我一直在瀏覽 Apache 文檔和其他示例，試圖創建一個使用 Apache HttpClient 來調用各種 RESTful Web 服務的客戶端。（這些 Web 服務中的每一個都可能需要不同的客戶端證書來進行身份驗證）。最初我創建了一個初始化 HttpClient 的靜態代碼塊（使用 SSLContext 信息和池連接管理器）：private static CloseableHttpClient _client;static { HttpClientBuilder clientBuilder = HttpClients.custom(); SSLContextBuilder sslContextBuilder = SSLContexts.custom(); sslContextBuilder.loadTrustMaterial(new TrustSelfSignedStrategy()); sslContextBuilder.loadKeyMaterial(new File("clientcert.p12"), password, password, (aliases, socket) -> aliases.keySet().iterator().next()); SSLContext sslContext = sslContextBuilder.build(); HostnameVerifier allowAllHosts = new NoopHostnameVerifier(); SSLConnectionSocketFactory connectionFactory = new SSLConnectionSocketFactory(sslContext, allowAllHosts); clientBuilder.setSSLSocketFactory(connectionFactory); RegistryBuilder<ConnectionSocketFactory> regBuilder = RegistryBuilder.<ConnectionSocketFactory>create(); regBuilder.register("https", connectionFactory); regBuilder.register("http", new PlainConnectionSocketFactory()); Registry<ConnectionSocketFactory> socketFactoryRegistry = regBuilder.build(); PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry); clientBuilder.setConnectionManager(connectionManager); _client = clientBuilder.build();}此時我可以使用客戶端執行請求，只要服務器配置為允許訪問 clientcert.p12，客戶端身份驗證就可以正常工作。我需要的是能夠根據所需客戶端證書的值動態更改每個請求的客戶端證書。是否可以在動態更改客戶端證書的同時重用靜態 HttpClient？另外，如果這是可能的，我是否仍然會看到使用池連接管理器的性能優勢？
2 回答
蠱毒傳說
TA貢獻1895條經驗 獲得超3個贊
可以使用一個未記錄的http.socket-factory-registry執行上下文屬性來覆蓋連接管理器在構造時設置的連接套接字工廠。
CloseableHttpClient httpClient = HttpClientBuilder.create()
.setSSLContext(SSLContexts.createSystemDefault())
.build();
SSLContext customSSlContext = SSLContexts.custom()
.loadKeyMaterial(new File("my-keystore.jks"), "sectret".toCharArray(), "sectret".toCharArray())
.build();
Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
.register("http", PlainConnectionSocketFactory.getSocketFactory())
.register("https", new SSLConnectionSocketFactory(customSSlContext))
.build();
HttpClientContext clientContext = HttpClientContext.create();
clientContext.setAttribute("http.socket-factory-registry", socketFactoryRegistry);
try (CloseableHttpResponse response = httpClient.execute(new HttpGet("https://host/stuff"), clientContext)) {
System.out.println(response.getStatusLine());
EntityUtils.consume(response.getEntity());
}
使用相同的客戶端實例/相同的連接池來執行具有不同用戶身份/安全上下文的多個線程的請求時要格外小心。
慕娘9325324
TA貢獻1783條經驗 獲得超4個贊
我在這里發布我使用PoolingHttpClientConnectionManager類的解決方案，這個對我有用：
SSLConnectionSocketFactory sslConnectionFactory = new SSLConnectionSocketFactory(sslContext, new DefaultHostnameVerifier());
Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory> create()
.register("https", sslConnectionFactory)
.register("http", new PlainConnectionSocketFactory())
.build();
PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(registry);
CloseableHttpClient httpClient = HttpClients.custom()
.setSSLContext(sslContext)
.setDefaultRequestConfig(RequestConfig.custom().setCookieSpec(CookieSpecs.STANDARD).build())
.setConnectionManager(cm)
.build();
cm.setMaxTotal(200);
cm.setDefaultMaxPerRoute(20);
final ApacheHttpClient4Engine engine = new ApacheHttpClient4Engine(httpClient);
engine.setFollowRedirects(false);
ResteasyClient client = clientBuilder.httpEngine(engine).build();
ResteasyWebTarget target = client.target(UriBuilder.fromPath(
"https://my.server.com/mtls/protected/resource"));
String response = target.request().get(String.class);
添加回答
舉報
0/150
提交
取消