首先,需要知道是什么是https

百度一波:
HTTPS（全称：Hyper Text Transfer Protocol over Secure Socket Layer 或 Hypertext Transfer Protocol Secure，超文本传输安全协议），是以安全为目标的HTTP通道，简单讲是HTTP的安全版。即HTTP下加入SSL层，HTTPS的安全基础是SSL，因此加密的详细内容就需要SSL。 它是一个URI scheme（抽象标识符体系），句法类同http:体系。用于安全的HTTP数据传输。https:URL表明它使用了HTTP，但HTTPS存在不同于HTTP的默认端口及一个加密/身份验证层（在HTTP与TCP之间）。这个系统的最初研发由网景公司(Netscape)进行，并内置于其浏览器Netscape Navigator中，提供了身份验证与加密通讯方法。现在它被广泛用于万维网上安全敏感的通讯，例如交易支付方面。
上面说得也很详细,也需要注意的一点是:HTTPS存在不同于HTTP的默认[端口],这个端口号是不一样的,它是443

然后再知道什么是Retrofit

百度一波:
Retrofit是Square公司开源的一个高质量高效率的HTTP库，github上面star数量最多的Android网络库就是这个。底层封装了okhttp，JakeWharton大神的经典作品之一。

怎么用

约等于百度哈~详细就不说了
在这里我们只说怎么配置证书

首先

问你们的后端人员要一个证书

然后

把证书扔进你的asset目录

紧接着

获取你目录下的证书

 private static KeyStore getKeyStore(String fileName) {
        KeyStore keyStore = null;
        try {
            AssetManager assetManager = MyApp.getAppContext().getAssets();
            CertificateFactory cf = CertificateFactory.getInstance("X.509");
            InputStream caInput = assetManager.open(fileName);
            Certificate ca;
            try {
                ca = cf.generateCertificate(caInput);
                Log.e("SslUtils", "ca=" + ((X509Certificate) ca).getSubjectDN());
            } finally {
                caInput.close();
            }


            keyStore = KeyStore.getInstance("BKS");
            keyStore.load(null, null);
            keyStore.setCertificateEntry("ca", ca);
        } catch (Exception e) {
            Log.e("SslUtils", "Error during getting keystore", e);
        }
        return keyStore;
    }

再然后

 public static SSLContext getSslContextForCertificateFile(String fileName) {
        try {
            KeyStore keyStore = getKeyStore(fileName);
            SSLContext sslContext = SSLContext.getInstance("SSL");
            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init(keyStore);
            sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());
            return sslContext;
        } catch (Exception e) {
            String msg = "Error during creating SslContext for certificate from assets";
            Log.e("SslUtils", msg, e);
            throw new RuntimeException(msg);
        }
    }

最后

   final SSLContext sslContext;
            try {

                sslContext = AppUtil.getSslContextForCertificateFile("xxx.bks");
                TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(
                        TrustManagerFactory.getDefaultAlgorithm());
                trustManagerFactory.init((KeyStore) null);
                TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
                if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
                    throw new IllegalStateException("Unexpected default trust managers:"
                            + Arrays.toString(trustManagers));
                }
                X509TrustManager trustManager = (X509TrustManager) trustManagers[0];
                mOkHttpClient = new OkHttpClient.Builder()
                        .cache(cache)
                        .hostnameVerifier((hostname, session) -> true)//校验IP
                        .sslSocketFactory(sslContext.getSocketFactory(), trustManager)
  .connectTimeout(20, TimeUnit.SECONDS)

                        .writeTimeout(20, TimeUnit.SECONDS)
                        .readTimeout(20, TimeUnit.SECONDS)
                        .cookieJar(cookieJar)//cookie持久化
                        .build();
            } catch (Exception pE) {
                pE.printStackTrace();
            }
        }

• 当然这是其中一种方式,还有别的方式,其实不太建议:

public class SSLSocketFactoryUtils {
    /*
     * 默认信任所有的证书
     * todo 最好加上证书认证，主流App都有自己的证书
     * */
    public static SSLSocketFactory createSSLSocketFactory() {
        SSLSocketFactory sslSocketFactory = null;
        try {
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, new TrustManager[]{createTrustAllManager()}, new SecureRandom());
            sslSocketFactory = sslContext.getSocketFactory();
        } catch (Exception e) {

        }
        return sslSocketFactory;
    }


    public static X509TrustManager createTrustAllManager() {
        X509TrustManager tm = null;
        try {
            tm = new X509TrustManager() {
                public void checkClientTrusted(X509Certificate[] chain, String authType)
                        throws CertificateException {
                    //do nothing，接受任意客户端证书
                }

                public void checkServerTrusted(X509Certificate[] chain, String authType)
                        throws CertificateException {
                    //do nothing，接受任意服务端证书
                }

                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }
            };
        } catch (Exception e) {

        }
        return tm;
    }

    public static class TrustAllHostnameVerifier implements HostnameVerifier {

        @Override
        public boolean verify(String hostname, SSLSession session) {
            return true;
        }
    }
}

然后

   mOkHttpClient = new OkHttpClient.Builder()
                        .cache(cache)
                        .hostnameVerifier((hostname, session) -> true)//校验IP
                        .sslSocketFactory(SSLSocketFactoryUtils.createSSLSocketFactory(), SSLSocketFactoryUtils.createTrustAllManager())
//                    .addNetworkInterceptor(reWriteCacheControlInterceptor)
                        .addInterceptor(reWriteCacheControlInterceptor)
                        .connectTimeout(20, TimeUnit.SECONDS)

                        .writeTimeout(20, TimeUnit.SECONDS)
                        .readTimeout(20, TimeUnit.SECONDS)
                        .cookieJar(cookieJar)//cookie持久化
                        .build();

这种方式挺不安全的