Apache Camel+Email启动报错：msal4j.AcquireTokenByClientCredentialSupplier执行失败

我有一个基于Apache Camel+Camel-email+SpringBoot的项目，camel-context中的IMAP路由启动失败，报错：
org.apache.camel.FailedToStartRouteException: Failed to start route mail-route-imap because of null

为了和后端API交互，我在application.properties里添加了若干SSL专属参数，但IMAP与Exchange Server的连接采用的是OAUTH2 Client Secret认证方式，且已在IMAP URL中传入myExchangeAuthenticator，疑惑为何msal4j库仍会触发SSL握手操作？
补充说明：移除application-context中的SSL参数后，IMAP路由可正常运行。

错误日志 #

ERROR | ForkJoinPool.commonPool-worker-1 | AuthenticationResultSupplier.java logException:155 | [Correlation ID: 272b48e9-bf32-4244-9b4b-61dd0cda568e] Execution of class com.microsoft.aad.msal4j.AcquireTokenByClientCredentialSupplier failed.
com.microsoft.aad.msal4j.MsalClientException: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at com.microsoft.aad.msal4j.HttpHelper.executeHttpRequest(HttpHelper.java:53)
Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

 ERROR | main | SpringApplication.java reportFailure:818 | Application run failed
org.apache.camel.FailedToStartRouteException: Failed to start route mail-route-imap because of null
        at org.apache.camel.impl.engine.RouteService.setUp(RouteService.java:132)

相关配置 #

camel-context.xml #

<route id="mail-route-imap" autoStartup="true">     
<from id="office365" uri="imaps://outlook.office365.com:993?authenticator=#myExchangeAuthenticator&amp;debugMode=true&amp;mail.imaps.proxy.host={{proxyHost}}&amp;mail.imaps.proxy.port={{proxyPort}}&amp;mail.imaps.auth.mechanisms=XOAUTH2&amp;disconnect=true" />
<to uri="direct:someProcessChainAhead" />
</route>

application.properties #

# Enabling SSL Bench
    server.http2.enabled=true
    server.ssl.enabled=true
    server.ssl.enabl=TLSv1.2,TLSv1.3
    server.servlet.session.cookie.secure=true
    server.servlet.session.cookie.same-site=strict
    server.ssl.trust-store=/some-path-here/truststore.ks
    server.ssl.key-alias=nfmt
    server.ssl.key-store=/some-path-here/keystore.ks
    server.ssl.client-auth=want

MainApplication.java #

//initialized the SSL params in appContext

public static void main(String[] args) {
        MyVaultUtil.initialize();
        System.setProperty("javax.net.ssl.trustStore", "/some-path-here/truststore.ks");
        System.setProperty("javax.net.ssl.trustStorePassword", MyVaultUtil.getInstance()
                .getSecret(MyVaultUtil.SecretKeys.truststore_external_password.getKey()));
        System.setProperty("javax.net.ssl.trustStoreType", KeyStore.getDefaultType());
        System.setProperty("server.ssl.trust-store-password", MyVaultUtil.getInstance()
                .getSecret(MyVaultUtil.SecretKeys.truststore_external_password.getKey()));
        System.setProperty("server.ssl.key-store-password", MyVaultUtil.getInstance()
                .getSecret(MyVaultUtil.SecretKeys.keystore_external_password.getKey()));
        MainApplication.run(MainApplication.class, args);
    }

    @Bean //initializing inside MainApp
    MicrosoftExchangeOnlineOAuth2MailAuthenticator exchangeAuthenticator() {
        return new MicrosoftExchangeOnlineOAuth2MailAuthenticator(tenantId, clientId, clientSecret, userName);
    }

原因分析 #

1. 全局SSL配置覆盖JVM默认信任库：你在MainApplication中设置了javax.net.ssl.trustStore等系统属性，会替换JVM默认的信任库。如果自定义信任库中未包含Microsoft Azure AD的根证书，msal4j向Azure AD请求令牌时，就会因无法验证证书触发SSL握手失败。
2. OAUTH2认证的隐藏HTTPS请求：IMAP用XOAUTH2认证的本质是，myExchangeAuthenticator内部需要通过msal4j向Azure AD发起HTTPS请求获取令牌——这个过程必须完成SSL握手。全局信任库被替换后，JVM无法识别Azure AD的证书，直接抛出PKIX路径错误。
3. 移除SSL参数后正常的逻辑：移除SSL配置后，JVM恢复使用默认信任库，而默认信任库包含Azure AD的根证书，msal4j能正常获取令牌，IMAP路由也就可以启动了。

解决方案 #

方案1：给自定义信任库添加Azure AD根证书 #

• 从Azure AD的HTTPS站点（如https://login.microsoftonline.com）导出根证书
• 使用keytool命令将证书导入自定义信任库：

  keytool -importcert -file azure-ad-root.crt -keystore /some-path-here/truststore.ks -alias azuread-root
  

• 导入时输入正确的信任库密码即可

方案2：单独给后端API配置SSL，不影响全局 #

• 移除MainApplication中设置的javax.net.ssl.*系统属性，保留application.properties中的server.ssl.*（用于服务端自身的SSL）
• 为后端API的客户端（如RestTemplate、FeignClient）单独配置SSL上下文：加载自定义的keystore.ks和truststore.ks，避免全局覆盖JVM默认信任库

方案3：自定义msal4j的HttpClient配置 #

• 在MicrosoftExchangeOnlineOAuth2MailAuthenticator初始化ConfidentialClientApplication时，指定使用默认信任库的HttpClient：

  SSLContext sslContext = SSLContext.getDefault(); // 使用JVM默认信任库
  HttpClient httpClient = HttpClient.createDefault(sslContext);
  ConfidentialClientApplication app = ConfidentialClientApplication.builder(clientId, ClientCredentialFactory.createFromSecret(clientSecret))
          .authority(authority)
          .httpClient(httpClient)
          .build();
  

内容的提问来源于stack exchange，提问作者raikumardipak