(null, null);
keyStore.setCertificateEntry("ca", ca);
} catch (Exception e) {
Log.e("SslUtils", "Error during getting keystore", e);
}
return keyStore;
}

[code]public static SSLContext getSslContextForCertificateFile() {
try {
KeyStore keyStore = getKeyStore();
SSLContext sslContext = SSLContext.getInstance("SSL");
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init(keyStore);
sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());
return sslContext;
} catch (Exception e) {
String msg = "Error during creating SslContext for certificate from assets";
Log.e("SslUtils", msg, e);
throw new RuntimeException(msg);
}
}

[code] SSLContext sslContext = getSslContextForCertificateFile();

TrustManagerFactory trustManagerFactory = null;
try {
trustManagerFactory = TrustManagerFactory.getInstance(
TrustManagerFactory.getDefaultAlgorithm());
trustManagerFactory.init((KeyStore) null);
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (KeyStoreException e) {
e.printStackTrace();
}

TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
throw new IllegalStateException("Unexpected default trust managers:"
+ Arrays.toString(trustManagers));
}
X509TrustManager trustManager = (X509TrustManager) trustManagers[0];

okHttpClient = new OkHttpClient().newBuilder()
.addInterceptor(httpLoggingInterceptor)
.addInterceptor(receiveCookieInterceptor)
.addInterceptor(addCookieInterceptor)
.sslSocketFactory(sslContext.getSocketFactory(), trustManager)
.connectTimeout(Constants.TIME_OUT, TimeUnit.MILLISECONDS)
.readTimeout(Constants.TIME_OUT, TimeUnit.MILLISECONDS)
.writeTimeout(Constants.TIME_OUT, TimeUnit.MILLISECONDS)
.build();

参考资料：https://developer.android.google.cn/training/articles/security-ssl#SelfSigned