如何配置REST请求SSL以避免HttpClient检索IBM JDK中的证书

你在WebSphere中配置的动态SSL规则会由容器统一管理SSL上下文，只需让Apache HttpClient调用容器提供的SSL上下文实例，即可跳过JDK默认的证书检索逻辑，直接使用你配置的出站证书。

代码修改方案 #

直接修改原HttpClient构建逻辑，手动指定WebSphere容器管理的SSL上下文，修改后代码如下：

import com.ibm.websphere.ssl.SSLClientHelper;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.HttpHeaders;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.client.methods.CloseableHttpResponse;

// 构建HttpClient实例
CloseableHttpClient httpClient = null;
// 获取WebSphere容器管理的SSL上下文，已包含动态配置的出站证书
javax.net.ssl.SSLContext wsSslContext = SSLClientHelper.getSSLContext();
HttpClientBuilder builder = HttpClientBuilder
        .create()
        // 手动指定WebSphere提供的SSL上下文，跳过默认JDK证书检索
        .setSSLContext(wsSslContext)
        // 若WebSphere SSL配置已处理主机名校验可保留以下配置，否则可删除使用默认校验逻辑
        .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);

httpClient = builder.build();
HttpPost request = new HttpPost("https://test.org:8081/add");

// add request headers
request.addHeader("custom-key", "rev");
request.addHeader(HttpHeaders.USER_AGENT, "lebot");

CloseableHttpResponse response = httpClient.execute(request);

若使用WebSphere 8.5以下版本，可替换SSL上下文获取逻辑为com.ibm.ws.ssl.config.SSLConfigManager.getInstance().getSSLContext(null, null)

配套校验配置 #

• 确认WebSphere动态SSL配置的作用域覆盖当前应用部署的服务器/模块，目标地址test.org:8081已匹配你配置的出站SSL规则
• 应用类加载器策略设置为父类优先，确保优先加载WebSphere提供的SSL相关类，避免应用自带的JSSE实现覆盖容器逻辑
• 移除应用内所有手动指定keystore/truststore路径、密码的配置代码，避免优先级冲突覆盖容器SSL配置

内容的提问来源于stack exchange，提问作者works-mails