Spring WebFlux WebClient配置双向TLS时无法发送客户端证书报403如何解决

问题根源 #

你代码的核心问题是Reactor Netty的HttpClient是不可变设计，所有配置修改都会返回一个全新的HttpClient实例，你原有代码中没有接收httpClient.secure()方法的返回值，导致你写的mTLS配置完全没有生效，发起请求时用的还是默认无客户端证书的HttpClient实例，所以握手阶段无法提供客户端证书触发403错误。

修复方案 #

你可以直接复用之前已经验证过可以正常工作的sslContext()构建逻辑，同时修正HttpClient的配置写法即可：

private WebClient getMtlsWebClient() throws Exception {
  // 复用你原有WebServiceTemplate用过的、已验证可用的SSLContext构建逻辑
  SSLContext validSslContext = sslContext();

  // 必须接收secure方法返回的新HttpClient实例，配置才会生效
  HttpClient httpClient = HttpClient.create()
      .secure(spec -> spec.sslContext(
          SslContextBuilder.forClient()
              .sslContextProvider(validSslContext)
              .build()
      ));

  return WebClient
      .builder()
      .clientConnector(new ReactorClientHttpConnector(httpClient))
      .build();
}

如果你希望保留当前手写KeyManagerFactory的写法，只要修正HttpClient的配置写法即可：

private WebClient getMtlsWebClient() {
  // 链式调用所有配置方法，直接接收最终的HttpClient实例
  HttpClient httpClient = HttpClient.create()
      .secure(spec -> {
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        keyStore.load(new FileInputStream(ResourceUtils.getFile(keyStorePath)), keyStorePass.toCharArray());
        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, keyStorePass.toCharArray());
        spec.sslContext(SslContextBuilder.forClient()
            .keyManager(keyManagerFactory)
            .build());
      });

  return WebClient
      .builder()
      .clientConnector(new ReactorClientHttpConnector(httpClient))
      .build();
}

额外排查点 #

如果修改配置后仍然有问题，请确认你导入的SslContextBuilder是io.netty.handler.ssl.SslContextBuilder，不要误导入Apache HttpClient或其他包的同名类。

内容的提问来源于stack exchange，提问作者Marco