From 598dc5b1ee8a2078435ffd1ff4c03f305e905e96 Mon Sep 17 00:00:00 2001 From: eastargh Date: Thu, 27 Aug 2026 16:54:27 +0900 Subject: [PATCH] =?UTF-8?q?=EC=9B=B9=ED=9B=85=20=EB=B0=9C=EC=86=A1=20?= =?UTF-8?q?=EC=9D=B8=EC=A6=9D=20=EC=9A=B0=ED=9A=8C(=EB=82=B4=EB=B6=80?= =?UTF-8?q?=EB=A7=9D=EB=A7=8C=20=EC=82=AC=EC=9A=A9)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .../user/sync/RestTemplateConfiguration.java | 27 +++++++++++++++---- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/src/main/java/com/eactive/eai/rms/ext/user/sync/RestTemplateConfiguration.java b/src/main/java/com/eactive/eai/rms/ext/user/sync/RestTemplateConfiguration.java index 91b96f3..933ce4e 100644 --- a/src/main/java/com/eactive/eai/rms/ext/user/sync/RestTemplateConfiguration.java +++ b/src/main/java/com/eactive/eai/rms/ext/user/sync/RestTemplateConfiguration.java @@ -1,24 +1,41 @@ package com.eactive.eai.rms.ext.user.sync; import org.apache.http.client.HttpClient; +import org.apache.http.conn.ssl.NoopHostnameVerifier; +import org.apache.http.conn.ssl.SSLConnectionSocketFactory; +import org.apache.http.conn.ssl.TrustAllStrategy; import org.apache.http.impl.client.HttpClientBuilder; +import org.apache.http.ssl.SSLContextBuilder; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.http.client.HttpComponentsClientHttpRequestFactory; import org.springframework.web.client.RestTemplate; +import javax.net.ssl.SSLContext; + @Configuration public class RestTemplateConfiguration { - + @Bean - public HttpClient httpClient() { - - HttpClient httpClient = + public HttpClient httpClient() throws Exception { + + // 사내망 내부 CA(자체 발급) 인증서 체인을 JVM cacerts가 신뢰하지 못해 PKIX 오류가 나는 문제의 + // 임시 우회. 인증서 체인/호스트명 검증을 모두 끄므로 MITM에 취약해진다 - 내부망 대상으로만 쓰고, + // 가능하면 해당 CA를 JVM 트러스트스토어에 등록하는 방식으로 대체할 것. + SSLContext sslContext = SSLContextBuilder.create() + .loadTrustMaterial(TrustAllStrategy.INSTANCE) + .build(); + + SSLConnectionSocketFactory sslSocketFactory = + new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE); + + HttpClient httpClient = HttpClientBuilder.create() + .setSSLSocketFactory(sslSocketFactory) .setMaxConnTotal(50) .setMaxConnPerRoute(20) .build(); - + return httpClient; }