Spring Boot响应式Apple Pay商户验证SSL握手问题求助

你的代码核心问题是：创建了包含Apple商户验证证书的KeyStore，但未将其传入TrustManagerFactory完成初始化，导致最终SSLContext使用的是系统默认信任管理器，无法识别Apple支付服务器的完整证书链，从而抛出PKIX路径构建失败的错误。

1. 必须将包含Apple完整证书链的自定义KeyStore绑定到TrustManagerFactory
2. 确保信任库中包含Apple根证书、中间证书以及你的商户验证证书，三者缺一不可
3. 修正SSLContext构建逻辑，使用自定义信任管理器替代默认配置

val certificateFactory = CertificateFactory.getInstance("X.509")

// 初始化自定义KeyStore
val keyStore: KeyStore = KeyStore.getInstance(KeyStore.getDefaultType())
keyStore.load(null)

// 加载并添加Apple根证书
val appleRootCertInputStream = FileInputStream("<PATH_TO_APPLE_ROOT_CERT>")
val appleRootCert = certificateFactory.generateCertificate(appleRootCertInputStream)
keyStore.setCertificateEntry("appleRootCert", appleRootCert)

// 加载并添加Apple中间证书
val appleIntermediateCertInputStream = FileInputStream("<PATH_TO_APPLE_INTERMEDIATE_CERT>")
val appleIntermediateCert = certificateFactory.generateCertificate(appleIntermediateCertInputStream)
keyStore.setCertificateEntry("appleIntermediateCert", appleIntermediateCert)

// 加载并添加商户验证证书
val merchantValidationInputStream = FileInputStream("<PATH_TO_CERT_FROM_APPLE>")
val merchantValidationCert= certificateFactory.generateCertificate(merchantValidationInputStream)
keyStore.setCertificateEntry("applePayMerchantValidationCert", merchantValidationCert)

// 初始化TrustManagerFactory，传入自定义KeyStore
val trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
trustManagerFactory.init(keyStore)

// 构建使用自定义信任库的SSLContext
val sslContext = SslContextBuilder
    .forClient()
    .trustManager(trustManagerFactory)
    .build()

val httpClient = HttpClient.create()
    .secure { it.sslContext(sslContext) }

val webClient = builder
    .clientConnector(ReactorClientHttpConnector(httpClient))
    .baseUrl("<VALIDATION_URL_PASSED_FROM_WEB>")
    .build()

return webClient.post()
    .bodyValue("<REQUEST_BODY_WITH_MERCHANTID_DISPLAYNAME_INITIATIVE_INITIATIVE_CONTEXT>")
    .retrieve()
    .toBodilessEntity()

• 证书格式：所有证书需为X.509格式（.cer/.pem均可，CertificateFactory可自动解析）
• 资源加载：推荐使用ResourceLoader或Class.getResourceAsStream()加载证书文件，避免部署时的路径问题
• 证书完整性：如果缺少根/中间证书，即使添加了商户证书，仍会出现SSL握手失败
• 混合信任（可选）：若需同时保留系统默认信任证书，可通过组合系统TrustManager和自定义TrustManager实现（需额外编写TrustManager逻辑）

内容的提问来源于stack exchange，提问作者Janani Subbiah