Spring Boot MTLS场景下如何仅记录客户端SSL证书指纹

核心思路 #

直接从每个HttpClient对应的SSLContext中提取客户端证书，计算可识别的指纹值，在请求发起前后精准记录，无需依赖冗余的SSL调试日志。

具体实现步骤 #

1. 编写证书指纹生成工具类 #

实现一个通用方法，将X509证书转换为SHA-256指纹（也可替换为SHA-1等其他算法）：

import java.security.MessageDigest;
import java.security.cert.X509Certificate;
import java.util.Formatter;

public class CertFingerprintUtils {
    public static String getSha256Fingerprint(X509Certificate cert) throws Exception {
        MessageDigest md = MessageDigest.getInstance("SHA-256");
        byte[] digest = md.digest(cert.getEncoded());
        return formatFingerprint(digest);
    }

    private static String formatFingerprint(byte[] digest) {
        try (Formatter formatter = new Formatter()) {
            for (byte b : digest) {
                formatter.format("%02X:", b);
            }
            String fingerprint = formatter.toString();
            return fingerprint.substring(0, fingerprint.length() - 1); // 移除末尾多余的冒号
        }
    }
}

2. 从SSLContext中提取客户端证书 #

在创建专属SSLContext的环节，直接从配置的密钥库中取出客户端证书并计算指纹：

import org.apache.http.ssl.SSLContexts;
import javax.net.ssl.SSLContext;
import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.cert.X509Certificate;

// 示例：加载客户端密钥库并创建SSLContext
KeyStore clientKeyStore = KeyStore.getInstance("PKCS12");
clientKeyStore.load(new FileInputStream("client-cert-1.p12"), "cert-password".toCharArray());

SSLContext sslContext = SSLContexts.custom()
        .loadKeyMaterial(clientKeyStore, "cert-password".toCharArray())
        .loadTrustMaterial(...) // 配置你的信任库逻辑
        .build();

// 提取并计算证书指纹
String alias = clientKeyStore.aliases().nextElement(); // 获取密钥库第一个别名（根据实际场景调整）
X509Certificate clientCert = (X509Certificate) clientKeyStore.getCertificate(alias);
String certFingerprint = CertFingerprintUtils.getSha256Fingerprint(clientCert);

3. 给HttpClient添加日志拦截器 #

为每个专属HttpClient添加请求拦截器，在发起请求时记录对应的证书指纹：

import org.apache.http.HttpRequest;
import org.apache.http.HttpRequestInterceptor;
import org.apache.http.protocol.HttpContext;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

public class CertLoggingInterceptor implements HttpRequestInterceptor {
    private static final Logger logger = LoggerFactory.getLogger(CertLoggingInterceptor.class);
    private final String clientCertFingerprint;

    public CertLoggingInterceptor(String clientCertFingerprint) {
        this.clientCertFingerprint = clientCertFingerprint;
    }

    @Override
    public void process(HttpRequest request, HttpContext context) {
        logger.info("调用目标服务[{}]，使用的客户端证书SHA-256指纹: {}", 
                    request.getRequestLine().getUri(), clientCertFingerprint);
    }
}

创建HttpClient时绑定该拦截器：

CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLContext(sslContext)
        .addInterceptorFirst(new CertLoggingInterceptor(certFingerprint))
        .build();

4. 适配非自定义密钥库的场景 #

如果SSLContext不是由你手动加载密钥库创建的（比如使用系统默认配置），可以通过KeyManager提取证书：

KeyManager[] keyManagers = sslContext.getKeyManagers();
if (keyManagers != null && keyManagers.length > 0) {
    X509KeyManager x509KeyManager = (X509KeyManager) keyManagers[0];
    // 根据实际场景选择客户端证书别名
    String alias = x509KeyManager.getClientAliases("RSA", null)[0];
    X509Certificate clientCert = x509KeyManager.getCertificateChain(alias)[0];
    String fingerprint = CertFingerprintUtils.getSha256Fingerprint(clientCert);
}

SSL调试日志的优化方案（可选） #

如果仍想使用SSL调试日志，可通过精准配置日志级别减少冗余，比如在application.properties中添加：

# 仅打印SSL握手相关的证书信息
logging.level.sun.security.ssl.handshake=INFO

但这种方式仍会产生额外日志，不如直接提取指纹的方式精准可控。

内容的提问来源于stack exchange，提问作者Manikdn84