切换为阻塞HTTP/HTTPS后，如何在WSO2 API Manager中访问客户端证书？

你已经找对了核心方向——切换到阻塞HTTP/HTTPS传输来获取HttpServletRequest对象，接下来我帮你补全剩余的配置步骤和证书获取逻辑：

1. 完成剩余配置修改 #

你已经修改了axis.xml和catalina-server.xml，还需要补充以下关键配置：

a. 确认axis.xml的阻塞传输配置 #

在axis.xml中，确保完全启用阻塞式HTTP/HTTPS传输接收器和发送器，并禁用NIO/PTT相关传输：

<!-- 替换NIO HTTP接收器为阻塞实现 -->
<transportReceiver name="http" class="org.apache.synapse.transport.http.HttpCoreListener">
  <parameter name="port" locked="false">8280</parameter>
</transportReceiver>

<!-- 替换NIO HTTPS接收器为阻塞实现，并开启客户端证书验证 -->
<transportReceiver name="https" class="org.apache.synapse.transport.http.HttpCoreSSLListener">
  <parameter name="port" locked="false">8243</parameter>
  <!-- 保留原有密钥库配置 -->
  <parameter name="keystore" locked="false">
    <KeyStore>
      <Location>${carbon.home}/repository/resources/security/wso2carbon.jks</Location>
      <Type>JKS</Type>
      <Password>wso2carbon</Password>
      <KeyPassword>wso2carbon</KeyPassword>
    </KeyStore>
  </parameter>
  <!-- 配置信任库用于验证客户端证书 -->
  <parameter name="truststore" locked="false">
    <TrustStore>
      <Location>${carbon.home}/repository/resources/security/client-truststore.jks</Location>
      <Type>JKS</Type>
      <Password>wso2carbon</Password>
    </TrustStore>
  </parameter>
  <parameter name="SSLVerifyClient">require</parameter> <!-- 强制验证客户端证书，可选want为非强制 -->
</transportReceiver>

<!-- 替换NIO发送器为阻塞实现 -->
<transportSender name="http" class="org.apache.synapse.transport.http.HttpCoreSender"/>
<transportSender name="https" class="org.apache.synapse.transport.http.HttpCoreSSLSender"/>

b. 完善catalina-server.xml的HTTPS Connector配置 #

确保Connector开启客户端证书验证，协议设置为阻塞式：

<Connector protocol="org.apache.coyote.http11.Http11Protocol"
           port="9443"
           SSLEnabled="true"
           scheme="https"
           secure="true"
           clientAuth="true" <!-- true为强制验证，want为可选 -->
           sslProtocol="TLS"
           keystoreFile="${carbon.home}/repository/resources/security/wso2carbon.jks"
           keystorePass="wso2carbon"
           truststoreFile="${carbon.home}/repository/resources/security/client-truststore.jks"
           truststorePass="wso2carbon"/>

2. 在API中获取客户端证书 #

切换到阻塞传输后，你可以通过两种方式获取客户端证书：

a. 使用自定义中介（Mediator） #

在API的入站中介流中添加类中介，从HttpServletRequest提取证书：

import org.apache.synapse.MessageContext;
import org.apache.synapse.core.axis2.Axis2MessageContext;
import org.apache.axis2.context.MessageContext;
import javax.servlet.http.HttpServletRequest;
import java.security.cert.X509Certificate;

public class ClientCertExtractorMediator {
    public boolean mediate(MessageContext synCtx) {
        org.apache.axis2.context.MessageContext axis2Ctx = 
            ((Axis2MessageContext) synCtx).getAxis2MessageContext();
        HttpServletRequest request = (HttpServletRequest) axis2Ctx.getProperty("HTTP_REQUEST");
        
        if (request != null) {
            X509Certificate[] certs = (X509Certificate[]) 
                request.getAttribute("javax.servlet.request.X509Certificate");
            if (certs != null && certs.length > 0) {
                X509Certificate clientCert = certs[0];
                // 提取证书信息，比如DN
                String clientDN = clientCert.getSubjectDN().getName();
                synCtx.setProperty("CLIENT_CERT_DN", clientDN);
                // 后续可以根据证书做权限验证等逻辑
            }
        }
        return true;
    }
}

b. 使用自定义Handler（处理程序） #

如果需要在API处理更早阶段获取证书，可以编写自定义Handler：

import org.apache.axis2.AxisFault;
import org.apache.axis2.context.MessageContext;
import org.apache.axis2.handlers.AbstractHandler;
import javax.servlet.http.HttpServletRequest;
import java.security.cert.X509Certificate;

public class ClientCertHandler extends AbstractHandler {
    @Override
    public InvocationResponse invoke(MessageContext msgCtx) throws AxisFault {
        HttpServletRequest request = (HttpServletRequest) msgCtx.getProperty("HTTP_REQUEST");
        if (request != null) {
            X509Certificate[] certs = (X509Certificate[]) 
                request.getAttribute("javax.servlet.request.X509Certificate");
            if (certs != null && certs.length > 0) {
                msgCtx.setProperty("CLIENT_CERT", certs[0]);
            }
        }
        return InvocationResponse.CONTINUE;
    }
}

之后在axis2.xml中注册该Handler，或者在API配置中直接引用。

3. 验证配置有效性 #

重启WSO2 APIM后，用带客户端证书的请求测试API：

curl -X GET https://<APIM_HOST>:8243/<API_CONTEXT>/<API_VERSION> \
  --cert /path/to/client-cert.pem \
  --key /path/to/client-key.pem \
  --cacert /path/to/apim-truststore.pem

如果配置正确，你会在日志中看到客户端证书的相关信息，或者在中介/Handler中成功获取到证书对象。

内容的提问来源于stack exchange，提问作者ulab