如何用字符串证书为Netty创建SslContext并配置到WebClient

安全阿岳

2026-7-28

解决WebClient使用ACM字符串证书创建Netty SslContext的问题

要搞定这个问题，核心是把AWS ACM返回的字符串证书转换成Netty SslContextBuilder能识别的标准证书格式，再配置到WebClient中，具体步骤如下：

1. 将字符串证书解析为X509Certificate对象

Netty的SslContextBuilder不直接支持字符串证书，但可以通过Java原生的CertificateFactory把字符串解析成标准的X509Certificate对象：

import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.io.ByteArrayInputStream;
import java.nio.charset.StandardCharsets;

// certStr 是从ACM GetCertificateResult获取的带首尾标记的字符串证书
String certStr = "-----BEGIN CERTIFICATE-----...-----END CERTIFICATE-----";

CertificateFactory certFactory = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate) certFactory.generateCertificate(
    new ByteArrayInputStream(certStr.getBytes(StandardCharsets.UTF_8))
);

2. 构建Netty SslContext

用解析后的证书对象创建客户端SslContext，指定信任该外部API的证书：

import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.SslContextBuilder;

SslContext sslContext = SslContextBuilder.forClient()
    .trustManager(cert) // 传入解析完成的证书对象
    .build();

3. 把SslContext配置到WebClient

通过ReactorClientHttpConnector将自定义SslContext注入WebClient：

import org.springframework.web.reactive.function.client.WebClient;
import reactor.netty.http.client.HttpClient;

HttpClient httpClient = HttpClient.create()
    .secure(sslSpec -> sslSpec.sslContext(sslContext));

WebClient webClient = WebClient.builder()
    .clientConnector(new ReactorClientHttpConnector(httpClient))
    .build();