SpringBoot中MicroStream基于SSL连接Redis的配置问题

一、从LettuceConnectionFactory获取RedisClient供MicroStream使用 #

Spring的LettuceConnectionFactory已经封装了Lettuce原生的RedisClient实例，无需手动创建新客户端，直接从已配置好的连接工厂中提取底层实例即可，保证配置一致性。以下是完整配置类示例：

import io.lettuce.core.RedisClient;
import org.springframework.data.redis.connection.ReactiveRedisConnectionFactory;
import org.springframework.data.redis.connection.lettuce.LettuceConnectionFactory;
import org.springframework.stereotype.Component;

@Component
public class RedisConfig {

    // 配置带SSL的ReactiveRedisConnectionFactory
    @Bean
    public ReactiveRedisConnectionFactory reactiveRedisConnectionFactory() throws Exception {
        LettuceConnectionFactory lettuceFactory = new LettuceConnectionFactory();
        lettuceFactory.setHostName("your-redis-host");
        lettuceFactory.setPort(6380); // Redis SSL默认端口
        lettuceFactory.setUseSsl(true);
        
        // 后续添加SSL信任配置，先完成基础初始化
        lettuceFactory.afterPropertiesSet();
        return lettuceFactory;
    }

    // 提取RedisClient供MicroStream使用
    @Bean
    public RedisClient microStreamRedisClient(ReactiveRedisConnectionFactory connectionFactory) {
        LettuceConnectionFactory lettuceFactory = (LettuceConnectionFactory) connectionFactory;
        return lettuceFactory.getRedisClient();
    }
}

二、解决PKIX路径构建失败（SSL握手错误） #

该错误源于JVM信任库未包含Redis服务器SSL证书的根CA，提供两种解决方案：

方式1：将Redis证书导入JVM全局信任库（生产环境推荐） #

1. 获取Redis服务器的SSL证书（.pem格式，自签名证书直接取服务器证书）
2. 使用keytool命令导入到JVM默认信任库：

keytool -importcert -alias redis-cert -file /path/to/redis-cert.pem -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit

• 替换/path/to/redis-cert.pem为你的实际证书路径
• JVM默认信任库密码为changeit，若已修改请对应替换

方式2：在Lettuce配置中指定自定义信任库/禁用证书验证（测试环境用） #

自定义信任库配置

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import java.io.FileInputStream;
import java.security.KeyStore;

// 修改reactiveRedisConnectionFactory方法，添加SSL上下文配置
@Bean
public ReactiveRedisConnectionFactory reactiveRedisConnectionFactory() throws Exception {
    LettuceConnectionFactory lettuceFactory = new LettuceConnectionFactory();
    lettuceFactory.setHostName("your-redis-host");
    lettuceFactory.setPort(6380);
    lettuceFactory.setUseSsl(true);

    // 加载包含Redis证书的自定义信任库（.jks格式）
    KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
    try (FileInputStream fis = new FileInputStream("/path/to/truststore.jks")) {
        trustStore.load(fis, "your-truststore-password".toCharArray());
    }

    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(trustStore);

    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, tmf.getTrustManagers(), null);

    lettuceFactory.setSslContext(sslContext);
    lettuceFactory.afterPropertiesSet();
    return lettuceFactory;
}

临时禁用证书验证（仅测试环境，生产绝对禁止）

import javax.net.ssl.SSLContext;
import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;

// 修改reactiveRedisConnectionFactory方法
@Bean
public ReactiveRedisConnectionFactory reactiveRedisConnectionFactory() throws Exception {
    LettuceConnectionFactory lettuceFactory = new LettuceConnectionFactory();
    lettuceFactory.setHostName("your-redis-host");
    lettuceFactory.setPort(6380);
    lettuceFactory.setUseSsl(true);

    // 禁用证书校验
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, new X509TrustManager[]{
        new X509TrustManager() {
            @Override
            public void checkClientTrusted(X509Certificate[] chain, String authType) {}
            @Override
            public void checkServerTrusted(X509Certificate[] chain, String authType) {}
            @Override
            public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
        }
    }, null);

    lettuceFactory.setSslContext(sslContext);
    lettuceFactory.afterPropertiesSet();
    return lettuceFactory;
}

内容的提问来源于stack exchange，提问作者Robert Sahayaraj