如何让Feign Client使用自定义信任库且不覆盖默认信任库

遇到这种既要对接自签名证书的服务器，又不能影响应用内其他标准CA认证请求的场景太常见了，下面给你几个无需依赖全局javax.net.ssl.trustStore系统属性的实现方案：

方案一：为特定Feign Client单独配置自定义HttpClient（推荐） #

这个方案的核心是给需要访问自签名证书服务的Feign Client单独绑定一个带有自定义SSL配置的HttpClient，完全不影响其他Feign Client的默认行为。

步骤1：加载自定义信任库并创建SSLContext #

首先写一个工具方法来加载你的自定义信任库，生成专属的SSL上下文：

private SSLContext createCustomSslContext() throws Exception {
    // 初始化自定义信任库
    KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
    // 替换为你的信任库路径和密码，建议用配置文件注入，不要硬编码
    try (InputStream trustStoreStream = new FileInputStream("/path/to/your/custom-truststore.jks")) {
        trustStore.load(trustStoreStream, "your-truststore-password".toCharArray());
    }

    // 构建信任管理器工厂
    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    trustManagerFactory.init(trustStore);

    // 创建并初始化SSLContext
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());
    return sslContext;
}

步骤2：配置自定义HttpClient #

以Apache HttpClient为例，把上面的SSLContext绑定到HttpClient：

@Bean
public HttpClient customSelfSignedHttpClient() throws Exception {
    SSLContext sslContext = createCustomSslContext();
    SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext);
    
    // 注册HTTP和HTTPS的Socket工厂
    Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
            .register("https", sslSocketFactory)
            .register("http", PlainConnectionSocketFactory.getSocketFactory())
            .build();

    PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
    return HttpClientBuilder.create().setConnectionManager(connectionManager).build();
}

步骤3：绑定到目标Feign Client #

创建一个专属的配置类，把自定义HttpClient绑定到需要的Feign Client上：

// 目标Feign Client，指定使用自定义配置
@FeignClient(name = "self-signed-service", url = "https://your-self-signed-server", configuration = CustomFeignSslConfig.class)
public interface SelfSignedServiceFeignClient {
    // 定义你的接口方法
    @GetMapping("/api/data")
    String fetchData();
}

// Feign专属配置类
@Configuration
public class CustomFeignSslConfig {
    @Bean
    public Client feignClient(HttpClient customSelfSignedHttpClient) {
        return new ApacheHttpClient(customSelfSignedHttpClient);
    }
}

方案二：使用OkHttp作为Feign客户端并配置SSL #

如果你项目里用的是OkHttp作为Feign的底层客户端，配置逻辑类似，只是替换HttpClient的实现：

配置自定义OkHttpClient #

@Bean
public OkHttpClient customOkHttpClient() throws Exception {
    SSLContext sslContext = createCustomSslContext(); // 复用方案一里的createCustomSslContext方法
    X509TrustManager trustManager = (X509TrustManager) TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
            .init((KeyStore) null).getTrustManagers()[0];

    return new OkHttpClient.Builder()
            .sslSocketFactory(sslContext.getSocketFactory(), trustManager)
            // 仅当自签名证书的主机名不匹配时临时开启，生产环境建议修正证书的SAN/CN字段
            .hostnameVerifier((hostname, session) -> true)
            .build();
}

// Feign配置类
@Configuration
public class FeignOkHttpConfig {
    @Bean
    public Client feignClient(OkHttpClient customOkHttpClient) {
        return new OkHttpClientFeignClient(customOkHttpClient);
    }
}

方案三：合并默认信任库与自定义信任库 #

如果你的Feign Client需要同时访问标准CA认证的站点和自签名证书的站点，可以把默认系统信任库和自定义信任库合并，这样一个Client就能处理两种场景：

private SSLContext createMergedSslContext() throws Exception {
    // 加载系统默认信任库
    KeyStore defaultTrustStore = KeyStore.getInstance(KeyStore.getDefaultType());
    String defaultTrustStorePath = System.getProperty("javax.net.ssl.trustStore", "/etc/ssl/certs/java/cacerts");
    String defaultTrustStorePwd = System.getProperty("javax.net.ssl.trustStorePassword", "changeit");
    
    try (InputStream defaultStream = new FileInputStream(defaultTrustStorePath)) {
        defaultTrustStore.load(defaultStream, defaultTrustStorePwd.toCharArray());
    }

    // 加载自定义信任库
    KeyStore customTrustStore = KeyStore.getInstance(KeyStore.getDefaultType());
    try (InputStream customStream = new FileInputStream("/path/to/custom-truststore.jks")) {
        customTrustStore.load(customStream, "custom-password".toCharArray());
    }

    // 把自定义信任库的证书合并到默认信任库中
    Enumeration<String> customAliases = customTrustStore.aliases();
    while (customAliases.hasMoreElements()) {
        String alias = customAliases.nextElement();
        if (customTrustStore.isCertificateEntry(alias)) {
            Certificate cert = customTrustStore.getCertificate(alias);
            defaultTrustStore.setCertificateEntry(alias, cert);
        }
    }

    // 构建合并后的SSLContext
    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    trustManagerFactory.init(defaultTrustStore);
    SSLContext sslContext = SSLContext.getInstance("TLS");
    sslContext.init(null, trustManagerFactory.getTrustManagers(), new SecureRandom());
    return sslContext;
}

之后把这个合并后的SSLContext绑定到Feign Client的HttpClient/OkHttp即可，这样该Client既能访问正常CA站点，也能访问自签名站点。

注意事项 #

• 不要全局替换应用的默认SSLContext，否则会影响所有HTTPS请求的信任策略。
• 生产环境尽量不要关闭主机名验证，建议让自签名证书的CN或SAN字段匹配服务器域名。
• 信任库的路径、密码建议通过配置文件（如application.yml）注入，避免硬编码。

内容的提问来源于stack exchange，提问作者Kannan Ramamoorthy