Disabled TLS Validation (ARCH4119)

Key java.security.disabled-tls-validation · Severity error · Category security · CWE CWE-295

Using a TrustManager that accepts all certificates disables TLS authentication entirely and enables man-in-the-middle (MITM) attacks. Use the default validating trust store.

Incorrect

TrustManager[] trustAll = { new X509TrustManager() {
    public void checkServerTrusted(X509Certificate[] c, String a) {} // accept everything
    public void checkClientTrusted(X509Certificate[] c, String a) {}
    public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
}};
SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(null, trustAll, new SecureRandom());

Correct

SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(null, null, new SecureRandom()); // default trust store validates
HttpClient client = HttpClient.newBuilder().sslContext(ctx).build();

Fix

Remove the all-accepting custom TrustManager; use the default validating TLS stack.