Trust all certificates with CXF

In development environments it is handy if CXF soap calls over HTTPS don't complain about invalid certificates. In https.get java code this is done with

TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
   @Override
   public X509Certificate[] getAcceptedIssuers() {
      return null;
   }

   @Override
   public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}

   @Override
   public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
} };

SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());

And for the hostname checking

HostnameVerifier hostnameVerifier = new HostnameVerifier() {
   @Override
   public boolean verify(String hostname, SSLSession session) {
      return true;
   }
};
HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);

After this any certificate for any host is accepted

URL url = new URL("https://localhost");
URLConnection connection = url.openConnection();
InputStream inputStream = connection.getInputStream();
InputStreamReader reader = new InputStreamReader(inputStream);
while (true) {
   int ch = reader.read();
   if (ch == -1) break;
   System.out.print((char)ch);
}

But CXF by default overrides this and so it should be informed to use the defaults.

Client client = ClientProxy.getClient(port);
HTTPConduit conduit = (HTTPConduit)client.getConduit();
TLSClientParameters tlsParams = new TLSClientParameters();
tlsParams.setUseHttpsURLConnectionDefaultSslSocketFactory(true);
tlsParams.setUseHttpsURLConnectionDefaultHostnameVerifier(true);
conduit.setTlsClientParameters(tlsParams);

Note: Don't do this in production. With this code, Man-In-The-Middle attacks are easy to do and so the connection can't be trusted anymore!!!