spring-web RestTemplate不校验证书

1. 问题描述

现在要对接客户的一个管理系统，采用的是https协议，证书采用的是自生成的不受信任的证书

2. 背景

对接的目标系统已存在且使用很久了，客户不愿意调整

2.1 版本

1. org.springframework:spring-web:5.3.23
2. org.apache.httpcomponents:httpclient:4.5.13

3. 原因

4. 解决方法

4.1 不校验证书

使用spring-web封装的RestTemplate，并且不校验ssl证书，

import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContexts;
import org.apache.http.ssl.TrustStrategy;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.env.Environment;
import org.springframework.http.client.ClientHttpResponse;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.ResponseErrorHandler;
import org.springframework.web.client.RestTemplate;

import javax.annotation.Resource;
import javax.net.ssl.SSLContext;
import java.io.IOException;
import java.security.KeyManagementException;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;

@Configuration
public class BeansConfig {

	private final Logger logger = LoggerFactory.getLogger(BeansConfig.class);

	@Resource
	private Environment environment;

	@Bean
	public RestTemplate httpsRestTemplateNoSSL() throws NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
		HttpComponentsClientHttpRequestFactory factory = generateNoSSLHttpRequestFactory();
		factory.setReadTimeout(environment.getProperty("client.http.request.readTimeout", Integer.class, 15000));
		factory.setConnectTimeout(environment.getProperty("client.http.request.connectTimeout", Integer.class, 3000));
		RestTemplate restTemplate = new RestTemplate(factory);
		restTemplate.setErrorHandler(new ResponseErrorHandler() {
			@Override
			public boolean hasError(ClientHttpResponse response) throws IOException {
				return false;
			}
			@Override
			public void handleError(ClientHttpResponse response) throws IOException {
			}
		});
		return restTemplate;
	}

	public HttpComponentsClientHttpRequestFactory generateNoSSLHttpRequestFactory() throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException {
		// TrustStrategy.isTrusted(X509Certificate[] chain, String authType) 直接返回true，表示不校验证书
		TrustStrategy acceptingTrustStrategy = (x509Certificates, authType) -> true;
		SSLContext sslContext = SSLContexts.custom().loadTrustMaterial(null, acceptingTrustStrategy).build();
		SSLConnectionSocketFactory connectionSocketFactory = new SSLConnectionSocketFactory(sslContext, new NoopHostnameVerifier());

		HttpClientBuilder httpClientBuilder = HttpClients.custom();
		httpClientBuilder.setSSLSocketFactory(connectionSocketFactory);
		CloseableHttpClient httpClient = httpClientBuilder.build();
		HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory();
		factory.setHttpClient(httpClient);
		return factory;
	}
}

5. 小结

笔记记录

6. 参考资料