如何在RestTemplate中动态更新SSL Context且保留连接池

核心思路 #

不需要重建RestTemplate和连接池，通过动态更新连接池关联的SSL SocketFactory实现证书更新，同时关闭旧连接强制后续请求使用新证书。

方案1：自定义可动态更新SSL Context的SocketFactory #

通过自定义SSLConnectionSocketFactory子类，持有可修改的SSL Context引用，再结合连接池的连接清理机制实现更新。

1.1 自定义动态SocketFactory #

public class DynamicSSLConnectionSocketFactory extends SSLConnectionSocketFactory {
    private volatile SSLContext sslContext;

    public DynamicSSLConnectionSocketFactory(SSLContext sslContext) {
        super(sslContext);
        this.sslContext = sslContext;
    }

    // 对外暴露更新SSL Context的方法
    public void updateSslContext(SSLContext newSslContext) {
        this.sslContext = newSslContext;
    }

    // 重写Socket初始化逻辑，使用最新的SSL Context
    @Override
    protected void prepareSocket(Socket socket) throws IOException {
        SSLSocket sslSocket = (SSLSocket) socket;
        sslSocket.setSSLContext(sslContext);
        super.prepareSocket(socket);
    }
}

1.2 修改RestTemplate Bean定义 #

拆分Bean，让连接池和动态SocketFactory可被单独注入：

@Bean
public DynamicSSLConnectionSocketFactory dynamicSSLConnectionSocketFactory() {
    return new DynamicSSLConnectionSocketFactory(getsslContext());
}

@Bean
public PoolingHttpClientConnectionManager connectionManager(DynamicSSLConnectionSocketFactory socketFactory) {
    PoolingHttpClientConnectionManager connectionManager =
        PoolingHttpClientConnectionManagerBuilder.create()
            .setSSLSocketFactory(socketFactory)
            .build();
    connectionManager.setMaxTotal(30);
    connectionManager.setDefaultMaxPerRoute(10);
    return connectionManager;
}

@Bean
public RestTemplate restTemplate(RestTemplateBuilder restTemplateBuilder,
                                 PoolingHttpClientConnectionManager connectionManager) {
    RequestConfig requestConfig =
        RequestConfig.custom()
            .setResponseTimeout(Timeout.ofSeconds(5))
            .setConnectionRequestTimeout(Timeout.ofSeconds(2))
            .build();

    HttpClient httpClient =
        HttpClientBuilder.create()
            .setConnectionManager(connectionManager)
            .setDefaultRequestConfig(requestConfig)
            .build();

    ClientHttpRequestFactory requestFactory =
        new HttpComponentsClientHttpRequestFactory(httpClient);
    return restTemplateBuilder.requestFactory(() -> requestFactory).build();
}

1.3 实现证书更新服务 #

@Service
public class SslContextUpdater {
    private final DynamicSSLConnectionSocketFactory socketFactory;
    private final PoolingHttpClientConnectionManager connectionManager;

    public SslContextUpdater(DynamicSSLConnectionSocketFactory socketFactory,
                             PoolingHttpClientConnectionManager connectionManager) {
        this.socketFactory = socketFactory;
        this.connectionManager = connectionManager;
    }

    // 触发证书更新的方法，可通过定时任务或接口调用
    public void updateSslContext() throws Exception {
        // 加载新证书并创建SSL Context（替换为你的实际证书加载逻辑）
        SSLContext newSslContext = loadNewSslContext();
        // 更新SocketFactory的SSL Context
        socketFactory.updateSslContext(newSslContext);
        // 关闭所有旧连接，强制后续请求使用新证书
        connectionManager.closeExpiredConnections();
        connectionManager.closeIdleConnections(Duration.ofSeconds(0));
    }

    private SSLContext loadNewSslContext() throws Exception {
        SSLContext sslContext = SSLContext.getInstance("TLS");
        // 示例：从文件加载新信任证书，实际需根据业务场景调整
        CertificateFactory cf = CertificateFactory.getInstance("X.509");
        try (InputStream in = new FileInputStream("new-trust-cert.crt")) {
            X509Certificate cert = (X509Certificate) cf.generateCertificate(in);
            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
            keyStore.load(null, null);
            keyStore.setCertificateEntry("new-trust-cert", cert);
            
            TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            tmf.init(keyStore);
            sslContext.init(null, tmf.getTrustManagers(), new SecureRandom());
        }
        return sslContext;
    }
}

方案2：通过Registry动态替换SSL SocketFactory #

利用HttpClient的Registry<ConnectionSocketFactory>管理Socket工厂，更新Registry后通知连接池刷新。

2.1 初始化Bean #

@Bean
public Registry<ConnectionSocketFactory> socketFactoryRegistry() {
    SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(getsslContext());
    return RegistryBuilder.<ConnectionSocketFactory>create()
            .register("http", PlainConnectionSocketFactory.getSocketFactory())
            .register("https", sslSocketFactory)
            .build();
}

@Bean
public PoolingHttpClientConnectionManager connectionManager(Registry<ConnectionSocketFactory> socketFactoryRegistry) {
    PoolingHttpClientConnectionManager connectionManager =
        new PoolingHttpClientConnectionManager(socketFactoryRegistry);
    connectionManager.setMaxTotal(30);
    connectionManager.setDefaultMaxPerRoute(10);
    return connectionManager;
}

@Bean
public RestTemplate restTemplate(RestTemplateBuilder restTemplateBuilder,
                                 PoolingHttpClientConnectionManager connectionManager) {
    // 同方案1的RestTemplate构建逻辑
    RequestConfig requestConfig =
        RequestConfig.custom()
            .setResponseTimeout(Timeout.ofSeconds(5))
            .setConnectionRequestTimeout(Timeout.ofSeconds(2))
            .build();

    HttpClient httpClient =
        HttpClientBuilder.create()
            .setConnectionManager(connectionManager)
            .setDefaultRequestConfig(requestConfig)
            .build();

    ClientHttpRequestFactory requestFactory =
        new HttpComponentsClientHttpRequestFactory(httpClient);
    return restTemplateBuilder.requestFactory(() -> requestFactory).build();
}

2.2 实现更新逻辑 #

@Service
public class SslContextUpdater {
    private final PoolingHttpClientConnectionManager connectionManager;

    public SslContextUpdater(PoolingHttpClientConnectionManager connectionManager) {
        this.connectionManager = connectionManager;
    }

    public void updateSslContext() throws Exception {
        SSLContext newSslContext = loadNewSslContext();
        SSLConnectionSocketFactory newSslSocketFactory = new SSLConnectionSocketFactory(newSslContext);
        // 创建新的Registry，替换https对应的SocketFactory
        Registry<ConnectionSocketFactory> newRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
                .register("http", PlainConnectionSocketFactory.getSocketFactory())
                .register("https", newSslSocketFactory)
                .build();
        // 更新连接池的Registry
        connectionManager.setSocketFactoryRegistry(newRegistry);
        // 清理旧连接
        connectionManager.closeExpiredConnections();
        connectionManager.closeIdleConnections(Duration.ofSeconds(0));
    }

    // 同方案1的loadNewSslContext方法
    private SSLContext loadNewSslContext() throws Exception {
        // ...省略实现
    }
}

关键注意事项 #

• 强制清理旧连接：更新SSL Context后必须关闭连接池中的空闲/过期连接，否则旧连接会继续使用过期证书。
• 更新时机：可通过Spring的@Scheduled定时任务在证书过期前自动触发更新，或提供手动触发的API。
• 证书加载可靠性：确保新证书的加载逻辑安全可靠（比如从配置中心加密获取），避免加载失败导致服务异常。

内容的提问来源于stack exchange，提问作者sub