如何在Spring RestClient中禁用SSL证书验证？

要让RestClient与带有自签名TLS证书的主机建立HTTPS通信，核心是自定义一个禁用证书校验的HTTP客户端，再将其绑定到RestClient构建器中。具体实现步骤如下：

1. 构建信任所有证书的HttpClient #

先创建一个忽略SSL证书验证的HttpClient实例，通过自定义X509TrustManager和SSLContext跳过证书校验逻辑：

import org.apache.hc.client5.http.impl.classic.HttpClients;
import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
import org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory;
import org.apache.hc.core5.ssl.SSLContextBuilder;
import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;

public static org.apache.hc.client5.http.classic.HttpClient createUnsafeHttpClient() throws Exception {
    // 定义信任所有证书的TrustManager
    X509TrustManager trustManager = new X509TrustManager() {
        @Override
        public void checkClientTrusted(X509Certificate[] chain, String authType) {}

        @Override
        public void checkServerTrusted(X509Certificate[] chain, String authType) {}

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
    };

    // 构建忽略证书校验的SSLContext
    SSLContext sslContext = SSLContextBuilder.create()
            .loadTrustMaterial(null, (chain, authType) -> true)
            .build();

    // 创建SSL连接工厂
    SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext);

    // 组装HttpClient
    return HttpClients.custom()
            .setConnectionManager(PoolingHttpClientConnectionManagerBuilder.create()
                    .setSSLSocketFactory(sslSocketFactory)
                    .build())
            .build();
}

2. 将自定义HttpClient配置到RestClient #

修改你的@Bean方法，把上述自定义HttpClient注入到RestClient的请求工厂中：

import org.springframework.context.annotation.Bean;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestClient;

@Bean
RestClient restClient(RestClient.Builder builder) throws Exception {
    // 创建自定义请求工厂，绑定不安全的HttpClient
    HttpComponentsClientHttpRequestFactory requestFactory = 
            new HttpComponentsClientHttpRequestFactory(createUnsafeHttpClient());
    
    return builder
            .requestFactory(requestFactory)
            .build();
}

重要提醒：这种跳过证书校验的方式仅适用于测试或内部封闭环境，生产环境绝对禁止使用——会直接暴露中间人攻击等安全风险。生产环境建议将自签名证书添加到系统信任列表，而非直接禁用校验。

内容的提问来源于stack exchange，提问作者jogerj