因此,我能够禁用SBA管理服务器验证它试图连接到的客户端的SSL证书-对于SBA版本2.6.2,它或多或少地从他们的文档中概述:https://codecentric.github.io/spring-boot-admin/current/#_using_mutual_tls
下面是完整的configuration overriding bean:
package com.markham.mkmappadmin.config;
import javax.net.ssl.SSLException;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.reactive.ClientHttpConnector;
import org.springframework.http.client.reactive.ReactorClientHttpConnector;
import io.netty.handler.ssl.SslContext;
import io.netty.handler.ssl.SslContextBuilder;
import io.netty.handler.ssl.util.InsecureTrustManagerFactory;
import reactor.netty.http.client.HttpClient;
/**
* Custom http client class which overrides Spring Boot Admin's server default client.<br>
* The custom client will bypass any SSL Validation by configuring an instance of
* {@link InsecureTrustManagerFactory}
* @author Hanif Rajabali
* @see <a href="https://codecentric.github.io/spring-boot-admin/current/#_using_mutual_tls">Spring Boot Admin 2.6.2 Using Mutual TLS</a>
*/
@Configuration
public class CustomHttpClientConfig {
@Bean
public ClientHttpConnector customHttpClient() throws SSLException {
SslContext sslContext = SslContextBuilder
.forClient()
.trustManager(InsecureTrustManagerFactory.INSTANCE)
.build();
HttpClient httpClient = HttpClient.create().secure(
ssl -> ssl.sslContext(sslContext)
);
return new ReactorClientHttpConnector(httpClient);
}
}
我还没有弄清楚的是如何从SBA客户端禁用它。我在下面定义了一个自定义的RestTemplate Config,但是SBA客户端似乎没有拾取它,即使我看到SBA客户端代码正在使用BlockingRegistrationClient(即RestTemplate)
package com.markham.mkmemailerws.config;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.X509Certificate;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;
/**
* Need to explicitly build Spring Boot's auto configured
* {@link #restTemplate(RestTemplateBuilder)}
*
* @author Hanif Rajabali
*
*/
@Configuration
public class RestTemplateConfig {
// @Bean
// public RestTemplate restTemplate(RestTemplateBuilder restTemplateBuilder) {
// return restTemplateBuilder.build();
// }
/**
* The following will bypass ssl validation altogether. Not ideal.
*/
@Bean
public RestTemplate restTemplate(RestTemplateBuilder builder)
throws NoSuchAlgorithmException, KeyManagementException {
TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
}
public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {
}
public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {
}
} };
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, trustAllCerts, new java.security.SecureRandom());
CloseableHttpClient httpClient = HttpClients.custom().setSSLContext(sslContext)
.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).build();
HttpComponentsClientHttpRequestFactory customRequestFactory = new HttpComponentsClientHttpRequestFactory();
customRequestFactory.setHttpClient(httpClient);
return builder.requestFactory(() -> customRequestFactory).build();
}
}
1条答案
按热度按时间gojuced71#
在我们的案例中(Sping Boot Admin 2.7.10),第一个问题是,如果您使用默认文档中给出的模板启动SBA,则配置类不会被拾取。添加一个
@ComponentScan
Annotation,配置将被使用。那么问题中的customHttpClientbean就能按预期工作。如果您不想使整个证书检查过程无效,而只想使“使用者备用名称”检查无效,因为您正在使用IP而不是SBA的主机名,则可以使用以下方法来执行此操作。
在我们的例子中,在这里使用
setEndpointIdentificationAlgorithm("");
很重要,因为如果我们使用null,实际上在内部设置了另一个算法。