RestTemplate连接https，证书匹配失败

RestTemplate连接https，证书匹配失败

使用RestTemplate进行接口转发，转发地址是 https://内网IP 的格式，由于证书是自签的，所以在调试的时候

接口报错，在jvm中无法找到匹配的SSL证书：

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target] with root cause 

所以在浏览器访问 https://内网IP ，并通过浏览器将证书下载下来，安装到我们的JDK：

# 进入到安装的jre目录，并将下载下来的证书拷贝到当前目录 cd $JAVA_HOME/jre/lib/security  # 执行安装命令 keytool -import -alias 证书别名 -keystore cacerts -file ./xxxx.cer 

经过上面的操作后重启服务，调用接口发现还是报同样的错误，但是SSL证书确实是安装成功的，所以索性在服务生成RestTemplate的Bean时绕过SSL验证，一般情况下，会通过SimpleClientHttpRequestFactory来构建RestTemplate实例，但是它不支持https，要支持https需要替换SimpleClientHttpRequestFactory为HttpComponentsClientHttpRequestFactory，而且我们还要引入httpclient依赖：

<dependency> 	<groupId>org.apache.httpcomponents</groupId> 	<artifactId>httpclient</artifactId> 	<version>4.5.6</version> </dependency> 

修改RestTemplateConfig配置类：

@Configuration public class RestTemplateConfig {     @Bean     public RestTemplate restTemplate(ClientHttpRequestFactory factory){         return new RestTemplate(factory);     }      @Bean     public ClientHttpRequestFactory httpComponentsClientHttpRequestFactory() throws Exception {         // 自定义证书校验器         TrustManager[] trustAllCerts = new TrustManager[]{                 new X509TrustManager() {                     @Override                     public void checkClientTrusted(java.security.cert.X509Certificate[] x509Certificates, String s) {                     }                      @Override                     public void checkServerTrusted(java.security.cert.X509Certificate[] x509Certificates, String s) {                     }                      @Override                     public java.security.cert.X509Certificate[] getAcceptedIssuers() {                         return new X509Certificate[0];                     }                 }         };          SSLContext sslContext = SSLContext.getInstance("SSL");         sslContext.init(null, trustAllCerts, new java.security.SecureRandom());           SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext);          CloseableHttpClient httpClient = HttpClients.custom()                 .setSSLSocketFactory(csf)                 .build();         HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory();         factory.setConnectTimeout(20000);         factory.setReadTimeout(15000);         factory.setHttpClient(httpClient);         return factory;     } } 

重启服务调用接口，原以为应该没什么大问题了，可是报了不同的错误：

Certificate for <10.xx.xx.xx> doesn't match any of the subject alternative names: [localhost, xx.xx.com] 

从上面的错误提示可以看出，其实第一步安装的证书是成功的，但是在创建SSL连接验证域名的时候出错了，打开证书查看证书保护的域名只有 localhost, xx.xx.com ，所以这是报错的根源所在，我通过IP访问的链接，但是IP不在证书保护的域名内，导致验证错误，但是我通过域名访问的链接 https://域名 是成功的。

网上查找了原因，我引入的httpclient版本是4.4以上的，所以在生成SSLConnectionSocketFactory实例时，需要指定host验证器，允许ssl连接允许通过不同的hosts，

SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE); 

完整的RestTemplateConfig配置类：

@Configuration public class RestTemplateConfig {     @Bean     public RestTemplate restTemplate(ClientHttpRequestFactory factory){         return new RestTemplate(factory);     }      @Bean     public ClientHttpRequestFactory httpComponentsClientHttpRequestFactory() throws Exception {         // 自定义证书校验器         TrustManager[] trustAllCerts = new TrustManager[]{                 new X509TrustManager() {                     @Override                     public void checkClientTrusted(java.security.cert.X509Certificate[] x509Certificates, String s) {                     }                      @Override                     public void checkServerTrusted(java.security.cert.X509Certificate[] x509Certificates, String s) {                     }                      @Override                     public java.security.cert.X509Certificate[] getAcceptedIssuers() {                         return new X509Certificate[0];                     }                 }         };          SSLContext sslContext = SSLContext.getInstance("SSL");         sslContext.init(null, trustAllCerts, new java.security.SecureRandom());           SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);          CloseableHttpClient httpClient = HttpClients.custom()                 .setSSLSocketFactory(csf)                 .build();         HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory();         factory.setConnectTimeout(20000);         factory.setReadTimeout(15000);         factory.setHttpClient(httpClient);         return factory;     } }