Spring Boot WebClient连接OAuth2 HTTPS API的证书配置步骤咨询

一、证书导入到自定义信任库 #

Java应用的HTTPS信任依赖证书信任库，推荐使用自定义信任库（避免修改JRE默认的cacerts影响其他应用）。优先使用你已有的PEM格式证书（XXX_Root_CA_3_PEM.cer、XXX_Sub_CA_3_PEM.cer），无需转换为PKCS12，直接用keytool（JDK自带工具）导入：

1. 创建并导入根CA证书 #

keytool -importcert -alias xxx-root-ca -file XXX_Root_CA_3_PEM.cer -keystore my-truststore.jks -storepass your-truststore-password

• -alias：为证书设置唯一标识别名，便于后续管理
• -file：指定PEM格式根CA证书的本地路径
• -keystore：自定义信任库文件名（如my-truststore.jks）
• -storepass：设置信任库密码（后续配置需使用，建议使用强密码）

执行命令后，会提示是否信任该证书，输入yes确认完成导入。

2. 导入子CA证书 #

重复上述命令，替换别名和证书文件：

keytool -importcert -alias xxx-sub-ca -file XXX_Sub_CA_3_PEM.cer -keystore my-truststore.jks -storepass your-truststore-password

（可选）使用已生成的PKCS12文件导入 #

如果要使用你之前生成的XXX_Root_CA_3.p12，执行以下命令导入到自定义信任库（注意此文件仅包含根CA，子CA需单独转换导入或直接用PEM文件）：

keytool -importkeystore -srckeystore XXX_Root_CA_3.p12 -srcstoretype PKCS12 -srcstorepass your-p12-password -destkeystore my-truststore.jks -deststoretype JKS -deststorepass your-truststore-password

• your-p12-password为生成PKCS12文件时设置的密码（若未设置，直接回车即可）

二、配置WebClient使用自定义信任库 #

方式1：全局配置（所有HTTPS请求生效） #

在application.properties中添加以下配置：

# 信任库路径：若放在src/main/resources下，使用classpath:my-truststore.jks
server.ssl.trust-store=file:/absolute/path/to/my-truststore.jks
server.ssl.trust-store-password=your-truststore-password
server.ssl.trust-store-type=JKS

方式2：仅WebClient生效（推荐） #

自定义WebClient的SSL上下文，避免全局影响。结合你已有的WebClient代码，添加SSL配置：

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.ResourceLoader;
import org.springframework.http.client.reactive.ReactorClientHttpConnector;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.netty.http.client.HttpClient;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import java.io.InputStream;
import java.security.KeyStore;

@Configuration
public class WebClientConfig {

    private final ResourceLoader resourceLoader;

    public WebClientConfig(ResourceLoader resourceLoader) {
        this.resourceLoader = resourceLoader;
    }

    @Bean
    public WebClient webClient() throws Exception {
        // 加载自定义信任库
        KeyStore trustStore = KeyStore.getInstance("JKS");
        try (InputStream fis = resourceLoader.getResource("classpath:my-truststore.jks").getInputStream()) {
            trustStore.load(fis, "your-truststore-password".toCharArray());
        }

        // 初始化信任管理器工厂
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(trustStore);

        // 创建SSL上下文
        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustManagerFactory.getTrustManagers(), null);

        // 配置HttpClient使用自定义SSL上下文
        HttpClient httpClient = HttpClient.create().secure(sslSpec -> sslSpec.sslContext(sslContext));

        // 构建WebClient
        return WebClient.builder()
                .clientConnector(new ReactorClientHttpConnector(httpClient))
                // 后续添加OAuth2配置
                .build();
    }
}

三、OAuth2客户端认证配置 #

结合spring-security-oauth2-client依赖，配置WebClient自动获取OAuth2令牌：

1. 配置文件添加OAuth2参数 #

在application.properties中添加：

spring.security.oauth2.client.registration.xxx-oauth-client.client-id=your-client-id
spring.security.oauth2.client.registration.xxx-oauth-client.client-secret=your-client-secret
spring.security.oauth2.client.registration.xxx-oauth-client.authorization-grant-type=client_credentials
spring.security.oauth2.client.provider.xxx-oauth-provider.token-uri=https://your-oauth2-api/token

2. WebClient添加OAuth2拦截器 #

修改WebClientConfig，添加OAuth2授权管理器和拦截器：

import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizedClientManager;
import org.springframework.security.oauth2.client.web.OAuth2AuthorizedClientRepository;
import org.springframework.security.oauth2.client.web.reactive.function.client.ServletOAuth2AuthorizedClientExchangeFilterFunction;

// 新增Bean：OAuth2授权管理器
@Bean
public OAuth2AuthorizedClientManager authorizedClientManager(
        ClientRegistrationRepository clientRegistrationRepository,
        OAuth2AuthorizedClientRepository authorizedClientRepository) {
    OAuth2AuthorizedClientProvider provider = OAuth2AuthorizedClientProviderBuilder.builder()
            .clientCredentials()
            .build();
    DefaultOAuth2AuthorizedClientManager manager = new DefaultOAuth2AuthorizedClientManager(clientRegistrationRepository, authorizedClientRepository);
    manager.setAuthorizedClientProvider(provider);
    return manager;
}

// 修改webClient Bean，添加OAuth2拦截器
@Bean
public WebClient webClient(OAuth2AuthorizedClientManager authorizedClientManager) throws Exception {
    // 之前的SSL上下文配置...

    ServletOAuth2AuthorizedClientExchangeFilterFunction oauth2Filter =
            new ServletOAuth2AuthorizedClientExchangeFilterFunction(authorizedClientManager);
    oauth2Filter.setDefaultClientRegistrationId("xxx-oauth-client");

    return WebClient.builder()
            .clientConnector(new ReactorClientHttpConnector(httpClient))
            .apply(oauth2Filter.oauth2Configuration())
            .build();
}

关键注意事项 #

• 完整证书链：必须同时导入根CA和子CA证书，否则会出现“证书不信任”的HTTPS连接错误
• 密码安全：信任库密码和OAuth2客户端密钥不要硬编码，可使用Spring Boot配置加密或环境变量注入
• 测试验证：可使用openssl s_client -connect target-api-url:443查看目标API的证书链，确认导入的CA是否在链中

内容的提问来源于stack exchange，提问作者Syed Iftekharuddin