WSO2 Identity Server 7.0.0配置MFA时邮件发送TLS转换异常求助

问题描述 #

我正在WSO2 Identity Server 7.0.0中配置多因素认证（MFA），已在deployment.toml中配置邮件输出适配器如下：

[output_adapter.email]
from_address= "coolkrishna@gmail.com"
username= "CoolKrishna"
password= "password"
hostname= "smtp.gmail.com"
port= 25
enable_start_tls= true
enable_authentication= false
signature = "ABC.com"

触发邮件时出现以下异常：

{org.wso2.carbon.event.output.adapter.email.EmailEventAdapter} - Exception occurred when sending email to abhishek@gmail.com. Could not convert socket to TLS javax.mail.MessagingException: Could not convert socket to TLS;
      nested exception is:
            javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
            at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2155)
            at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:752)
            at javax.mail.Service.connect(Service.java:366)
            at javax.mail.Service.connect(Service.java:246)
            at javax.mail.Service.connect(Service.java:195)
            at javax.mail.Transport.send0(Transport.java:254)
            at javax.mail.Transport.send(Transport.java:124)
            at org.wso2.carbon.event.output.adapter.email.EmailEventAdapter$EmailSender.run(EmailEventAdapter.java:367)
            at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
            at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
            at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
            at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
            at java.base/java.lang.Thread.run(Thread.java:829)
    Caused by: javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
            at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
            at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:349)
            at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:292)
            at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:287)
            at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1357)
            at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.onConsumeCertificate(CertificateMessage.java:1232)
            at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.consume(CertificateMessage.java:1175)
            at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:392)
            at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:443)
            at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:421)
            at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
            at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
            at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1426)
            at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1336)
            at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:450)
            at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:421)
            at com.sun.mail.util.SocketFetcher.configureSSLSocket(SocketFetcher.java:626)
            at com.sun.mail.util.SocketFetcher.startTLS(SocketFetcher.java:553)
            at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:2150)
            ... 12 more
    Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
            at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:439)
            at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:306)
            at java.base/sun.security.validator.Validator.validate(Validator.java:264)
            at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:313)
            at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:222)
            at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
            at java.base/sun.security.ssl.CertificateMessage$T13CertificateConsumer.checkServerCerts(CertificateMessage.java:1341)
            ... 26 more
    Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
            at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
            at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
            at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)
            at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:434)

问题原因 #

1. 证书信任问题：JVM无法信任Gmail SMTP服务器的SSL证书，PKIX证书路径构建失败，说明Gmail的根证书未导入到WSO2使用的JVM信任存储中。
2. 配置参数错误：
   • Gmail SMTP的TLS端口应为587，25端口通常被ISP屏蔽且Gmail官方推荐使用587
   • enable_authentication需设为true，Gmail SMTP必须身份验证才能发送邮件

解决方案 #

1. 修正deployment.toml配置 #

更新邮件适配器配置：

[output_adapter.email]
from_address= "coolkrishna@gmail.com"
username= "coolkrishna@gmail.com"  # Gmail用户名即为邮箱地址
password= "应用专用密码"  # 开启两步验证时需用Google应用专用密码，否则用邮箱登录密码
hostname= "smtp.gmail.com"
port= 587
enable_start_tls= true
enable_authentication= true
signature = "ABC.com"

提示：若开启Gmail两步验证，需在Google账户设置中生成应用专用密码，不能直接使用登录密码。

2. 导入Gmail根证书到WSO2信任存储 #

WSO2默认信任存储路径为<IS_HOME>/repository/resources/security/client-truststore.jks，默认密码wso2carbon。

操作步骤：

• 导出Gmail SMTP服务器的根证书：通过浏览器访问smtp.gmail.com:587，查看证书链并导出根证书（通常为GTS Root R1系列）
• 使用keytool命令导入证书：

keytool -importcert -alias gmail-smtp-root -file /path/to/gmail-root-cert.crt -keystore <IS_HOME>/repository/resources/security/client-truststore.jks -storepass wso2carbon

• 重启WSO2 Identity Server服务

3. 测试环境临时方案（跳过证书验证） #

仅测试环境使用，生产环境禁止：
在deployment.toml中添加配置跳过SSL验证：

[output_adapter.email]
# 保持原有配置不变
ssl_verify_mode = "none"

内容的提问来源于stack exchange，提问作者Sumant Shintre