웹훅 발송 인증 우회(내부망만 사용)

src/main/java/com/eactive/eai/rms/ext/user/sync/RestTemplateConfiguration.java

@@ -1,24 +1,41 @@
 package com.eactive.eai.rms.ext.user.sync;
 
 import org.apache.http.client.HttpClient;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.conn.ssl.TrustAllStrategy;
 import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.ssl.SSLContextBuilder;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
 import org.springframework.web.client.RestTemplate;
 
+import javax.net.ssl.SSLContext;
+
 @Configuration
 public class RestTemplateConfiguration {
-	
+
 	@Bean
-	public HttpClient httpClient() {
-		
-		HttpClient httpClient = 
+	public HttpClient httpClient() throws Exception {
+
+		// 사내망 내부 CA(자체 발급) 인증서 체인을 JVM cacerts가 신뢰하지 못해 PKIX 오류가 나는 문제의
+		// 임시 우회. 인증서 체인/호스트명 검증을 모두 끄므로 MITM에 취약해진다 - 내부망 대상으로만 쓰고,
+		// 가능하면 해당 CA를 JVM 트러스트스토어에 등록하는 방식으로 대체할 것.
+		SSLContext sslContext = SSLContextBuilder.create()
+				.loadTrustMaterial(TrustAllStrategy.INSTANCE)
+				.build();
+
+		SSLConnectionSocketFactory sslSocketFactory =
+				new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
+
+		HttpClient httpClient =
 				HttpClientBuilder.create()
+				.setSSLSocketFactory(sslSocketFactory)
 				.setMaxConnTotal(50)
 				.setMaxConnPerRoute(20)
 				.build();
-		
+
 		return httpClient;
 	}