不需要这么费劲吧，常用的库比如 okhttp 都支持设置自定义证书验证回调吧，在回调里处理下直接忽略证书过期然后改成直接验证服务器证书指纹就好了啊，也是安全的

import okhttp3.*;
import javax.net.ssl.*;
import java.security.cert.X509Certificate;

public class CustomVerifyOkHttp {

public static OkHttpClient buildClient() throws Exception {
TrustManager[] trustManagers = new TrustManager[]{
new X509TrustManager() {
@Override
public void checkClientTrusted(X509Certificate[] chain, String authType) {
// 不处理客户端
}

@Override
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
// 示例：只信任特定公钥指纹
X509Certificate cert = chain[0];
String sha256 = sha256(cert.getPublicKey().getEncoded());
if (!"your_expected_sha256_fingerprint".equalsIgnoreCase(sha256)) {
throw new CertificateException("Untrusted server certificate");
}
}

@Override
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
}
}
};

SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustManagers, new java.security.SecureRandom());

return new OkHttpClient.Builder()
.sslSocketFactory(sslContext.getSocketFactory(), (X509TrustManager) trustManagers[0])
.hostnameVerifier((hostname, session) -> true) // 可选：略过主机名验证
.build();
}

private static String sha256(byte[] data) throws Exception {
java.security.MessageDigest md = java.security.MessageDigest.getInstance("SHA-256");
byte[] digest = md.digest(data);
StringBuilder sb = new StringBuilder();
for (byte b : digest) sb.append(String.format("%02x", b));
return sb.toString();
}
}


基本就是这样，这样之后楼上说的什么中间人抓包也没可能了