首先根据如下操作生成证书，配置springboot https，生成一个简单的https web服务

https://www.cnblogs.com/qq931399960/p/11889349.html

验证客户端pom依赖

  1. </dependency>
  2.             <dependency>
  3.                 <groupId>org.springframework.boot</groupId>
  4.                 <artifactId>spring-boot-starter-web</artifactId>
  5.             </dependency>
  6.             <dependency>
  7.                 <groupId>org.apache.httpcomponents</groupId>
  8.                 <artifactId>httpclient</artifactId>
  9.                 <version>4.5.10</version>
  10.             </dependency>
  11.             <dependency>
  12.                 <groupId>org.apache.httpcomponents</groupId>
  13.                 <artifactId>httpcore</artifactId>
  14.                 <version>4.4.12</version>
  15.             </dependency>

httpclient和httpcore版本要对应，否则可能会出现异常

验证方式包括跳过证书验证，也即是添加信任，就像浏览器访问自签名https服务时，页面会给出提示“您的链接不是私密连接”，点击了高级，继续前往即是对该服务添加了信任，可以继续访问该网站服务，另外一种方式就是通过服务器证书来验证，下面就直接上代码

跳过证书验证方式

  1. package com.demo.bootdemo;
  2.  
  3. import java.security.cert.CertificateException;
  4. import java.security.cert.X509Certificate;
  5.  
  6. import javax.net.ssl.HostnameVerifier;
  7. import javax.net.ssl.HttpsURLConnection;
  8. import javax.net.ssl.SSLContext;
  9. import javax.net.ssl.SSLSession;
  10. import javax.net.ssl.TrustManager;
  11. import javax.net.ssl.X509TrustManager;
  12.  
  13. import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
  14. import org.apache.http.impl.client.HttpClients;
  15. import org.slf4j.Logger;
  16. import org.slf4j.LoggerFactory;
  17. import org.springframework.context.annotation.Bean;
  18. import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
  19. import org.springframework.stereotype.Component;
  20. import org.springframework.web.client.RestTemplate;
  21.  
  22. @Component
  23. public class SkipVerifyRestTemplateBuilder {
  24.  
  25. 	private Logger logger = LoggerFactory.getLogger(SkipVerifyRestTemplateBuilder.class);
  26.  
  27. 	// 初始化ssl resttemplate
  28. 	@Bean("skipVerifyRestTemplate")
  29. 	public RestTemplate skipVerifyRestTemplate() {
  30. 		RestTemplate rest = new RestTemplate();
  31.  
  32. 		SSLConnectionSocketFactory buildSSLSocketFactory = null;
  33. 		try {
  34. 			buildSSLSocketFactory = this.buildSSLSocketFactory();
  35. 		} catch (Exception e) {
  36. 			logger.error("", e);
  37. 		}
  38.  
  39. 		HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(
  40. 				HttpClients.custom().setSSLSocketFactory(buildSSLSocketFactory).build());
  41.  
  42. 		factory.setConnectionRequestTimeout(1000);
  43. 		factory.setConnectTimeout(1000);
  44. 		
  45. 		rest.setRequestFactory(factory);
  46. 		return rest;
  47. 	}
  48.  
  49. 	private SSLConnectionSocketFactory buildSSLSocketFactory() throws Exception {
  50. 		SSLContext sslContext = SSLContext.getInstance("SSL");
  51. 		// 设置信任证书（绕过TrustStore验证）
  52. 		sslContext.init(null, new TrustManager[] { new AuthX509TrustManager() }, null);
  53. 		HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());
  54.  
  55. 		SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext,
  56. 				new String[] { "TLSv1" }, null, new HostnameVerifier() {
  57. 					// hostname,默认返回true,不验证hostname
  58. 					@Override
  59. 					public boolean verify(String urlHostName, SSLSession session) {
  60. 						return true;
  61. 					}
  62. 				});
  63. 		return sslConnectionSocketFactory;
  64. 	}
  65.  
  66. 	private class AuthX509TrustManager implements TrustManager, X509TrustManager {
  67. 		public X509Certificate[] getAcceptedIssuers() {
  68. 			return null;
  69. 		}
  70.  
  71. 		public void checkServerTrusted(X509Certificate[] certs, String authType)
  72. 				throws java.security.cert.CertificateException {
  73. 			return;
  74. 		}
  75.  
  76. 		public void checkClientTrusted(X509Certificate[] certs, String authType) throws CertificateException {
  77. 			return;
  78. 		}
  79. 	}
  80. }

