如何在Java Function App中读取TLS/SSL证书发起HTTPS请求

前置准备 #

首先确认已完成以下配置操作：

• 已将目标HTTPS端点的公钥证书上传至Function App控制台的TLS/SSL配置-「公钥证书」板块
• 已在Function App的「配置」-「应用设置」中添加配置项WEBSITE_LOAD_CERTIFICATES，值设置为对应上传证书的SHA-1指纹（多个证书用英文逗号分隔，填*则加载所有已上传的公钥证书）

实现步骤 #

核心逻辑说明 #

Java 11原生HttpClient默认使用JDK自带的信任库校验证书，我们只需手动读取Function App加载到系统环境中的自定义证书，构造专属SSLContext传入HttpClient即可完成信任配置。

完整代码示例 #

import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import java.io.ByteArrayInputStream;
import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.security.KeyStore;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.Base64;

public class HttpsRequestUtil {

    /**
     * 构造信任自定义证书的HttpClient
     */
    public HttpClient getCustomSslHttpClient() throws Exception {
        // 1. 读取系统环境中的证书，环境变量命名规则：WEBSITE_LOAD_ROOT_CERTIFICATE_<证书SHA1指纹全大写，无冒号等分隔符>
        String certBase64Content = System.getenv("WEBSITE_LOAD_ROOT_CERTIFICATE_<替换为你的证书SHA1指纹全大写无分隔符>");
        byte[] certBinary = Base64.getDecoder().decode(certBase64Content);
        X509Certificate trustedCert = (X509Certificate) CertificateFactory.getInstance("X.509")
                .generateCertificate(new ByteArrayInputStream(certBinary));

        // 2. 构造自定义信任库
        KeyStore customTrustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        customTrustStore.load(null, null);
        customTrustStore.setCertificateEntry("targetEndpointCert", trustedCert);

        // 3. 初始化自定义SSLContext
        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustManagerFactory.init(customTrustStore);
        SSLContext customSslContext = SSLContext.getInstance("TLS");
        customSslContext.init(null, trustManagerFactory.getTrustManagers(), null);

        // 4. 返回绑定自定义SSL配置的HttpClient
        return HttpClient.newBuilder()
                .sslContext(customSslContext)
                .build();
    }

    // 调用示例
    public void executeRequest() throws Exception {
        HttpClient httpClient = getCustomSslHttpClient();
        HttpRequest request = HttpRequest.newBuilder()
                .uri(URI.create("https://替换为你的目标HTTPS请求地址"))
                .GET()
                .build();
        HttpResponse<String> response = httpClient.send(request, HttpResponse.BodyHandlers.ofString());
        // 处理响应逻辑
        System.out.println("请求响应状态码：" + response.statusCode());
        System.out.println("请求返回内容：" + response.body());
    }
}

异常排查 #

• 若提示找不到证书环境变量，请确认WEBSITE_LOAD_CERTIFICATES配置的指纹和上传证书的SHA1指纹完全一致，且配置已保存生效
• 若仍提示证书不受信任，请确认上传的证书是目标HTTPS端点对应的完整根证书/中间证书链，证书格式为标准DER编码的.cer格式

内容的提问来源于stack exchange，提问作者Jasmine