Apache CXF + grails - 间歇性错误 - https URL 主机名与公用名 (CN) 不匹配

Question

我正在使用 Apache CXF 插件(我已经尝试过 1.5.6 和 1.6.1)和 Grails (2.2.3) 通过 SSL 调用 Web 服务。

我有时会收到错误“https URL 主机名与客户端信任库中服务器证书上的通用名称 (CN) 不匹配。确保服务器证书正确，或禁用此检查(不推荐用于生产)将 CXF 客户端 TLS 配置属性“disableCNCheck”设置为 true。”

然而，它并不总是发生。通常它会工作几次，然后我会开始出现错误。我开始怀疑错误消息并未反射(reflect)实际问题。我在 Config.groovy 中将 disableCNCheck 设置为 true，但我仍然看到相同的行为:

cxf {
    client {
        requestClient {
            clientInterface = gov.agency.RequestPortType
            serviceEndpointAddress = "https://agency.gov/service"
            secureSocketProtocol = CxfClientConstants.SSL_PROTOCOL_TLSV1
            tlsClientParameters = [disableCNCheck: true]            
        }
    }
}

有什么想法吗？

这是插件的调试输出片段:

2014-05-06 09:32:36,507 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleMessage on interceptor org.apache.cxf.interceptor.BareOutInterceptor@464ea113
2014-05-06 09:32:36,507 [http-bio-8080-exec-9] DEBUG http.Headers  - Accept: */*
2014-05-06 09:32:36,507 [http-bio-8080-exec-9] DEBUG http.Headers  - SOAPAction: "tns:ProvideAndRegisterDocumentSet-bRequest"
2014-05-06 09:32:36,507 [http-bio-8080-exec-9] DEBUG http.TrustDecisionUtil  - No Trust Decider for Conduit '{urn:ihe:iti:xdr:async:request:2007}XDRRequest_PortTypePort.http-conduit'. An afirmative Trust Decision is assumed.
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.interceptor.BareOutInterceptor@464ea113
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.binding.soap.interceptor.SoapOutInterceptor@5fa570da
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.interceptor.StaxOutInterceptor@111ad6e7
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.interceptor.AttachmentOutInterceptor@1de6a407
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.interceptor.LoggingOutInterceptor@15024134
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.interceptor.MessageSenderInterceptor@4706c7b2
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.binding.soap.interceptor.SoapPreProtocolOutInterceptor@54310a74
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.binding.soap.interceptor.SoapHeaderOutFilterInterceptor@7912e076
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.jaxws.interceptors.WrapperClassOutInterceptor@7ec40b92
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.jaxws.interceptors.SwAOutInterceptor@e209b8c
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.jaxws.interceptors.HolderOutInterceptor@78d3df42
2014-05-06 09:32:36,621 [http-bio-8080-exec-9] DEBUG phase.PhaseInterceptorChain  - Invoking handleFault on interceptor org.apache.cxf.ws.policy.PolicyOutInterceptor@295cf1bb
2014-05-06 09:32:36,626 [http-bio-8080-exec-9] WARN  phase.PhaseInterceptorChain  - Interceptor for {urn:ihe:iti:xdr:async:request:2007}XDRRequestPortTypeService#{urn:ihe:iti:xdr:async:request:2007}ProvideAndRegisterDocumentSet-bRequest has thrown exception, unwinding now
Message: The https URL hostname does not match the Common Name (CN) on the server certificate in the client's truststore.  Make sure server certificate is correct, or to disable this check (NOT recommended for production) set the CXF client TLS configuration property "disableCNCheck" to true.
   Line | Method
->> 101 | writeParts        in org.apache.cxf.interceptor.AbstractOutDatabindingInterceptor
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
|    68 | handleMessage     in org.apache.cxf.interceptor.BareOutInterceptor
|   262 | doIntercept . . . in org.apache.cxf.phase.PhaseInterceptorChain
|   531 | doInvoke          in org.apache.cxf.endpoint.ClientImpl
|   464 | invoke . . . . .  in     ''
|   367 | invoke            in     ''
|   320 | invoke . . . . .  in     ''
|    89 | invokeSync        in org.apache.cxf.frontend.ClientProxy
|   134 | invoke . . . . .  in org.apache.cxf.jaxws.JaxWsClientProxy
|   424 | invoke            in com.grails.cxf.client.WebServiceClientFactoryImpl$WSClientInvocationHandler

Answer 1

在这方面花了一些时间后，我发现 secureSocketProtocol 没有正确设置。我更改了 Config.groovy 以完全限定常量:

secureSocketProtocol = com.grails.cxf.client.CxfClientConstants.SSL_PROTOCOL_TLSV1

而且我不再遇到这个问题，所以我想这一直是问题所在。