我正在使用 spring webflux webclient 工具來調用 API。API服務器地址為HTTPS，是不帶域名的IP地址。我需要在 webclient 中禁用主機名驗證?，F在異常如下Caused by: java.security.cert.CertificateException: No subject alternative names matching IP address 180.101.147.89 found at sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:168) ~[na:1.8.0_211] at sun.security.util.HostnameChecker.match(HostnameChecker.java:94) ~[na:1.8.0_211] at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:461) ~[na:1.8.0_211] at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:442) ~[na:1.8.0_211] at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:260) ~[na:1.8.0_211] at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144) ~[na:1.8.0_211] at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1626) ~[na:1.8.0_211] ... 28 common frames omitted@Bean public WebClient telcomWebclient(WebClient.Builder webClientBuilder, @Value("${telcom.api.host}") String telcomApiHost, @Value("${telcom.api.certificate-name}") String telcomApiCertificateName, @Value("${telcom.api.certificate-store-pass}") String telcomApiCertificateStorePass) { try { KeyStore selfCert = KeyStore.getInstance("pkcs12"); selfCert.load(getClass().getResourceAsStream("/cert/outgoing.CertwithKey.pkcs12"), "IoM@1234".toCharArray()); KeyManagerFactory kmf = KeyManagerFactory.getInstance("sunx509"); kmf.init(selfCert, "IoM@1234".toCharArray()); KeyStore caCert = KeyStore.getInstance("jks"); caCert.load(getClass().getResourceAsStream("/cert/" + telcomApiCertificateName), telcomApiCertificateStorePass.toCharArray()); TrustManagerFactory tmf = TrustManagerFactory.getInstance("sunx509"); tmf.init(caCert);
1 回答
慕蓋茨4494581
TA貢獻1850條經驗 獲得超11個贊
實際上 SNIMatcher 僅適用于服務器端。這可以通過在 matches() 方法的返回上放置一個斷點來驗證。執行永遠不會在該斷點處停止。
跳過主機名驗證的實際原因是，當覆蓋 SSLParameters 時，新的 params.identificationAlgorithm 值為 null 而不是“HTTPS”。
這是一個更簡單的代碼，它和上面的一樣有效。
HttpClient.create().secure(sslContextSpec -> sslContextSpec
.sslContext(sslContext)
.handlerConfigurator(sslHandler -> {
SSLEngine engine = handler.engine();
SSLParameters params = new SSLParameters(engine.getSSLParameters().getCipherSuites(), engine.getSSLParameters().getProtocols());
// With java update null value is no longer sufficient to skip host name verification
params.setEndpointIdentificationAlgorithm("");
engine.setSSLParameters(params);
}));
添加回答
舉報
0/150
提交
取消