第二种跳过证书验证方式

  1. package com.demo.bootdemo;
  3. import java.io.IOException;
  4. import java.security.KeyStore;
  5. import java.security.cert.CertificateException;
  6. import java.security.cert.X509Certificate;
  7. import java.util.ArrayList;
  8. import java.util.List;
  10. import javax.net.ssl.HostnameVerifier;
  11. import javax.net.ssl.HttpsURLConnection;
  12. import javax.net.ssl.SSLContext;
  13. import javax.net.ssl.SSLSession;
  15. import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
  16. import org.apache.http.conn.ssl.TrustStrategy;
  17. import org.apache.http.impl.client.HttpClients;
  18. import org.apache.http.ssl.SSLContexts;
  19. import org.springframework.context.annotation.Bean;
  20. import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
  21. import org.springframework.stereotype.Component;
  22. import org.springframework.web.client.RestTemplate;
  24. @Component
  25. public class SecondSkipVerifyRestTemplateBuilder {
  27.     @Bean("secondSkipRestTemplate")
  28.     public RestTemplate verifyCaRestTemplate() {
  29.         RestTemplate rest = new RestTemplate();
  30.         SSLConnectionSocketFactory ssLSocketFactory = null;
  31.         try {
  32.             ssLSocketFactory = sslFactory("PKCS12", "abc123");
  33.         } catch (Exception e) {
  34.             // TODO Auto-generated catch block
  35.             e.printStackTrace();
  36.         }
  38.         HttpComponentsClientHttpRequestFactory httpRequestFactory = new HttpComponentsClientHttpRequestFactory(
  39.                 HttpClients.custom().setSSLSocketFactory(ssLSocketFactory).build());
  40.         // 设置传递数据超时时长
  41.         httpRequestFactory.setReadTimeout(1000);
  43.         rest.setRequestFactory(httpRequestFactory);
  45.         // 如果返回的数据非json则可能需要添加对应httpmessageconverter
  46.         // Jaxb2RootElementHttpMessageConverter converter = new
  47.         // Jaxb2RootElementHttpMessageConverter();
  48.         //
  49.         // List<MediaType> mediaTypeList = new ArrayList<>();
  50.         // mediaTypeList.addAll(converter.getSupportedMediaTypes());
  51.         // mediaTypeList.add(MediaType.TEXT_HTML);
  52.         // converter.setSupportedMediaTypes(mediaTypeList);
  53.         //
  54.         // List<HttpMessageConverter<?>> list = new ArrayList<>();
  55.         // list.add(converter);
  56.         // rest.setMessageConverters(list);
  57.  
  58.         return rest;
  60.     }
  62.     public SSLConnectionSocketFactory sslFactory(String keyStoreType, String keyPassword) {
  63.         SSLConnectionSocketFactory sslConnectionSocketFactory = null;
  64.         try {
  65.             SSLContext sslcontext = SSLContexts.custom()
  66.                     // //忽略掉对服务器端证书的校验
  67.                     .loadTrustMaterial(new TrustStrategy() {
  68.                         @Override
  69.                         public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {
  70.                             return true;
  71.                         }
  72.                     }).build();
  73.             sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslcontext, new String[] { "TLSv1" }, null,
  74.                     SSLConnectionSocketFactory.getDefaultHostnameVerifier());
  75.         } catch (Exception e) {
  76.             e.printStackTrace();
  77.         }
  78.         return sslConnectionSocketFactory;
  79.     }
  81. }

