java - CXF web 服务客户端忽略 ssl 配置 http-conf :tlsClientParameters

Question

我正在尝试在 cxf 客户端和网络服务之间建立 SSL 连接。为了进行概念验证，我正在使用 SpringJunit4TestRunner 运行测试。在我的客户端 spring 配置中，我使用了以下内容:

    <jaxws:client id="wsClient"  address="${webservice.endpoint.url}" serviceClass="MyServiceClass"/>
<http-conf:conduit name="${webservice.endpoint.url}">
        <http-conf:client ConnectionTimeout="${webservice.connectionTimeout}" />

        <http-conf:tlsClientParameters>            

            <sec:keyManagers keyPassword="changeit">
                <sec:keyStore type="JKS" password="changeit" file="c:\temp\keystore\myKeyStore.jks" />
            </sec:keyManagers>
            <sec:trustManagers >
                <sec:keyStore type="JKS" password="changeit" file="c:\temp\keystore\myKeyStore.jks"/>
            </sec:trustManagers>
            <sec:cipherSuitesFilter>
                <!-- these filters ensure that a ciphersuite with
                export-suitable or null encryption is used,
                but exclude anonymous Diffie-Hellman key change as
                this is vulnerable to man-in-the-middle attacks -->
                <sec:include>.*_EXPORT_.*</sec:include>
                <sec:include>.*_EXPORT1024_.*</sec:include>
                <sec:include>.*_WITH_DES_.*</sec:include>
                <sec:include>.*_WITH_AES_.*</sec:include>
                <sec:include>.*_WITH_NULL_.*</sec:include>
                <sec:exclude>.*_DH_anon_.*</sec:exclude>
            </sec:cipherSuitesFilter>    
        </http-conf:tlsClientParameters>
    </http-conf:conduit> 

但是 cxf 似乎没有选择我的配置。在启动期间的日志中，我看到一个

10:38:58.581 [ProofOfConceptTaskExecutor-1] DEBUG o.a.c.t.h.HttpsURLConnectionFactory - The location of the key store has not been set via a system parameter or through configuration so the default value of MYHOMEFOLDER.keystore will be used.
10:38:58.581 [ProofOfConceptTaskExecutor-1] DEBUG o.a.c.t.h.HttpsURLConnectionFactory - The key store password has not been set via a system property or through configuration, reading data from the keystore will fail.
10:38:58.581 [ProofOfConceptTaskExecutor-1] DEBUG o.a.c.t.h.HttpsURLConnectionFactory - The key password has not been set via a system property or through configuration, reading data from the keystore will fail.
10:38:59.252 [ProofOfConceptTaskExecutor-1] WARN  o.a.c.t.h.HttpsURLConnectionFactory - Default key managers cannot be initialized: Password must not be null
java.security.UnrecoverableKeyException: Password must not be null

在此之后，SSL 连接失败并出现 sun.security.provider.certpath.SunCertPathBuilderException:无法找到请求目标的有效证书路径

但是， keystore 及其证书链似乎是正确的，就好像我从命令行执行测试一样，传递了 keystore 和信任库的参数:

mvn clean test -Dtest=MyTestClass -Djavax.net.ssl.trustStore=C:\temp\keystore\myKeyStore.jks -Djavax.net.ssl.trustStorePassword=changeit -Djavax.net.ssl.keyStore=C:\temp\keystore\myKeyStore.jks -Djavax.net.ssl.keyStorePassword=changeit

一切正常，SSL 连接正常。所以我的结论是 CXF 忽略了 tlsClientParameters。非常感谢任何帮助。

编辑:如果我删除自己的 TaskExecutor，问题仍然存在，但在我看到的日志中

DEBUG o.a.c.t.h.HttpsURLConnectionFactory The location of the key store has not been set via a system parameter or through configuration so the default value will be used

Answer 1

您应该为 http-conf:conduit name 属性使用具有限定 namespace 的端口名称。检查Apache CXF文档。