Java7环境下OkHttp调用PeopleSoft SOAP服务报Connection reset如何解决

核心根因 #

• JDK7 默认最高支持TLS 1.0协议，且默认不主动启用TLS 1.2，当前绝大多数PeopleSoft服务端已禁用低版本TLS协议，仅接受TLS 1.2及以上请求，协议不匹配直接触发SSL握手阶段连接重置
• 低版本JDK7更新包（低于update 111）存在TLS 1.2启用逻辑缺陷，手动配置也无法正常生效
• 部分场景下JDK7内置信任库缺少PeopleSoft服务端的自签名证书，导致握手被主动断开

分步解决操作 #

1. 升级JDK7小版本 #

首先将使用的JDK7升级到7u131及以上的最终兼容版本，修复内置SSL实现的已知TLS兼容bug。

2. 自定义TLS 1.2套接字工厂 #

强制OkHttp请求使用TLS 1.2协议，自定义套接字工厂实现如下：

import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;

public class TLS12SocketFactory extends SSLSocketFactory {
    private final SSLSocketFactory delegate;

    public TLS12SocketFactory(SSLSocketFactory delegate) {
        this.delegate = delegate;
    }

    @Override
    public String[] getDefaultCipherSuites() {
        return delegate.getDefaultCipherSuites();
    }

    @Override
    public String[] getSupportedCipherSuites() {
        return delegate.getSupportedCipherSuites();
    }

    @Override
    public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {
        return enableTLS12(delegate.createSocket(s, host, port, autoClose));
    }

    @Override
    public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
        return enableTLS12(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException {
        return enableTLS12(delegate.createSocket(host, port, localHost, localPort));
    }

    @Override
    public Socket createSocket(InetAddress host, int port) throws IOException {
        return enableTLS12(delegate.createSocket(host, port));
    }

    @Override
    public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {
        return enableTLS12(delegate.createSocket(address, port, localAddress, localPort));
    }

    private Socket enableTLS12(Socket socket) {
        if (socket instanceof SSLSocket) {
            ((SSLSocket) socket).setEnabledProtocols(new String[]{"TLSv1.2"});
        }
        return socket;
    }
}

3. 注入自定义配置到OkHttp客户端 #

OkHttp 3.x配置示例（兼容3.9.0版本）

import okhttp3.OkHttpClient;
import javax.net.ssl.*;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;

// 生产环境建议替换为正式的证书信任逻辑，避免跳过校验带来的安全风险
SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, new TrustManager[]{new X509TrustManager() {
    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) {}
    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) {}
    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
}}, new SecureRandom());

OkHttpClient client = new OkHttpClient.Builder()
        .sslSocketFactory(new TLS12SocketFactory(sslContext.getSocketFactory()))
        .hostnameVerifier((hostname, session) -> true) // 生产环境替换为严格域名校验
        .build();

OkHttp 2.x配置示例（兼容2.7.5版本）

import com.squareup.okhttp.OkHttpClient;
import javax.net.ssl.*;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;

SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
sslContext.init(null, new TrustManager[]{new X509TrustManager() {
    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) {}
    @Override
    public void checkServerTrusted(X509Certificate[] chain, String authType) {}
    @Override
    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[0];
    }
}}, new SecureRandom());

OkHttpClient client = new OkHttpClient();
client.setSslSocketFactory(new TLS12SocketFactory(sslContext.getSocketFactory()));
client.setHostnameVerifier((hostname, session) -> true);

4. 新增JVM启动参数 #

启动服务时添加参数-Dhttps.protocols=TLSv1.2，强制JVM全局HTTPS请求优先使用TLS 1.2协议，避免默认配置覆盖自定义设置。

5. 导入自签名证书（可选，针对内部自签名证书场景） #

如果PeopleSoft服务端使用自签名证书，将证书导入JDK7信任库：

keytool -import -alias peoplesoft -file 你的证书路径.cer -keystore $JAVA_HOME/jre/lib/security/cacerts

默认密钥库密码为changeit。

注意事项 #

• 确认使用的OkHttp版本属于Java7兼容分支：OkHttp 2.x全分支、OkHttp 3.0.x~3.12.x分支，高于3.12的版本已移除Java7支持，会出现类加载异常。

内容的提问来源于stack exchange，提问作者Ricardo Álvarez