SpringBoot集成Keycloak AuthzClient报SSL证书路径验证失败问题

你遇到的PKIX path building failed错误本质是Keycloak 18.0.0版本的AuthzClient内置Apache HttpComponents 4.x客户端发起请求时，不信任Keycloak服务端返回的TLS证书链。此前导入JDK cacerts、配置AuthzClient truststore不生效的核心原因包括：

• AuthzClient不读取SpringBoot全局SSL配置，也不会自动复用Spring上下文中RestTemplate的SSL规则
• 导入证书的JDK实例与应用实际运行的JDK不一致（常见于IDE内置JDK、容器内独立JDK场景）
• 仅在配置文件中指定truststore路径，但未将加载后的信任库主动绑定到AuthzClient使用的HttpClient连接工厂，配置未实际生效
• 导入的证书不完整，缺少中间CA或根CA证书，无法构建完整信任链

该方案会完全跳过证书校验与主机名校验，存在中间人攻击风险，仅可用于本地调试。

import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.keycloak.authorization.client.AuthzClient;
import org.keycloak.authorization.client.Configuration;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;
import java.util.HashMap;
import java.util.Map;

// 构建信任所有证书的信任管理器
X509TrustManager trustAllCertsManager = new X509TrustManager() {
    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) {}
    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) {}
    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
};

SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, new TrustManager[]{trustAllCertsManager}, new java.security.SecureRandom());

// 构建跳过主机名校验的SSL连接工厂
SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
        sslContext,
        NoopHostnameVerifier.INSTANCE
);

// 组装自定义HttpClient
CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLSocketFactory(sslSocketFactory)
        .build();

// 初始化AuthzClient配置
Map<String, Object> clientCredentials = new HashMap<>();
clientCredentials.put("secret", "替换为你的OIDC客户端密钥");
Configuration authzConfig = new Configuration(
        "https://atcom-cc/auth/realms/atcom",
        "替换为你的OIDC客户端ID",
        clientCredentials,
        httpClient
);

// 实例化客户端，此时会跳过SSL校验拉取uma2-configuration
AuthzClient authzClient = AuthzClient.create(authzConfig);

该方案保留SSL校验逻辑，将自有CA证书绑定到AuthzClient的信任链中，无安全风险。

• 先排查JDK一致性问题：应用启动时添加VM参数-verbose:class，从启动日志中确认实际加载的JDK路径，将自有CA根证书（含完整中间CA链）导入到该JDK的lib/security/cacerts文件中，cacerts默认密码为changeit。可通过以下命令验证证书是否导入成功：

  keytool -list -keystore $JAVA_HOME/lib/security/cacerts -storepass changeit | grep 你的CA证书别名
  

• 如果需要使用独立truststore不依赖JDK全局配置，通过以下代码加载信任库并绑定到HttpClient：

  import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
  import org.apache.http.impl.client.CloseableHttpClient;
  import org.apache.http.impl.client.HttpClients;
  import org.apache.http.ssl.SSLContexts;
  import org.keycloak.authorization.client.AuthzClient;
  import org.keycloak.authorization.client.Configuration;
  import javax.net.ssl.SSLContext;
  import java.io.File;
  import java.util.HashMap;
  import java.util.Map;
  
  // 加载自定义truststore，支持jks/pkcs12格式
  SSLContext sslContext = SSLContexts.custom()
          .loadTrustMaterial(
                  new File("替换为truststore文件的绝对路径"),
                  "替换为truststore密码".toCharArray()
          )
          .build();
  
  SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext);
  CloseableHttpClient httpClient = HttpClients.custom()
          .setSSLSocketFactory(sslSocketFactory)
          .build();
  
  // 后续组装配置、创建AuthzClient逻辑同方案1
  Map<String, Object> clientCredentials = new HashMap<>();
  clientCredentials.put("secret", "替换为你的OIDC客户端密钥");
  Configuration authzConfig = new Configuration(
          "https://atcom-cc/auth/realms/atcom",
          "替换为你的OIDC客户端ID",
          clientCredentials,
          httpClient
  );
  AuthzClient authzClient = AuthzClient.create(authzConfig);
  

配置注意事项 #

• truststore中必须导入完整CA证书链，仅导入Keycloak服务端叶子证书仍会报信任路径构建失败
• 如果truststore存放在SpringBoot resources目录下，不要直接用文件系统路径读取，要通过类加载器获取输入流后加载，避免打包后路径失效
• 如果使用keycloak.json配置文件初始化客户端，不要直接调用无参AuthzClient.create()方法，需先读取配置、注入自定义HttpClient后再实例化，否则配置文件中的truststore参数不会被HttpClient识别。

内容的提问来源于stack exchange，提问作者frisky5