如何无需环境变量为WebLogic Java客户端配置SSL

使用Oracle官方WebLogic Server 14.1.1 Thin T3 Jakarta客户端消费JMS队列消息时，目标WebLogic服务器采用自签名证书，导致T3S协议连接失败。全局设置javax.net.ssl.trustStore和javax.net.ssl.trustStorePassword可解决问题，但该配置会让整个应用信任此证书，因此需要仅为JMS连接工厂单独配置信任，此前尝试的多种JNDI属性均无效，求正确配置方式。

正确配置方案 #

WebLogic Thin客户端的T3S SSL信任配置无法通过JNDI Properties直接生效，需通过自定义SSLSocketFactory并关联到WebLogic的JNDI上下文实现局部信任，步骤如下：

• 加载仅包含目标WebLogic自签名证书的自定义信任库，生成专属SSLContext
• 使用WebLogic原生Environment类构建JNDI上下文，绑定自定义SSL配置
• 为JMS连接工厂和目标解析器分别配置相同的局部SSL环境，避免全局污染

修改后的代码示例 #

import weblogic.jndi.Environment;
import javax.naming.Context;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import javax.jms.QueueConnectionFactory;
import org.springframework.jms.listener.DefaultJmsListenerContainerFactory;
import org.springframework.jms.support.destination.JndiDestinationResolver;
import org.springframework.stereotype.Component;
import org.springframework.context.annotation.Bean;
import java.io.FileInputStream;
import java.security.KeyStore;

@Component
public class JmsConfig {

    // 假设这些是已注入的配置参数
    private String serverUrl = "t3s://your-weblogic-host:port";
    private String user = "weblogic-user";
    private String password = "weblogic-password";
    private String trustStorePath = "C:\\cert\\mycert.p12";
    private String trustStorePassword = "changeit";

    @Bean
    public QueueConnectionFactory connectionFactory() throws Exception {
        // 1. 加载自定义信任库，创建专属SSLContext
        KeyStore trustStore = KeyStore.getInstance("P12");
        try (FileInputStream fis = new FileInputStream(trustStorePath)) {
            trustStore.load(fis, trustStorePassword.toCharArray());
        }

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);

        // 2. 配置WebLogic Environment，绑定自定义SSL Socket Factory
        Environment env = new Environment();
        env.setInitialContextFactory("weblogic.jndi.WLInitialContextFactory");
        env.setProviderUrl(serverUrl);
        env.setSecurityPrincipal(user);
        env.setSecurityCredentials(password);
        env.setSSLSocketFactory(sslContext.getSocketFactory());
        // 测试环境可选：忽略主机名验证，生产环境需确保证书与服务器地址匹配
        env.setProperty("weblogic.security.SSL.ignoreHostnameVerification", "true");

        // 3. 获取JNDI上下文并查找连接工厂
        Context ctx = env.getInitialContext();
        QueueConnectionFactory connectionFactory = (QueueConnectionFactory) ctx.lookup("weblogic.jms.ConnectionFactory");
        ctx.close();

        return connectionFactory;
    }

    @Bean
    public DefaultJmsListenerContainerFactory jmsListenerContainerFactory(QueueConnectionFactory connectionFactory) throws Exception {
        DefaultJmsListenerContainerFactory factory = new DefaultJmsListenerContainerFactory();
        factory.setConnectionFactory(connectionFactory);

        // 为目标解析器配置相同的局部SSL环境
        JndiDestinationResolver jndiDestinationResolver = new JndiDestinationResolver();
        jndiDestinationResolver.setJndiEnvironment(buildJndiEnvWithCustomSsl().getProperties());
        factory.setDestinationResolver(jndiDestinationResolver);

        return factory;
    }

    // 提取复用的SSL环境构建逻辑
    private Environment buildJndiEnvWithCustomSsl() throws Exception {
        KeyStore trustStore = KeyStore.getInstance("P12");
        try (FileInputStream fis = new FileInputStream(trustStorePath)) {
            trustStore.load(fis, trustStorePassword.toCharArray());
        }

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, tmf.getTrustManagers(), null);

        Environment env = new Environment();
        env.setInitialContextFactory("weblogic.jndi.WLInitialContextFactory");
        env.setProviderUrl(serverUrl);
        env.setSecurityPrincipal(user);
        env.setSecurityCredentials(password);
        env.setSSLSocketFactory(sslContext.getSocketFactory());
        env.setProperty("weblogic.security.SSL.ignoreHostnameVerification", "true");

        return env;
    }

    @JmsListener(destination = "your-target-queue")
    public void handleJmsMessage(String message) {
        // 消息处理逻辑
    }
}

关键注意事项 #

• 必须使用WebLogic原生Environment类构建JNDI上下文，JndiObjectFactoryBean无法传递自定义SSLSocketFactory
• 自定义信任库仅包含目标WebLogic的自签名证书，确保仅该JMS连接使用此信任，不影响应用其他SSL链路
• 生产环境禁止使用weblogic.security.SSL.ignoreHostnameVerification，需确保证书的SubjectAltName或CN与服务器地址完全匹配

内容的提问来源于stack exchange，提问作者Niko Arts