Configure SSL context when creating a Client instance
There is a method in the ClientBuilder API that allows you to set the SSLContext :
public abstract ClientBuilder sslContext(SSLContext sslContext)
Specify the SSL context that will be used when creating secure transport connections to the server endpoints from the web targets created by the client instance that uses this SSL context. It is expected that in the context of SSL, the entire security infrastructure, including key and trust managers, will be initialized.
Setting up an SSL context instance resets all previously stored values of the keystore or trust store.
Parameters:
SSLContext is an implementation of a secure socket protocol that acts as a factory for secure socket factories or SSL mechanisms. Must not be null .
Return:
Updated client client instance.
Throws:
NullPointerException - if the SSLContext parameter is null .
Assuming you have added a certificate to the cacerts trust store, you can use the default SSLContext when creating the Client instance.
Client client = ClientBuilder.newBuilder().sslContext(SSLContext.getDefault()).build();
That should be enough. However, for some reason, the above code snippet does not work with RESTEasy, but works with Jersey. This is probably a RESTEasy error.
The standard solution does not work with RESTEasy. What should I do?
The RESTEasy documentation states the following:
Network communication between the client and server is handled in RESTEasy by default using the HttpClient (4.x) from the Apache HttpComponents project. [...]
RESTEasy and HttpClient make smart decisions by default, so you can use the client infrastructure without referring to HttpClient , but for some applications you may need to talk about the details of HttpClient . [...]
To configure the HttpClient used by RESTEeasy, follow these steps:
HttpClient httpClient = HttpClientBuilder.create() .setSslcontext(SSLContext.getDefault()) .build(); ApacheHttpClient4Engine engine = new ApacheHttpClient4Engine(httpClient); Client client = new ResteasyClientBuilder().httpEngine(engine).build();
Then you can execute the query:
Response response = client.target("https://self-signed.badssl.com/").request().get(); System.out.println(response.getStatus());
Are there alternatives to the SSL context?
Instead of using SSLContext when creating Client , you can download KeyStore . To load the cacerts trust store, you can do the following:
String filename = System.getProperty("java.home") + "/lib/security/cacerts".replace('/', File.separatorChar); FileInputStream is = new FileInputStream(filename); KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType()); String password = "changeit"; keystore.load(is, password.toCharArray());
Password cacerts ' default changeit .
Then create an instance of Client using one of the following methods:
Client client = ClientBuilder.newBuilder().trustStore(keystore).build();
Client client = ClientBuilder.newBuilder().keyStore(keystore, password).build();
The problem is that it does not work with RESTEasy, but it works with Jersey.
The above solutions have been tested against the following JAX-RS API implementations: