SSL 연결 시 서명된 CA 인증서가 truststore에 존재하지 않는 경우 자동으로 갱신하는 Java 코드 예제

SSL 연결 시 서명된 CA 인증서가 truststore에 존재하지 않는 경우 자동으로 갱신하는 Java 코드 예제는 다음과 같습니다.

String url = "https://example.com";
HttpClient httpClient = null;
try {
    SSLContext sslContext = SSLContexts.createDefault();
    SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);

    Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
        .register("https", sslSocketFactory).build();

    PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);

    httpClient = HttpClients.custom().setConnectionManager(connectionManager).build();

    HttpGet httpGet = new HttpGet(url);
    HttpResponse response = httpClient.execute(httpGet);
    HttpEntity entity = response.getEntity();
    EntityUtils.consume(entity);
} catch (SSLHandshakeException e) {
    Throwable cause = e.getCause();
    if (cause instanceof CertificateException) {
        CertificateException ce = (CertificateException) cause;
        if (ce.getMessage().contains("PKIX path building failed")) {
            X509Certificate[] certs = ((PKIXCertPathBuilderException) ce.getCause()).getCertPath().getCertificates().toArray(new X509Certificate[0]);
            KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
            keyStore.load(null, null);
            for (int i = 0; i < certs.length; i++) {
                X509Certificate cert = certs[i];
                keyStore.setCertificateEntry("alias-" + i, cert);
            }
            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init(keyStore);
            SSLContext sslContext = SSLContexts.custom().loadTrustMaterial(keyStore, null).build();
            SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
            httpClient = HttpClients.custom().setSSLSocketFactory(sslSocketFactory).setConnectionManager(connectionManager).build();
            response = httpClient.execute(httpGet);
            entity = response.getEntity();
            EntityUtils.consume(entity);
        }
    }
} catch (Exception e) {
    // 에러 처리를 수행합니다.
    throw new RuntimeException("Error initializing HttpClient", e);
}

 

 

위 코드에서는 HttpClient를 생성하는 도중 SSLHandshakeException이 발생하는 경우, PKIX path building failed 예외가 발생하는지 확인합니다. 만약 해당 예외가 발생한다면, 예외에 포함된 CertificateException에서 CA 인증서를 추출합니다. 이후 KeyStore를 생성하여 CA 인증서를 추가하고, TrustManagerFactory를 생성합니다. TrustManagerFactory의 init() 메서드를 사용하여 keyStore를 설정합니다. SSLContextBuilder를 사용하여 SSLContext를 생성하고, SSLConnectionSocketFactory를 생성합니다. 마지막으로 HttpClient를 생성합니다.

위 코드에서는 HttpClient의 생성이 실패할 경우에도 예외 처리를 수행하였습니다. 이를 위해 try-catch 블록을 사용하여 예외 처리를 수행하였습니다.