Spring RestTemplate调用HTTPS在WebLogic异常，求差异分析与调试方案

Great question! Let’s break this down clearly and walk through how to resolve and debug the problem in WebLogic.

First, let’s explain why those system properties work in your plain Java main method:

• Plain Java apps rely on the JVM’s default SSL context for HTTPS connections. When you set javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword, you’re overriding the JVM’s default SSL configuration to use your specified keystore—critical if the target REST service requires mutual TLS (2-way SSL) or needs trusted certificates for validation. This directly tells the JVM’s SSL engine which certificates to use, so the connection succeeds.

Why WebLogic Behaves Differently #

WebLogic Server has its own integrated SSL management system that doesn’t depend on the JVM’s default SSL context. Here’s the key differences:

• WebLogic maintains its own Identity and Trust keystore configurations, set via the WebLogic Console, config.xml, or startup scripts. These server-level settings take full precedence over JVM-level system properties like javax.net.ssl.keyStore.
• WebLogic uses a custom SSL implementation (weblogic.security.SSL) to handle all HTTPS connections—even for application code like RestTemplate. Your system properties aren’t picked up by this custom engine, so they have no effect on connections initiated from within WebLogic.

How to Debug Certificate/SSL Issues in WebLogic #

Follow these practical steps to diagnose and fix the problem:

1. Enable Detailed SSL Debug Logging #

Turn on SSL debugging to get granular visibility into handshake processes, keystore loading, and certificate validation. Add these JVM arguments to your WebLogic startup script (or set them via the Console):

-Dssl.debug=true
-Dweblogic.SSL.debug=true
-Djavax.net.debug=ssl,handshake

These logs will show you:

• Which keystores WebLogic is attempting to load
• Whether required certificates are found or rejected
• Exact errors during the SSL handshake (e.g., "untrusted certificate", "no client certificate presented")

2. Verify WebLogic’s Keystore Configurations #

WebLogic requires explicit setup of Identity and Trust keystores for SSL operations:

• Log into the WebLogic Console, navigate to Servers > [Your Target Server] > SSL tab.
• Check the Identity Keystore: If the target service uses mutual TLS, this keystore must contain a client certificate trusted by the target service.
• Check the Trust Keystore: This keystore must include the CA certificate that signed the target service’s SSL certificate (for 1-way TLS) or the client certificate’s CA (for 2-way TLS).
• Use the keytool command to inspect the keystore contents and confirm validity:

  keytool -list -v -keystore /path/to/weblogic/identity.jks -storepass your-keystore-password
  

  Ensure certificates are present, not expired, and have the correct key usage attributes.

3. Configure RestTemplate to Use WebLogic’s SSL Context #

Instead of relying on system properties, make your RestTemplate use WebLogic’s managed SSL context. This ensures it inherits the server’s pre-configured keystores and trust policies:

import weblogic.security.SSL.SSLContextManager;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;
import javax.net.ssl.SSLContext;

public class RestTemplateConfig {
    public RestTemplate createWebLogicAwareRestTemplate() throws Exception {
        // Retrieve WebLogic's configured SSL context
        SSLContext sslContext = SSLContextManager.getInstance().getSSLContext();
        
        // Set up the request factory to use WebLogic's SSL context
        HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
        requestFactory.setSslContext(sslContext);
        
        // Initialize RestTemplate with the custom factory
        return new RestTemplate(requestFactory);
    }
}

4. Check for Conflicting Startup Parameters #

Ensure no WebLogic-specific JVM arguments are overriding your SSL settings. For example:

• -Dweblogic.security.SSL.trustedCAKeyStore: This explicitly sets WebLogic’s truststore, overriding javax.net.ssl.trustStore.
• -Dweblogic.security.SSL.ignoreHostnameVerification: While this might mask hostname mismatch errors, it’s not a secure long-term fix—always validate certificate hostnames properly.

5. Validate the Target Service’s SSL Requirements #

Confirm whether the target REST service uses 1-way or 2-way SSL:

• For 1-way SSL: Your WebLogic Trust Keystore must trust the target service’s certificate (i.e., contain the root/intermediate CA that signed it).
• For 2-way SSL: Your WebLogic Identity Keystore must have a client certificate trusted by the target service’s Trust Keystore, and vice versa.

内容的提问来源于stack exchange，提问作者soumitra chatterjee