java Soap客户端，TLS 1.2连接PKIX路径构建失败，尽管cacerts包含证书

Question

我试图在第一个连接阶段使用TLS连接作为Soap客户端连接到3d party web服务。技术堆栈：Spring boot 2.2.2.RELEASE，spring-ws-security 2.2.2.RELEASE和httpclient 4.5.4，wss4j 1.6.19。。。详见下文pom.xml

这是我的Spring启动配置文件

@Configuration
public class SoapConfig {

    @Value("${client.ws.url}")
    private String defaultUri;

    @Value("${client.ssl.trust-store}")
    private Resource sslTrustStore;

    @Value("${client.ssl.trust-store-password}")
    private String sslTrustStorePassword;

    @Value("${client.wss.trust-store}")
    private Resource wssTrustStore;

    @Value("${client.wss.trust-store-password}")
    private String wssStorePassword;

    @Bean
    public Jaxb2Marshaller jaxb2Marshaller(){
        Jaxb2Marshaller jaxb2Marshaller = new Jaxb2Marshaller();
        jaxb2Marshaller.setPackagesToScan("com.advantio.models.soap.bindings");
        return jaxb2Marshaller;
    }

    @Bean
    public WebServiceTemplate webServiceTemplate() throws Exception {
        WebServiceTemplate webServiceTemplate = new WebServiceTemplate();
        webServiceTemplate.setMarshaller(jaxb2Marshaller());
        webServiceTemplate.setUnmarshaller(jaxb2Marshaller());
        webServiceTemplate.setDefaultUri(defaultUri);
        webServiceTemplate.setMessageSender(httpComponentsMessageSender());

        //ClientInterceptor[] interceptors = new ClientInterceptor[]{securityInterceptor()};
        //webServiceTemplate.setInterceptors(interceptors);

        return webServiceTemplate;
    }

    @Bean
    public HttpComponentsMessageSender httpComponentsMessageSender() throws Exception {
        HttpComponentsMessageSender httpComponentsMessageSender = new HttpComponentsMessageSender();
        httpComponentsMessageSender.setHttpClient(httpClient());

        return httpComponentsMessageSender;
    }

    public HttpClient httpClient() throws Exception {
        return HttpClientBuilder.create()
                .setSSLSocketFactory(sslConnectionSocketFactory())
                .addInterceptorFirst(new HttpComponentsMessageSender.RemoveSoapHeadersInterceptor()).build();
    }

    public SSLConnectionSocketFactory sslConnectionSocketFactory() throws Exception {
        // NoopHostnameVerifier essentially turns hostname verification off as otherwise following error
        // is thrown: java.security.cert.CertificateException: No name matching localhost found
        return new SSLConnectionSocketFactory(sslContext(), NoopHostnameVerifier.INSTANCE);
    }

    public SSLContext sslContext() throws Exception {
        return SSLContextBuilder.create()
                .loadTrustMaterial(wssTrustStore.getFile(), sslTrustStorePassword.toCharArray()).build();
    }

}

我的客户。爪哇

@Service
public class SoapClient {


    @Autowired
    private WebServiceTemplate webServiceTemplate;

    public ProvisionResponse getItemInfo(ProvisionData itemRequest){

        return (ProvisionResponse) webServiceTemplate.marshalSendAndReceive(itemRequest);
    }
}

和pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.myproject</groupId>
    <artifactId>myproject</artifactId>
    <version>1.0-SNAPSHOT</version>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.2.1.RELEASE</version>
    </parent>

    <dependencies>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-logging</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>org.apache.ws.security</groupId>
            <artifactId>wss4j</artifactId>
            <version>1.6.19</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.ws</groupId>
            <artifactId>spring-ws-security</artifactId>
            <version>2.2.1.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
            <version>2.2.1.RELEASE</version>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-log4j2</artifactId>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpclient</artifactId>
            <version>4.5.4</version>
        </dependency>

        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <version>1.18.10</version>
            <scope>provided</scope>
        </dependency>

        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>2.6</version>
        </dependency>
        <dependency>
            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
            <scope>test</scope>
            <version>1.4.194</version>
        </dependency>
        <dependency>
            <groupId>org.jetbrains</groupId>
            <artifactId>annotations</artifactId>
            <version>RELEASE</version>
            <scope>compile</scope>
        </dependency>

