Node.js调用HTTPS WSDL遇443端口封禁，如何绕过SSL检查换端口？

Let's break down how to fix both your port blocking issue and SSL validation problem, with practical steps for common development scenarios:

1. Avoid Port 443 First #

Your core roadblock is outbound requests on port 443 getting intercepted. Here are two reliable workarounds:

Option A: Use a Vendor-Provided Alternative Port #

First, circle back to the gateway vendor to confirm if they host the same WSDL service on a non-443 SSL port (common alternatives include 8443, 9443, or even 8080 for SSL-enabled endpoints). If available, simply update your WSDL URL to include this port:

https://example.com:8443/TokenService?wsdl

This is the cleanest solution—no extra setup required if the vendor supports it.

Option B: Set Up a Local Reverse Proxy #

If the vendor only offers port 443, use a local proxy to redirect your non-443 requests to the vendor's 443 endpoint. Here's how to do this with Nginx:

1. Install Nginx on your local machine or a controlled server.
2. Add this configuration to your Nginx config file:

server {
    listen 8081; # Pick any non-443 port you have access to

    location /TokenService {
        proxy_pass https://example.com/TokenService;
        proxy_set_header Host example.com;
        proxy_ssl_server_name on;
    }
}

3. Restart Nginx. Now you can access the WSDL via your local proxy port:

http://localhost:8081/TokenService?wsdl

(If you need SSL for the local proxy, configure Nginx with a self-signed certificate and use https://localhost:8081 instead.)

2. Bypass SSL Validation #

Once you've switched to a non-443 port, you'll need to disable SSL certificate checks (whether for a proxy's self-signed cert, custom port setup, or vendor's untrusted cert). Here's how to do this in popular SOAP clients:

For Node.js (using soap library) #

Add the rejectUnauthorized: false option when creating the client:

const soap = require('soap');

const proxyUrl = 'http://localhost:8081/TokenService?wsdl';
soap.createClient(proxyUrl, {
    rejectUnauthorized: false
}, (err, client) => {
    if (err) {
        console.error(err);
        return;
    }
    // Use your client object to call service methods here
});

For Python (using zeep library) #

Pass verify=False when initializing the client:

from zeep import Client

client = Client('http://localhost:8081/TokenService?wsdl', verify=False)
# Proceed with service calls using the client

For Java (using Axis2) #

Create a custom TrustManager that accepts all certificates:

import org.apache.axis2.client.ServiceClient;
import javax.net.ssl.*;
import java.security.cert.X509Certificate;

// Trust manager that skips certificate validation
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() { return null; }
        public void checkClientTrusted(X509Certificate[] certs, String authType) {}
        public void checkServerTrusted(X509Certificate[] certs, String authType) {}
    }
};

// Install the trust manager
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new java.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

// Disable hostname verification
HttpsURLConnection.setDefaultHostnameVerifier((hostname, session) -> true);

// Initialize your Axis2 client with the proxy/alternate port URL
ServiceClient client = new ServiceClient();
// Configure client endpoint and methods as needed

3. Fix the "Invalid WSDL URL" Error #

The error referencing ?wsdlxsd=1 means your SOAP client is automatically fetching associated XSD schema files from the WSDL. If using a proxy, the Nginx config above will handle this by proxying the entire /TokenService path. If you're using an alternate port directly, ask the vendor to provide a WSDL with updated XSD port references, or use tools like wsdl2java with a custom URL rewrite to adjust internal schema links.

内容的提问来源于stack exchange，提问作者Fazel Najariyan