根据证书验证

  1. package com.demo.bootdemo;
  3. import java.io.IOException;
  4. import java.security.KeyStore;
  5. import java.util.ArrayList;
  6. import java.util.List;
  8. import javax.net.ssl.HostnameVerifier;
  9. import javax.net.ssl.SSLContext;
  10. import javax.net.ssl.SSLSession;
  12. import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
  13. import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
  14. import org.apache.http.impl.client.HttpClients;
  15. import org.apache.http.ssl.SSLContexts;
  16. import org.slf4j.Logger;
  17. import org.slf4j.LoggerFactory;
  18. import org.springframework.beans.factory.annotation.Value;
  19. import org.springframework.context.annotation.Bean;
  20. import org.springframework.core.io.Resource;
  21. import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
  22. import org.springframework.stereotype.Component;
  23. import org.springframework.web.client.RestTemplate;
  25. @Component
  26. public class VerifyCaRestTemplateBuilder {
  28.     private Logger logger = LoggerFactory.getLogger(VerifyCaRestTemplateBuilder.class);
  30.     @Value("classpath:cert.p12")
  31.     private Resource certFile;
  33.     @Bean("verifyCaRestTemplate")
  34.     public RestTemplate verifyCaRestTemplate() {
  35.         RestTemplate rest = new RestTemplate();
  37.         SSLConnectionSocketFactory ssLSocketFactory = null;
  38.         try {
  39.             ssLSocketFactory = sslFactory("PKCS12", "abc123");
  40.         } catch (Exception e) {
  41.             logger.error("", e);
  42.         }
  44.         HttpComponentsClientHttpRequestFactory httpRequestFactory = new HttpComponentsClientHttpRequestFactory(
  45.                 HttpClients.custom().setSSLSocketFactory(ssLSocketFactory).build());
  46.         // 设置传递数据超时时长
  47.         httpRequestFactory.setReadTimeout(1000);
  49.         rest.setRequestFactory(httpRequestFactory);
  51.         // 如果返回的数据非json则可能需要添加对应httpmessageconverter
  52.         // Jaxb2RootElementHttpMessageConverter converter = new
  53.         // Jaxb2RootElementHttpMessageConverter();
  54.         //
  55.         // List<MediaType> mediaTypeList = new ArrayList<>();
  56.         // mediaTypeList.addAll(converter.getSupportedMediaTypes());
  57.         // mediaTypeList.add(MediaType.TEXT_HTML);
  58.         // converter.setSupportedMediaTypes(mediaTypeList);
  59.         //
  60.         // List<HttpMessageConverter<?>> list = new ArrayList<>();
  61.         // list.add(converter);
  62.         // rest.setMessageConverters(list);
  63.  
  64.         return rest;
  66.     }
  68.     public SSLConnectionSocketFactory sslFactory(String keyStoreType, String keyPassword) {
  69.         SSLConnectionSocketFactory sslConnectionSocketFactory = null;
  70.         try {
  71.             KeyStore keyStore = null;
  72.             try {
  73.                 keyStore = KeyStore.getInstance(keyStoreType);
  74.                 keyStore.load(certFile.getInputStream(), keyPassword.toCharArray());
  75.             } catch (IOException e) {
  76.                 logger.error("", e);
  77.             }
  79.             HostnameVerifier hv = new HostnameVerifier() {
  80.                 @Override
  81.                 public boolean verify(String urlHostName, SSLSession session) {
  82.                     // 如果需要验证https域名，可以在该处做判断,如果访问的hostname与判断不一致，则会出现如下异常
  83.                     // if("localhost".equals(urlHostName)) {
  84.                     // return true;
  85.                     // }else {
  86.                     // return false;
  87.                     // }
  88.                     // 此处不校验hostname，接收所有hostname，只是用于测试。
  89.                     return true;
  90.                 }
  91.             };
  93.             SSLContext sslcontext = SSLContexts.custom()
  94.                     .loadTrustMaterial(certFile.getFile(), keyPassword.toCharArray(), new TrustSelfSignedStrategy())
  95.                     .loadKeyMaterial(keyStore, keyPassword.toCharArray()).build();
  96.             sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslcontext, new String[] { "TLSv1" }, null, hv);
  98.         } catch (Exception e) {
  99.             e.printStackTrace();
  100.         }
  101.         return sslConnectionSocketFactory;
  102.     }
  104. }

 注：在上述HostnameVerifier 中，可以验证hostname有效性，如果无效，返回fase，则会出现类似以下异常

javax.net.ssl.SSLPeerUnverifiedException: Certificate for <localhost> doesn\’t match any of the subject alternative names: []

测试controller

  1. package com.demo.bootdemo;
  3. import javax.annotation.Resource;
  5. import org.springframework.http.ResponseEntity;
  6. import org.springframework.stereotype.Controller;
  7. import org.springframework.web.bind.annotation.RequestMapping;
  8. import org.springframework.web.bind.annotation.ResponseBody;
  9. import org.springframework.web.client.RestTemplate;
  11. @Controller
  12. public class HttpsSendController {
  14.     @Resource(name = "skipVerifyRestTemplate")
  15.     private RestTemplate skipVerifyRestTemplate;
  17.     @Resource(name = "verifyCaRestTemplate")
  18.     private RestTemplate verifyCaRestTemplate;
  20.     @Resource(name = "secondSkipRestTemplate")
  21.     private RestTemplate secondSkipRestTemplate;
  23.     @RequestMapping("/skip")
  24.     @ResponseBody
  25.     public String skipVerifyCert() {
  26.         ResponseEntity<String> forEntity = skipVerifyRestTemplate.getForEntity("https://127.0.0.1:8443/test",
  27.                 String.class, new Object[] {});
  28.         return forEntity.getBody();
  29.     }
  31.     @RequestMapping("/secondskip")
  32.     @ResponseBody
  33.     public String secondSkipVerifyCert() {
  34.         ResponseEntity<String> forEntity = skipVerifyRestTemplate.getForEntity("https://127.0.0.1:8443/test",
  35.                 String.class, new Object[] {});
  36.         return forEntity.getBody();
  37.     }
  39.     @RequestMapping("/verify")
  40.     @ResponseBody
  41.     public String verifyCert() {
  42.         ResponseEntity<String> forEntity = verifyCaRestTemplate.getForEntity("https://127.0.0.1:8443/test",
  43.                 String.class, new Object[] {});
  44.         return forEntity.getBody();
  45.     }
  47. }

可分别访问当前客户端的skip、secondskip、verify验证结果

 

版权声明：本文为qq931399960原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://www.cnblogs.com/qq931399960/p/11904157.html