java - 为官方 Docker 映像 microProfile3java11 打开 Liberty SSLHandshakeException
问题描述
我正在尝试使用简单的 JAX-RS 客户端访问虚拟 REST API,例如https://reqres.in/api/users或https://jsonplaceholder.typicode.com/todos :
public class RandomDataProvider {
private WebTarget webTarget;
@PostConstruct
public void setUp() {
Client client = ClientBuilder.newBuilder()
.connectTimeout(5, TimeUnit.SECONDS)
.readTimeout(5, TimeUnit.SECONDS)
.build();
this.webTarget = client
.target("https://reqres.in/api/users");
}
public JsonArray getAllPosts() {
return this.webTarget
.request()
.accept(MediaType.APPLICATION_JSON)
.get(JsonArray.class);
}
}
但是每次我尝试使用 HTTPS 时,我都会得到SSLHandshakeExeption
服务器是:无法找到请求目标的有效证书路径:
[ERROR ] SRVE0283E: Exception caught while initializing context: javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://reqres.in/api/users: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.apache.cxf.jaxrs.client.AbstractClient.checkClientException(AbstractClient.java:640)
at [internal classes]
at de.rieckpil.udemy.RandomDataProvider.getAllPosts(RandomDataProvider.java:32)
at de.rieckpil.udemy.RandomDataPrinter.initialize(RandomDataPrinter.java:17)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.base/java.lang.reflect.Method.invoke(Unknown Source)
at org.jboss.weld.injection.StaticMethodInjectionPoint.invoke(StaticMethodInjectionPoint.java:95)
at [internal classes]
Caused by (repeated) ... : javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://reqres.in/api/users: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at java.base/jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at java.base/jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.base/java.lang.reflect.Constructor.newInstance(Unknown Source)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1451)
... 9 more
Caused by: java.security.cert.CertificateException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.ibm.ws.ssl.core.WSX509TrustManager.checkServerTrusted(WSX509TrustManager.java:806)
... 9 more
Dockerfile 如下所示:
FROM open-liberty:microProfile3-java11
COPY --chown=1001:0 target/mywar.war /config/dropins/
我假设这个官方 Docker 映像正在使用 JDK 可信证书,还是我必须在自己的文件中明确配置它server.xml
?
解决方案
Liberty 默认不使用 JDK 的可信证书。如果要使用 cacerts 文件进行信任,则必须对其进行配置。我假设您没有 ssl 配置。要添加 cacerts 文件,您可以添加如下配置:
<ssl id="defaultSSLConfig" keyStoreRef="defaultKeyStore" trustStoreRef="caTrustStore" />
<keyStore id="caTrustStore" location=“enter path to cacerts file" type="JKS" password="changeit" />
推荐阅读
- json - 在 Lua 中从字符串中分离值
- fortran - Fortran 编译器选项,用于警告将单精度常量分配给双精度变量
- css - div 之间的边距底部未按预期工作
- mysql - MySQL 字符串到 DATE / TIME 或 TIMESTAMP
- reactjs - 字符串未在 foreach 循环中输出
- reactjs - 第一次导航后,React Router 不会呈现推送的页面
- azure-devops - Azure devops 提交的 IP 地址信息
- react-native - 无法在 react native 项目中启动 Metro bundler
- python - 使用 UDP 套接字通过以太网电缆连接同一网络上的两台笔记本电脑
- python - 需要帮助创建餐厅菜单。基础成本、配料、税收、总计是产出