Apache HttpClient 5.1 bypass SSL Verification - apache-httpclient-4.x

Question

I have configured CloseableHttpAsyncClient as mentioned below
public CloseableHttpAsyncClient closeableHttpAsyncClient(){
HttpAsyncClientBuilder clientBuilder = HttpAsyncClients.custom();
final PoolingAsyncClientConnectionManager connManager = new PoolingAsyncClientConnectionManager();
connManager.setMaxTotal(10);
clientBuilder.setConnectionManager(connManager);
clientBuilder.setRedirectStrategy(DefaultRedirectStrategy.INSTANCE);
CloseableHttpAsyncClient closeableHttpAsyncClient = clientBuilder.build();
return closeableHttpAsyncClient;
}
I want to bypass SSL verification. I have tried to check different configurations but didn't find the solution for the same.

Answer 1

One can set up a custom TLS context and use it with the default TLS strategy as described here:
https://github.com/apache/httpcomponents-client/blob/5.1.x/httpclient5/src/test/java/org/apache/hc/client5/http/examples/AsyncClientCustomSSL.java
In this particular example the connection manager has been configured to trust all certificates with the CN equal to httpbin.org in addition to standard CAs. One can choose a different stratefgy or trust all certificates indiscriminately, though the latter is STONGLY discouraged.
final SSLContext sslcontext = SSLContexts.custom()
.loadTrustMaterial(new TrustStrategy() {
#Override
public boolean isTrusted(
final X509Certificate[] chain,
final String authType) throws CertificateException {
// Trust all certs with CN equal `httpbin.org`
final X509Certificate cert = chain[0];
return "CN=httpbin.org".equalsIgnoreCase(cert.getSubjectDN().getName());
}
})
.build();
final TlsStrategy tlsStrategy = ClientTlsStrategyBuilder.create()
.setSslContext(sslcontext)
.build();
final PoolingAsyncClientConnectionManager cm = PoolingAsyncClientConnectionManagerBuilder.create()
.setTlsStrategy(tlsStrategy)
.build();