如何在Quarkus中以编程方式配置SSL连接

QuarkusRestClientBuilder 确实没有提供直接的 .sslContext() 方法，你可以通过以下两种方式实现编程式的SSL信任证书配置：

方法一：使用标准JAX-RS API的SSLSocketFactory与TrustManager #

先构建自定义的SSLContext，再通过sslSocketFactory()方法传入，同时指定对应的TrustManager：

// 1. 加载自定义信任证书
try (InputStream certStream = new FileInputStream("/path/to/your-trust-cert.pem")) {
    CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
    X509Certificate trustCert = (X509Certificate) certFactory.generateCertificate(certStream);

    // 2. 创建内存信任库并添加证书
    KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
    trustStore.load(null);
    trustStore.setCertificateEntry("custom-trust-cert", trustCert);

    // 3. 初始化TrustManagerFactory
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(trustStore);
    X509TrustManager trustManager = (X509TrustManager) tmf.getTrustManagers()[0];

    // 4. 构建SSLContext
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, new TrustManager[]{trustManager}, new SecureRandom());

    // 5. 配置QuarkusRestClientBuilder
    QuarkusRestClientBuilder restClientBuilder = QuarkusRestClientBuilder.newBuilder()
            .sslSocketFactory(sslContext.getSocketFactory(), trustManager)
            .hostnameVerifier((hostname, session) -> {
                // 根据业务需求实现主机名验证逻辑，示例为跳过验证，生产环境请勿直接使用
                return true;
            });
} catch (Exception e) {
    // 处理证书加载或SSLContext构建异常
    throw new RuntimeException("Failed to configure SSL context", e);
}

方法二：通过Apache HttpClient Builder配置（需引入对应依赖） #

如果你的项目使用了Quarkus的Apache HttpClient扩展（quarkus-rest-client-apache），可以直接配置底层HttpClient的SSLContext：

// 1. 构建自定义SSLContext（步骤同方法一）
SSLContext sslContext = ...;

// 2. 创建Apache HttpClient Builder并设置SSLContext
ApacheHttpClient5Builder httpClientBuilder = ApacheHttpClient5Builder.create();
httpClientBuilder.setSSLContext(sslContext);

// 3. 将HttpClient Builder绑定到QuarkusRestClientBuilder
QuarkusRestClientBuilder restClientBuilder = QuarkusRestClientBuilder.newBuilder()
        .property(ApacheHttpClient5Config.PROPERTY_HTTP_CLIENT_BUILDER, httpClientBuilder);

注意事项 #

• 生产环境中请勿直接跳过主机名验证（hostnameVerifier返回true），需实现符合业务安全要求的验证逻辑。
• 使用Apache HttpClient方式时，需确保项目已引入quarkus-rest-client-apache依赖。

内容的提问来源于stack exchange，提问作者SBW