Spring RestTemplate调用HTTPS接口遇PKIX路径构建失败求助

Hey there! Let's tackle this PKIX path issue you're hitting. Even though the third party said you don't need a certificate/keystore, the error tells us your JVM is still trying to validate their SSL certificate against its default trust store—and failing because the cert isn't trusted (it's probably self-signed or issued by a private CA).

First, Let's Check Your Existing CustomRequestFactory #

Chances are your current implementation is missing a piece or two. Here are the common gaps:

• You didn't fully disable certificate chain validation (your TrustManager isn't set to accept all certs)
• You forgot to turn off hostname verification (if the cert's common name doesn't match the URL domain, this will still trigger an error)
• You didn't properly assign the custom factory to your RestTemplate instance

A Complete Working CustomRequestFactory (For Testing/Dev) #

If you need to bypass SSL validation temporarily (never do this in production), here's a full implementation that covers all bases:

import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustAllStrategy;
import org.apache.http.ssl.SSLContexts;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;

import javax.net.ssl.SSLContext;
import java.security.KeyManagementException;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;

public class CustomHttpsRequestFactory extends HttpComponentsClientHttpRequestFactory {

    public CustomHttpsRequestFactory() throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException {
        super(createHttpClient());
    }

    private static CloseableHttpClient createHttpClient() throws NoSuchAlgorithmException, KeyManagementException, KeyStoreException {
        // Create SSL context that trusts all certificates
        SSLContext sslContext = SSLContexts.custom()
                .loadTrustMaterial(null, TrustAllStrategy.INSTANCE)
                .build();

        // Create socket factory that accepts all hostnames
        SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
                sslContext,
                NoopHostnameVerifier.INSTANCE);

        // Build and return the HTTP client
        return HttpClients.custom()
                .setSSLSocketFactory(sslSocketFactory)
                .build();
    }
}

Then assign it to your RestTemplate:

RestTemplate restTemplate = new RestTemplate();
try {
    restTemplate.setRequestFactory(new CustomHttpsRequestFactory());
} catch (Exception e) {
    // Handle initialization errors
    e.printStackTrace();
}

A Safer Production-Friendly Alternative #

Bypassing SSL validation is a huge security risk. Instead, add the third party's certificate to your JVM's trust store or a custom trust store:

1. Import the certificate to JVM cacerts (default trust store):

   keytool -import -alias third-party-cert -file /path/to/certificate.crt -keystore $JAVA_HOME/jre/lib/security/cacerts
   

   (The default password for cacerts is changeit)

2. Or use a custom trust store in your RestTemplate:
   Create an SSLContext that uses your custom trust store, then build the RequestFactory with it. Here's a quick snippet:

   SSLContext sslContext = SSLContexts.custom()
           .loadTrustMaterial(new File("/path/to/custom-truststore.jks"), "truststore-password".toCharArray())
           .build();
   
   SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext);
   CloseableHttpClient httpClient = HttpClients.custom()
           .setSSLSocketFactory(sslSocketFactory)
           .build();
   
   restTemplate.setRequestFactory(new HttpComponentsClientHttpRequestFactory(httpClient));
   

Quick Troubleshooting Checks #

• Double-check that you're actually using the custom RequestFactory (it's easy to forget the setRequestFactory call!)
• If you're using Spring Boot, make sure your RestTemplate bean is properly configured with the factory
• Verify that the third party's certificate is indeed valid (sometimes they might have an expired or misconfigured cert even if they say it's fine)

内容的提问来源于stack exchange，提问作者Marcelo Tataje