集群部署WebClient+OAuth2时SSL握手失败问题求助

问题描述 #

• 实现了带有OAuth2过滤器的WebClient Bean，用于通过Bearer Token调用文件上传服务
• 本地环境使用相同的token-uri可正常运行
• 集群部署后出现SSL握手错误，具体表现为获取Token时发送ServerHello后无响应
• 已排除证书配置、代理问题，OAuth服务器本身配置连接正常

相关代码 #

WebClient Bean配置 #

@Bean
public WebClient oauth2WebClient(ReactiveClientRegistrationRepository clientRegistrations,
                                 ServerOAuth2AuthorizedClientRepository authorizedClients) {
    ServerOAuth2AuthorizedClientExchangeFilterFunction oauth2 =
            new ServerOAuth2AuthorizedClientExchangeFilterFunction(clientRegistrations, authorizedClients);
    oauth2.setDefaultClientRegistrationId("file-upload-service");
    
    return WebClient.builder()
            .filter(oauth2)
            .build();
}

核心配置片段（application.yml） #

spring:
  security:
    oauth2:
      client:
        registration:
          file-upload-service:
            client-id: ${CLIENT_ID}
            client-secret: ${CLIENT_SECRET}
            authorization-grant-type: client_credentials
        provider:
          file-upload-service:
            token-uri: ${OAUTH_TOKEN_URI} # 集群环境下的HTTPS地址

典型报错信息 #

2024-XX-XX XX:XX:XX.XXX DEBUG [reactor-http-nio-3] reactor.netty.tcp.TcpClient: [id: 0xb4d2f1a, L:/10.0.0.5:54321 - R:oauth-server.example.com/192.168.1.10:443] SSL handshake started
2024-XX-XX XX:XX:XX.XXX DEBUG [reactor-http-nio-3] reactor.netty.tcp.TcpClient: [id: 0xb4d2f1a, L:/10.0.0.5:54321 - R:oauth-server.example.com/192.168.1.10:443] Sent ServerHello
2024-XX-XX XX:XX:XX.XXX ERROR [reactor-http-nio-3] reactor.netty.tcp.TcpClient: [id: 0xb4d2f1a, L:/10.0.0.5:54321 - R:oauth-server.example.com/192.168.1.10:443] SSL handshake failed
io.netty.handler.ssl.SslHandshakeTimeoutException: handshake timed out after 10000ms

排查分析 #

从现象（发送ServerHello后无响应）来看，基本排除代码实现问题，更倾向于网络层/Socket层面的异常，可能的原因包括：

• 集群网络策略限制：防火墙、安全组或服务网格在SSL握手阶段拦截了双向数据包
• SSL协议/密码套件不兼容：集群JVM默认SSL配置与OAuth服务器不匹配，导致对方无回应
• Socket超时配置不合理：集群网络延迟较高，默认握手超时过短触发中断
• DNS解析异常：集群节点解析到的OAuth服务器IP存在异常，部分节点无法正常完成握手

解决方案 #

1. 检查集群网络连通性 #

• 在集群节点执行nc -zv oauth-server.example.com 443测试端口连通性，同时用tcpdump抓包，确认ServerHello发送后是否收到服务器回应
• 排查集群内防火墙、服务网格（如Istio）规则，确保443端口双向流量完全开放

2. 强制指定兼容的SSL协议与密码套件 #

修改WebClient配置，显式指定与OAuth服务器匹配的SSL参数：

@Bean
public WebClient oauth2WebClient(ReactiveClientRegistrationRepository clientRegistrations,
                                 ServerOAuth2AuthorizedClientRepository authorizedClients) {
    SslContext sslContext = SslContextBuilder.forClient()
            .protocols("TLSv1.2", "TLSv1.3")
            .ciphers(Arrays.asList("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384"))
            .build();

    ClientHttpConnector connector = new ReactorClientHttpConnector(
            HttpClient.create().secure(t -> t.sslContext(sslContext)));

    ServerOAuth2AuthorizedClientExchangeFilterFunction oauth2 =
            new ServerOAuth2AuthorizedClientExchangeFilterFunction(clientRegistrations, authorizedClients);
    oauth2.setDefaultClientRegistrationId("file-upload-service");

    return WebClient.builder()
            .clientConnector(connector)
            .filter(oauth2)
            .build();
}

3. 调整Socket超时配置 #

针对集群网络延迟优化超时参数：

@Bean
public WebClient oauth2WebClient(ReactiveClientRegistrationRepository clientRegistrations,
                                 ServerOAuth2AuthorizedClientRepository authorizedClients) {
    ClientHttpConnector connector = new ReactorClientHttpConnector(
            HttpClient.create()
                    .secure(t -> t.sslContext(SslContextBuilder.forClient().build()))
                    .option(ChannelOption.CONNECT_TIMEOUT_MILLIS, 30000)
                    .doOnConnected(conn -> conn
                            .addHandlerLast(new ReadTimeoutHandler(30))
                            .addHandlerLast(new WriteTimeoutHandler(30))));

    ServerOAuth2AuthorizedClientExchangeFilterFunction oauth2 =
            new ServerOAuth2AuthorizedClientExchangeFilterFunction(clientRegistrations, authorizedClients);
    oauth2.setDefaultClientRegistrationId("file-upload-service");

    return WebClient.builder()
            .clientConnector(connector)
            .filter(oauth2)
            .build();
}

4. 验证DNS解析与服务器节点状态 #

• 在集群节点执行nslookup oauth-server.example.com，确认解析到的IP与本地环境一致，且所有IP都能正常完成SSL握手
• 直接使用OAuth服务器的IP地址替换token-uri中的域名测试，排除DNS解析问题

5. 显式指定JVM信任库 #

若集群JVM使用非默认信任库，可在代码中显式配置：

@Bean
public WebClient oauth2WebClient(ReactiveClientRegistrationRepository clientRegistrations,
                                 ServerOAuth2AuthorizedClientRepository authorizedClients) throws Exception {
    KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
    try (InputStream is = new FileInputStream("/path/to/truststore.jks")) {
        trustStore.load(is, "truststore-password".toCharArray());
    }

    SslContext sslContext = SslContextBuilder.forClient()
            .trustManager(trustStore)
            .build();

    // 后续配置同前
}

内容的提问来源于stack exchange，提问作者yungbroccoli