Helidon MP：如何禁用SSL证书验证？

关于server.ssl.trustAll/server.trust-all的说明 #

这两个配置是Helidon作为服务端时的SSL设置，作用是让Helidon自身服务信任所有客户端证书，和你当前作为客户端调用外部HTTPS服务的场景不相关，无法解决你的问题。

客户端禁用SSL证书验证的方法 #

Helidon SE 实现方式 #

通过自定义WebClient的SSL上下文，跳过证书验证：

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;
import io.helidon.webclient.WebClient;

// 创建信任所有证书的TrustManager
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }

        @Override
        public void checkClientTrusted(X509Certificate[] certs, String authType) {}

        @Override
        public void checkServerTrusted(X509Certificate[] certs, String authType) {}
    }
};

// 构建信任所有的SSL上下文
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustAllCerts, new SecureRandom());

// 配置并创建WebClient
WebClient client = WebClient.builder()
        .sslContext(sslContext)
        .build();

// 使用客户端发起请求
client.get()
        .uri("https://目标服务器地址")
        .submit()
        .await();

Helidon MP 实现方式 #

针对MicroProfile Rest Client，通过自定义SSL上下文来跳过验证：

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.net.URI;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;
import jakarta.ws.rs.core.Response;
import org.eclipse.microprofile.rest.client.RestClientBuilder;
import org.eclipse.microprofile.rest.client.inject.RegisterRestClient;

// 定义Rest Client接口
@RegisterRestClient(baseUri = "https://目标服务器地址")
public interface TargetServiceClient {
    @GET
    Response fetchData();
}

// 创建客户端并配置SSL上下文
public class ClientExample {
    public static void main(String[] args) throws Exception {
        TargetServiceClient client = RestClientBuilder.newBuilder()
                .baseUri(URI.create("https://目标服务器地址"))
                .sslContext(createTrustAllSslContext())
                .build(TargetServiceClient.class);
        
        Response response = client.fetchData();
        // 处理响应
    }

    private static SSLContext createTrustAllSslContext() throws Exception {
        TrustManager[] trustAllCerts = new TrustManager[]{
            new X509TrustManager() {
                @Override
                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }

                @Override
                public void checkClientTrusted(X509Certificate[] certs, String authType) {}

                @Override
                public void checkServerTrusted(X509Certificate[] certs, String authType) {}
            }
        };

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustAllCerts, new SecureRandom());
        return sslContext;
    }
}

注意事项 #

• 禁用SSL证书验证仅限测试环境使用，生产环境必须将目标服务器的合法证书导入到Helidon的信任库中（比如通过keytool导入到JVM默认的cacerts文件，或者配置Helidon使用自定义信任库），否则会带来严重的安全风险。

内容的提问来源于stack exchange，提问作者Newbie