了解Apache HttpClient（Java）中的SSL

Question

这里有一个自定义SSL的示例：https ://hc.apache.org/httpcomponents-client-ga/httpclient/examples/org/apache/http/examples/client/ClientCustomSSL.java/** * This example demonstrates how to create secure connections with a custom SSL * context. */public class ClientCustomSSL {public final static void main(String[] args) throws Exception {    // Trust own CA and all self-signed certs    SSLContext sslcontext = SSLContexts.custom()            .loadTrustMaterial(new File("my.keystore"), "nopassword".toCharArray(),                    new TrustSelfSignedStrategy())            .build();    // Allow TLSv1 protocol only    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(            sslcontext,            new String[] { "TLSv1" },            null,            SSLConnectionSocketFactory.getDefaultHostnameVerifier());    CloseableHttpClient httpclient = HttpClients.custom()            .setSSLSocketFactory(sslsf)            .build();    try {        HttpGet httpget = new HttpGet("https://httpbin.org/");        System.out.println("Executing request " + httpget.getRequestLine());        CloseableHttpResponse response = httpclient.execute(httpget);        try {            HttpEntity entity = response.getEntity();            System.out.println("----------------------------------------");            System.out.println(response.getStatusLine());            EntityUtils.consume(entity);        } finally {            response.close();        }    } finally {        httpclient.close();    }}}为什么我们需要那个？我已经测试了没有任何SSL内容的HttpClient请求，并且从HTTPS URL得到了正确的响应，没有错误。如果我不添加任何SSLContext，会有什么问题？如果重要的是使其更加安全，这条线是什么？：.loadTrustMaterial(new File("my.keystore"), "nopassword".toCharArray(),似乎我们需要一些文件和一些密码？