Shulou(Shulou.com)06/02 Report--

What this article shares to you is about how to solve the problem of online Https request error report. The editor thinks it is very practical, so I share it with you to learn. I hope you can get something after reading this article.

Get to the point:

Our system relies on an external query interface, which is served by HTTPS. Because the external system does not have a test environment, we all request their production environment directly. We use HttpClient in the project, and the code to create SSLClient is as follows:

Private static CloseableHttpClient createSSLClientDefault () {SSLContext sslContext; try {sslContext = new SSLContextBuilder () .loadTrustMaterial (null, new TrustStrategy () {/ / trust all @ Override public boolean isTrusted (X509Certificate [] xcs, String string) {return true;}}) .build ()

SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory (sslContext); return HttpClients.custom (). SetSSLSocketFactory (sslsf). Build ();} catch (Exception ex) {logger.error (ex.getMessage (), ex);} return HttpClients.createDefault ();}

In this way, the HTTPS service can be invoked normally. However, when our service is deployed to the online environment, because the production machine cannot find the domain name of the external interface, host is configured to point to the Nginx server where the external interface is located, but the request keeps reporting an error: doesn't match any of the subject alternative names: []. Call the API with curl-k to report a (35) SSL connect error error. At that time, it was suspected that the openssl version of the linux machine was a problem, so a forced upgrade of a version still did not solve. Later, we know that curl has a parameter of-v. The error message is as follows:

* Initializing NSS with certpath: sql:/etc/pki/nssdb* CAfile: / etc/pki/tls/certs/ca-bundle.crt CApath: none* NSS error-5990 * Closing connection # 0* SSL connect errorcurl: (35) SSL connect error

So according to the online process to upgrade the nss version, and finally curl-k can transfer the service. However, the error is still reported through httpclient, so the problem of openssl can be eliminated. So we can only analyze the difference between the test environment and the production environment to see where the problem appears.

Later, by consulting colleagues on the external interface, we learned that their external interface service was connected to the company's internal intelligent gateway, and the intelligent gateway was configured with a unified HTTPS certificate. And as long as the service of the intelligent gateway is connected, the request will first pass through the intelligent gateway and then be forwarded to their own server. However, the production environment and the intelligent gateway are not on the same network, and the domain names of the external interfaces can not be resolved, so they can only be mapped to their Nginx servers through host. Take a look at the network topology of the external interface requested by the test environment:

The test environment requests the network topology

Request network topology for production environment:

Production environment requests network topology

Finally, we can see that the main reason why the test environment can be adjusted is that it can resolve the corresponding domain name in the internal DNS server. On the other hand, the production environment is mapped through host. When parsing a domain name, it is found that the current network does not have the domain name, so an error doesn't match any of the subject alternative names: [] is reported. At that time, there were two ways of thinking, the first one: can you turn on the permission to access the intelligent gateway in the production environment, and then go directly to the domain name, but the company does not know what consideration it is based on and is not allowed to do so. Second: whether http client supports the operation of not resolving domain names. Indeed, http client can set the policy of not resolving host, and adjust the code for creating SSLClient to the following code:

Private static CloseableHttpClient createSSLClientDefault () {try {SSLContextBuilder builder = new SSLContextBuilder (); builder.loadTrustMaterial (null, new TrustSelfSignedStrategy ()); / / No hostname verification SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory (builder.build (), NoopHostnameVerifier.INSTANCE) Registry registry = RegistryBuilder.create () .register ("http", new PlainConnectionSocketFactory ()) .register ("https", sslConnectionSocketFactory) .build ()

PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager (registry); cm.setMaxTotal (100); CloseableHttpClient httpclient = HttpClients.custom () .setSSLSocketFactory (sslConnectionSocketFactory) .setDefaultCookieStore (new BasicCookieStore ()) .setConnectionManager (cm). Build (); return httpclient;} catch (Exception e) {logger.error ("createSSLClientDefault error", e) } return null;}

The problem can be solved. A small problem with https does cost me a lot of time. Record it.

The above is how to solve the problem of online Https request error report, the editor believes that there are some knowledge points that we may see or use in our daily work. I hope you can learn more from this article. For more details, please follow the industry information channel.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.