Apache Camel HttpClient在IBM Java 8下强制使用TLSv1.2的方法咨询

针对Spring Boot集成Camel 3.14、IBM Java 8环境下出现的SSL握手失败（远端拒绝TLSv1协议）问题，可通过以下方式强制Camel使用TLSv1.2：

1. 全局自定义HttpClient配置 #

创建配置类，生成指定TLSv1.2的HttpClient并绑定到Camel的HTTP组件，让所有HTTP端点共用该配置：

import org.apache.camel.component.http.HttpComponent;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContexts;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.net.ssl.SSLContext;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;

@Configuration
public class CamelHttpClientConfig {

    @Bean
    public HttpComponent httpComponent() throws NoSuchAlgorithmException, KeyManagementException {
        // 构建仅支持TLSv1.2的SSLContext
        SSLContext sslContext = SSLContexts.custom()
                .useProtocol("TLSv1.2")
                .build();

        // 创建指定TLSv1.2的SocketFactory
        SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
                sslContext,
                new String[]{"TLSv1.2"},
                null,
                SSLConnectionSocketFactory.getDefaultHostnameVerifier()
        );

        // 生成自定义HttpClient
        CloseableHttpClient httpClient = HttpClients.custom()
                .setSSLSocketFactory(sslSocketFactory)
                .build();

        // 配置Camel HTTP组件使用该HttpClient
        HttpComponent httpComponent = new HttpComponent();
        httpComponent.setHttpClient(httpClient);
        return httpComponent;
    }
}

2. 针对单个端点配置SSL参数 #

如果不需要全局生效，可创建自定义SSLContextParameters Bean，然后在目标端点中引用：

第一步：创建SSL配置Bean #

import org.apache.camel.support.jsse.SSLContextParameters;
import org.apache.camel.support.jsse.SSLContextClientParameters;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class CamelSSLConfig {

    @Bean(name = "tls12SslContext")
    public SSLContextParameters tls12SslContext() {
        SSLContextParameters sslContextParams = new SSLContextParameters();
        SSLContextClientParameters clientParams = new SSLContextClientParameters();
        // 指定客户端使用TLSv1.2协议
        clientParams.setSecureSocketProtocol("TLSv1.2");
        sslContextParams.setClientParameters(clientParams);
        return sslContextParams;
    }
}

第二步：修改端点配置 #

在调用端点时添加sslContextParameters参数引用上述Bean：

.to("endpoint?bridgeEndpoint=true&okStatusCodeRange=200-310,400-501&sslContextParameters=#tls12SslContext")

3. 修正IBM Java的VM参数 #

IBM Java的JSSE配置有专属参数，之前的配置可能存在遗漏，确保添加以下VM参数：

-Dcom.ibm.jsse2.overrideDefaultTLS=true
-Dcom.ibm.jsse2.protocolVersion=TLSv12
-Dhttps.protocols=TLSv1.2
-Djdk.tls.client.protocols=TLSv1.2

注意com.ibm.jsse2.protocolVersion的值是TLSv12（不带点），这是IBM Java特有的配置项。

以上方案结合使用，即可强制Camel的SSLConnectionSocketFactory使用TLSv1.2完成握手。

内容的提问来源于stack exchange，提问作者normalindon1