如何让Apache HTTPClient 4.5.2复用WebSphere 8.5的SSL配置与证书？

Absolutely feasible! WebSphere Application Server (WAS) 8.5 provides native mechanisms to let Apache HttpClient 4.5.2 leverage its built-in SSL configuration, truststore, and keystore certificates. This means you won’t have to manage separate SSL settings for your EAR and OSGi bundle REST consumer projects. Below’s a step-by-step breakdown for both project types:

WAS maintains its own SSLContext that encapsulates all configured SSL settings (truststores, keystores, protocols, etc.). The trick is to have HttpClient use this preconfigured SSLContext instead of its default one.

Step 1: Fetch WAS's SSLContext and Build HttpClient #

Use WAS's SSLContextHelper class to retrieve the default SSL context, then pass it to HttpClient's SSLConnectionSocketFactory:

import com.ibm.websphere.ssl.SSLContextHelper;
import javax.net.ssl.SSLContext;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;

public class EarRestClient {
    public CloseableHttpClient createWASIntegratedClient() throws Exception {
        // Pull the default SSL context configured in WAS
        SSLContext wasSslContext = SSLContextHelper.getDefaultSSLContext();
        
        // Create a socket factory using WAS's SSL context
        SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
            wasSslContext,
            SSLConnectionSocketFactory.getDefaultHostnameVerifier()
        );
        
        // Build the HttpClient with this socket factory
        return HttpClients.custom()
            .setSSLSocketFactory(sslSocketFactory)
            .build();
    }
}

This code automatically uses all SSL settings you’ve configured in the WAS console (truststores, keystores, protocols, etc.).

Step 2: Prerequisite: Configure WAS SSL Settings #

Before testing, make sure you’ve set up the necessary SSL configurations in the WAS admin console:

• Define SSL aliases (e.g., DefaultSSLSettings)
• Assign truststores (like CellDefaultTrustStore) and keystores (if client certificate auth is required)
• Set preferred SSL protocols (e.g., TLS 1.2)

OSGi has unique class loading rules, so you’ll need to adjust for that:

Step 1: Declare Dependencies in MANIFEST.MF #

Add these imports to your bundle’s MANIFEST.MF to access WAS SSL classes and HttpClient libraries:

Import-Package: com.ibm.websphere.ssl,
 javax.net.ssl,
 org.apache.http.conn.ssl,
 org.apache.http.impl.client,
 org.apache.http.client

This ensures your bundle can load the required classes from WAS’s system bundles and HttpClient packages.

Step 2: Build the WAS-Aware HttpClient #

The code is similar to the EAR project, but you need to ensure class loading works correctly. Here’s a sample:

import com.ibm.websphere.ssl.SSLContextHelper;
import javax.net.ssl.SSLContext;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;

public class OsgiRestClient {
    public CloseableHttpClient createWASIntegratedClient() throws Exception {
        SSLContext wasSslContext = SSLContextHelper.getDefaultSSLContext();
        
        SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
            wasSslContext,
            // Use default hostname verifier if WAS enforces host validation; adjust if needed
            SSLConnectionSocketFactory.getDefaultHostnameVerifier()
        );
        
        return HttpClients.custom()
            .setSSLSocketFactory(sslSocketFactory)
            .build();
    }
}

If you run into ClassNotFoundException issues, check that your bundle’s classpath includes the required WAS and HttpClient packages, or use the OSGi BundleContext to explicitly load classes if necessary.

• Client Certificate Auth: If your target REST service requires client-side certificates, ensure the corresponding keystore is configured in WAS’s SSL settings. The SSLContextHelper will automatically pick up these certificates.
• Protocol Compatibility: WAS 8.5 defaults to TLS 1.0/1.1, but you can enable TLS 1.2 via the admin console. HttpClient 4.5.2 supports these protocols, but avoid overriding protocol settings that conflict with WAS’s configuration.
• Debugging: Enable SSL tracing in WAS (set com.ibm.ws.ssl.*=all in trace settings) to verify that HttpClient is using WAS’s SSL configurations and certificates.

内容的提问来源于stack exchange，提问作者makemehappy