Java使用WebClient调用带JWT的REST服务报PKIX证书路径错误

该异常的核心原因是Java运行时使用独立的信任证书库（默认路径为jre/lib/security/cacerts），库中没有包含目标REST服务端SSL证书的信任链。Chrome、Postman等客户端默认使用操作系统级别的信任证书库，所以会出现两端调用表现不一致的情况。

方案1：将服务端证书导入Java信任库（生产环境推荐） #

• 导出服务端SSL证书：使用浏览器打开服务地址，点击地址栏的锁图标→「证书」→「详细信息」→「复制到文件」，选择Base64编码的X.509格式，保存为server.crt文件。
• 执行keytool命令导入证书到Java信任库，执行前替换为实际的JDK路径和证书文件路径：

keytool -import -alias custom-server-cert -file /path/to/server.crt -keystore $JAVA_HOME/jre/lib/security/cacerts

• 证书库默认密码为changeit，输入后确认信任证书即可，导入完成后重启Java应用生效。

方案2：自定义WebClient SSL配置跳过证书校验（仅测试环境使用，生产环境禁用） #

如果是本地测试场景，可临时配置WebClient信任所有证书规避校验，根据你使用的WebClient类型选择对应配置：

Apache CXF WebClient配置示例 #

import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.jaxrs.client.WebClient;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;

// 1. 构造信任所有证书的信任管理器
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
        public void checkClientTrusted(X509Certificate[] certs, String authType) {}
        public void checkServerTrusted(X509Certificate[] certs, String authType) {}
    }
};

// 2. 初始化SSL上下文
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());

// 3. 配置TLS参数
TLSClientParameters tlsParams = new TLSClientParameters();
tlsParams.setSSLSocketFactory(sslContext.getSocketFactory());
tlsParams.setDisableCNCheck(true); // 如需跳过域名校验可开启

// 4. 构造带自定义SSL配置的WebClient发起请求
WebClient client = WebClient.create("你的请求URL");
WebClient.getConfig(client).getHttpConduit().setTlsClientParameters(tlsParams);
Response response = client.accept(MediaType.TEXT_PLAIN)
    .header(HttpHeaders.AUTHORIZATION, "Bearer " + jwtToken)
    .header(HttpHeaders.CONTENT_TYPE, "application/json")
    .get();

Spring WebClient配置示例 #

import org.springframework.http.client.reactive.ReactorClientHttpConnector;
import org.springframework.web.reactive.function.client.WebClient;
import reactor.netty.http.client.HttpClient;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;

// 1. 构造信任所有证书的信任管理器
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
        public void checkClientTrusted(X509Certificate[] certs, String authType) {}
        public void checkServerTrusted(X509Certificate[] certs, String authType) {}
    }
};

// 2. 初始化SSL上下文
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());

// 3. 配置HttpClient跳过SSL校验
HttpClient httpClient = HttpClient.create()
    .secure(sslSpec -> sslSpec.sslContext(sslContext).disableHostnameVerification(true));

// 4. 构造WebClient发起请求
WebClient webClient = WebClient.builder()
    .clientConnector(new ReactorClientHttpConnector(httpClient))
    .baseUrl("你的请求URL")
    .build();
Response response = webClient.get()
    .accept(MediaType.TEXT_PLAIN)
    .header(HttpHeaders.AUTHORIZATION, "Bearer " + jwtToken)
    .header(HttpHeaders.CONTENT_TYPE, "application/json")
    .retrieve()
    .bodyToMono(Response.class)
    .block();

注意：方案2存在严重的安全风险，仅可用于本地开发测试场景，生产环境必须使用方案1导入合法证书的方式处理。

内容的提问来源于stack exchange，提问作者Parameswar