Configure SSL with Webflux Webclient using Apache HttpComponents

Question

I am trying to migrate from restTemplate to webClient.

Everything was fine until I reached restTemplate config with ClientHttpRequestFactory .

I paste here the old and the new codes.

------Old code with restTemplate-------

private HttpComponentsClientHttpRequestFactory buildRequestFactory() {

    HttpClientBuilder clientBuilder = HttpClientBuilder.create();
    HttpHost proxy = new HttpHost(proxyHost, proxyPort);
    CredentialsProvider credsProvider = new BasicCredentialsProvider();
    credsProvider.setCredentials(new AuthScope(proxyHost, proxyPort),
            new UsernamePasswordCredentials(proxyUser, proxyPassword));
    clientBuilder.useSystemProperties();
    clientBuilder.setProxy(proxy);
    clientBuilder.setDefaultCredentialsProvider(credsProvider);
    clientBuilder.setProxyAuthenticationStrategy(new ProxyAuthenticationStrategy());

    TrustStrategy acceptingTrustStrategy = new TrustStrategy() {
        public boolean isTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
            return true;
        }
    };

    SSLContext sslContext = null;
    try {
        sslContext = org.apache.http.ssl.SSLContexts.custom().loadTrustMaterial(null, acceptingTrustStrategy).build();
    } catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
        throw new ServiceException(GlobalErrorMessage.INTERNAL_SERVER_ERROR);
    }

    SSLConnectionSocketFactory connectionFactory = new SSLConnectionSocketFactory(sslContext, new NoopHostnameVerifier());
    CloseableHttpClient httpClient = clientBuilder
            .setSSLSocketFactory(connectionFactory)
            .setRoutePlanner(new DefaultProxyRoutePlanner(proxy) {
                @Override
                public HttpHost determineProxy(HttpHost target, HttpRequest request, HttpContext context)
                        throws HttpException {
                    if (target.getHostName().equals(noproxy)) {
                        return null;
                    }
                    return super.determineProxy(target, request, context);
                }
            })
            .build();
    HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
    requestFactory.setHttpClient(httpClient);

    return requestFactory;
}

@Bean(name = "gatewayRestTemplate")
public RestTemplate gatewayRestTemplateConfig() {
    RestTemplate restTemplate = new RestTemplate(converters());
    restTemplate.setRequestFactory(buildRequestFactory());
    return restTemplate;
}

------New code with webClient-------

private ClientHttpConnector buildClientConnector() {
    HttpAsyncClientBuilder clientBuilder = HttpAsyncClients.custom();
    org.apache.hc.core5.http.HttpHost proxy = new org.apache.hc.core5.http.HttpHost(proxyHost, proxyPort);
    org.apache.hc.client5.http.auth.CredentialsProvider credsProvider = new org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider();
    ((org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider) credsProvider).setCredentials(new org.apache.hc.client5.http.auth.AuthScope(proxyHost, proxyPort),
            new org.apache.hc.client5.http.auth.UsernamePasswordCredentials(proxyUser, proxyPassword.toCharArray()));
    clientBuilder.useSystemProperties();
    clientBuilder.setProxy(proxy);
    clientBuilder.setDefaultCredentialsProvider(credsProvider);
    clientBuilder.setProxyAuthenticationStrategy(new DefaultAuthenticationStrategy());

    TrustStrategy acceptingTrustStrategy = new TrustStrategy() {
        public boolean isTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
            return true;
        }
    };

    SSLContext sslContext = null;
    try {
        sslContext = org.apache.http.ssl.SSLContexts.custom().loadTrustMaterial(null, acceptingTrustStrategy).build();
    } catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
        throw new ServiceException(GlobalErrorMessage.INTERNAL_SERVER_ERROR);
    }

    org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory connectionFactory =
            new org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory(sslContext, new NoopHostnameVerifier());

    org.apache.hc.core5.http.config.Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder
            // .<org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory>create().register("https", connectionFactory)
            .<ConnectionSocketFactory>create().register("https", connectionFactory)
            // .register("http", new PlainConnectionSocketFactory())
            .build();
    PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);