    </dependencies>

    <build>
        <resources>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>true</filtering>
                <excludes>
                    <exclude>**/*.jks</exclude>
                </excludes>
            </resource>
            <resource>
                <directory>src/main/resources</directory>
                <filtering>false</filtering>
                <includes>
                    <include>**/*.jks</include>
                </includes>
            </resource>
        </resources>

    </build>


</project>

我已将所有证书添加到cacerts文件中（对于jdk和jre文件夹） 这是一个屏幕-https://www.screencast.com/t/E5NpGSCR

我得到以下堆栈跟踪错误：

chain [0] = ...
chain [1] = [
[... 5E   6B AC EE C4 80 9A 12 72  WT.....^k......r
00A0: FA 56 93 D7 FF BF 30 85   06 30 BF 0B 7F 4E FF 57  .V....0..0...N.W
00B0: 05 9D 24 ED 85 C3 2B FB   A6 75 A8 AC 2D 16 EF 7D  ..$...+..u..-...
00C0: 79 27 B2 EB C2 9D 0B 07   EA AA 85 D3 01 A3 20 28  y'............ (
00D0: 41 59 43 28 D2 81 E3 AA   F6 EC 7B 3B 77 B6 40 62  AYC(.......;w.@b
00E0: 80 05 41 45 01 EF 17 06   3E DE C0 33 9B 67 D3 61  ..AE....>..3.g.a
00F0: 2E 72 87 E4 69 FC 12 00   57 40 1E 70 F5 1E C9 B4  .r..i...W@.p....

]
***
%% Invalidated:  [Session-2, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384]
my-scheduled-task-pool-3, SEND TLSv1.2 ALERT:  fatal, description = certificate_unknown
my-scheduled-task-pool-3, WRITE: TLSv1.2 Alert, length = 2
[Raw write]: length = 7
0000: 15 03 03 00 02 02 2E                               .......
my-scheduled-task-pool-3, called closeSocket()
my-scheduled-task-pool-3, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
2020-01-24T09:03:11,832 ERROR [my-scheduled-task-pool-3] o.s.s.s.TaskUtils$LoggingErrorHandler: Unexpected error occurred in scheduled task
org.springframework.ws.client.WebServiceIOException: I/O error: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at org.springframework.ws.client.core.WebServiceTemplate.sendAndReceive(WebServiceTemplate.java:561)
    at org.springframework.ws.client.core.WebServiceTemplate.marshalSendAndReceive(WebServiceTemplate.java:390)
    at org.springframework.ws.client.core.WebServiceTemplate.marshalSendAndReceive(WebServiceTemplate.java:383)
    at org.springframework.ws.client.core.WebServiceTemplate.marshalSendAndReceive(WebServiceTemplate.java:373)
    at com.myproject.service.impl.SoapClient.getItemInfo(SoapClient.java:20)
    at com.myproject.service.impl.TestSenderImpl.send(TestSenderImpl.java:60)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.scheduling.support.ScheduledMethodRunnable.run(ScheduledMethodRunnable.java:84)
    at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.runAndReset$$$capture(FutureTask.java:308)
    at java.util.concurrent.FutureTask.runAndReset(FutureTask.java)
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1946)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:316)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:396)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355)
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:373)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381)
    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237)
    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185)
    at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
    at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111)
    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
    at org.springframework.ws.transport.http.HttpComponentsConnection.onSendAfterWrite(HttpComponentsConnection.java:121)
    at org.springframework.ws.transport.AbstractWebServiceConnection.send(AbstractWebServiceConnection.java:48)
    at org.springframework.ws.client.core.WebServiceTemplate.sendRequest(WebServiceTemplate.java:658)
    at org.springframework.ws.client.core.WebServiceTemplate.doSendAndReceive(WebServiceTemplate.java:606)
    at org.springframework.ws.client.core.WebServiceTemplate.sendAndReceive(WebServiceTemplate.java:555)
    ... 19 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
    at sun.security.validator.Validator.validate(Validator.java:262)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1621)
    ... 44 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
    ... 50 more
2020-01-24T09:03:17,995 DEBUG [my-scheduled-task-pool-5] c.a.s.i.Stage1RepeaterImpl: STAGE_1 Starts work...
Hibernate: select transactio0_.trans_id as trans_id1_1_, transactio0_.number_of_attempts as number_o2_1_, transactio0_.comment as comment3_1_, transactio0_.created as created4_1_, transactio0_.error_code as error_co5_1_, transactio0_.external_id as external6_1_, transactio0_.file_path as file_pat7_1_, transactio0_.first_name as first_na8_1_, transactio0_.last_name as last_nam9_1_, transactio0_.last_updated as last_up10_1_, transactio0_.otp as otp11_1_, transactio0_.otp_enc as otp_enc12_1_, transactio0_.phone as phone13_1_, transactio0_.phone_enc as phone_e14_1_, transactio0_.DATA_block as DATA_blo15_1_, transactio0_.status as status16_1_ from transactions transactio0_ where transactio0_.status=? order by transactio0_.created desc limit ?
2020-01-24T09:03:17,998 DEBUG [my-scheduled-task-pool-5] c.a.s.i.Stage1RepeaterImpl: my-scheduled-task-pool-5 STAGE_1 Finished work...
2020-01-24T09:03:17,999 DEBUG [my-scheduled-task-pool-5] c.a.s.i.DATAServiceImpl: SEND DATA Started work...
Hibernate: select transactio0_.trans_id as trans_id1_1_, transactio0_.number_of_attempts as number_o2_1_, transactio0_.comment as comment3_1_, transactio0_.created as created4_1_, transactio0_.error_code as error_co5_1_, transactio0_.external_id as external6_1_, transactio0_.file_path as file_pat7_1_, transactio0_.first_name as first_na8_1_, transactio0_.last_name as last_nam9_1_, transactio0_.last_updated as last_up10_1_, transactio0_.otp as otp11_1_, transactio0_.otp_enc as otp_enc12_1_, transactio0_.phone as phone13_1_, transactio0_.phone_enc as phone_e14_1_, transactio0_.DATA_block as DATA_blo15_1_, transactio0_.status as status16_1_ from transactions transactio0_ where transactio0_.status=? order by transactio0_.created desc limit ?
2020-01-24T09:03:18,002 DEBUG [my-scheduled-task-pool-4] c.a.s.i.Stage2RepeaterImpl: STAGE_2 Starts work...
2020-01-24T09:03:18,003 DEBUG [my-scheduled-task-pool-5] c.a.s.i.DATAServiceImpl: my-scheduled-task-pool-5 SEND DATA Finished work...
Hibernate: select transactio0_.trans_id as trans_id1_1_, transactio0_.number_of_attempts as number_o2_1_, transactio0_.comment as comment3_1_, transactio0_.created as created4_1_, transactio0_.error_code as error_co5_1_, transactio0_.external_id as external6_1_, transactio0_.file_path as file_pat7_1_, transactio0_.first_name as first_na8_1_, transactio0_.last_name as last_nam9_1_, transactio0_.last_updated as last_up10_1_, transactio0_.otp as otp11_1_, transactio0_.otp_enc as otp_enc12_1_, transactio0_.phone as phone13_1_, transactio0_.phone_enc as phone_e14_1_, transactio0_.DATA_block as DATA_blo15_1_, transactio0_.status as status16_1_ from transactions transactio0_ where transactio0_.status=? order by transactio0_.created desc limit ?
2020-01-24T09:03:18,006 DEBUG [my-scheduled-task-pool-4] c.a.s.i.Stage2RepeaterImpl: my-scheduled-task-pool-4 STAGE_2 Finished work...
Disconnected from the target VM, address: '127.0.0.1:58568', transport: 'socket'

Process finished with exit code -1

不明白为什么PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Jdk版本1.8.0_191，但也尝试了jdk 1.8.0_241和jdk 13 Maven版本3.6.0

Answer 1

好的，我发现了问题。 在创建sslContext时，我不得不使用.loadKeyMaterial而不是.loadTrustStore方法。以下是更改的sslContext()方法：

public SSLContext sslContext() throws Exception {


        KeyStore keyStore = KeyStore.getInstance("JKS");
        InputStream in = new FileInputStream(sslTrustStore.getFile());
        keyStore.load(in, sslTrustStorePassword.toCharArray());

        return SSLContextBuilder.create()
                .loadKeyMaterial(keyStore, sslTrustStorePassword.toCharArray(), (a, s)->"alias-name").build();

    }