    CloseableHttpAsyncClient client = clientBuilder
            .setConnectionManager((AsyncClientConnectionManager) connectionManager)
            .setRoutePlanner(new org.apache.hc.client5.http.impl.routing.DefaultProxyRoutePlanner(proxy) {
                @Override
                protected org.apache.hc.core5.http.HttpHost determineProxy(org.apache.hc.core5.http.HttpHost target, org.apache.hc.core5.http.protocol.HttpContext context) throws org.apache.hc.core5.http.HttpException {
                    if (target.getHostName().equals(noproxy)) {
                        return null;
                    }
                    return super.determineProxy(target, context);
                }
            })
            .build();
    ClientHttpConnector connector = new HttpComponentsClientHttpConnector(client);
    return connector;
}

@Primary
@Bean(name = "defaultWebClient")
public WebClient defaultWebClientConfig() {
    WebClient webClient = WebClient.builder()
            .clientConnector(buildClientConnector())
            .build();
    return webClient;
}

When I run the project, I get this exception:

Caused by: java.lang.ClassCastException: class org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager cannot be cast to class org.apache.hc.client5.http.nio.AsyncClientConnectionManager (org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager and org.apache.hc.client5.http.nio.AsyncClientConnectionManager are in unnamed module of loader 'app')

Answer 1

Based on Migration to Apache HttpClient 5.0 async APIs , I solved my problem. The idea is to use ClientTlsStrategyBuilder when setting sslContext .

private ClientHttpConnector buildClientConnector() {
    HttpAsyncClientBuilder clientBuilder = HttpAsyncClients.custom();
    org.apache.hc.core5.http.HttpHost proxy = new org.apache.hc.core5.http.HttpHost(proxyHost, proxyPort);
    org.apache.hc.client5.http.auth.CredentialsProvider credsProvider = new org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider();
    ((org.apache.hc.client5.http.impl.auth.BasicCredentialsProvider) credsProvider).setCredentials(new org.apache.hc.client5.http.auth.AuthScope(proxyHost, proxyPort),
            new org.apache.hc.client5.http.auth.UsernamePasswordCredentials(proxyUser, proxyPassword.toCharArray()));
    clientBuilder.useSystemProperties();
    clientBuilder.setProxy(proxy);
    clientBuilder.setDefaultCredentialsProvider(credsProvider);
    clientBuilder.setProxyAuthenticationStrategy(new DefaultAuthenticationStrategy());
    TrustStrategy acceptingTrustStrategy = (x509Certificates, s) -> true;
    SSLContext sslContext;
    try {
        sslContext = org.apache.http.ssl.SSLContexts.custom().loadTrustMaterial(null, acceptingTrustStrategy).build();
    } catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
        throw new ServiceException(GlobalErrorMessage.INTERNAL_SERVER_ERROR);
    }
    PoolingAsyncClientConnectionManager connectionManager = PoolingAsyncClientConnectionManagerBuilder.create()
            .setTlsStrategy(ClientTlsStrategyBuilder.create()
                    .setSslContext(sslContext)
                    .setHostnameVerifier(new NoopHostnameVerifier())
                    .build())
            .build();

    CloseableHttpAsyncClient client = clientBuilder
            .setConnectionManager(connectionManager)
            .setRoutePlanner(new org.apache.hc.client5.http.impl.routing.DefaultProxyRoutePlanner(proxy) {
                @Override
                protected org.apache.hc.core5.http.HttpHost determineProxy(org.apache.hc.core5.http.HttpHost target, org.apache.hc.core5.http.protocol.HttpContext context) throws org.apache.hc.core5.http.HttpException {
                    if (target.getHostName().equals(noproxy)) {
                        return null;
                    }
                    return super.determineProxy(target, context);
                }
            })
            .build();
    ClientHttpConnector connector = new HttpComponentsClientHttpConnector(client);
    return connector;
}

@Primary
@Bean(name = "defaultWebClient")
public WebClient defaultWebClientConfig() {
    WebClient webClient = WebClient.builder()
        .clientConnector(buildClientConnector())
        .build();
    return webClient;

}

Answer 2

If you want to use HttpClient connector. Please use below code for webclient. The above answers any of them not worked, below solution is working fine for me.

SslContext sslContext = SslContextBuilder
            .forClient()
            .trustManager(InsecureTrustManagerFactory.INSTANCE)
            .build();

  HttpClient httpClient = HttpClient.create().secure(t -> 
    t.sslContext(sslContext) );
    WebClient webClient =  WebClient.builder()
             .baseUrl("any-url")
            .clientConnector(new ReactorClientHttpConnector(httpClient))
            .build();