9
问题
我一直在使用 Java 17 和 TLSv1.3。在为 TLSv1.3 指定正确的 TLS_CHACHA20_POLY1305_SHA256 并为 TLSv1.2 指定正确的 TLS_AES_256_GCM_SHA384 时，密码套件/协议不可用WebTestClient。这是相关的代码部分和日志。
server:
port: 8443
ssl:
enabled: true
key-store-type: PKCS12
key-store: classpath:keystore/localhost.p12
key-store-password: ${LOCALHOST_KEYSTORE_PASSWORD}
key-alias: localhost
ciphers:
- TLS_CHACHA20_POLY1305_SHA256
- TLS_AES_256_GCM_SHA384
- TLS_AES_128_GCM_SHA256
- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
enabled-protocols:
- TLSv1.3
- TLSv1.2 protected def getHttpClient(String protocol, List<String> cipherSuites) {
def httpClient = HttpClient
.create().secure({
it.sslContext(SslContextBuilder
.forClient()
.trustManager(InsecureTrustManagerFactory.INSTANCE)
.protocols(protocol)
.ciphers(cipherSuites)
.build())
})
WebTestClient
.bindToServer(new ReactorClientHttpConnector(httpClient))
.baseUrl(getBaseUrl())
.build()
} def "when TLSv1.2 allowed cipher suite used then accepted"() {
given:
def client = getHttpClient(TestConstants.TLSV1_2, List.of("TLS_AES_256_GCM_SHA384"))
expect:
client
.get()
.uri("/posts/${TestConstants.TEST_UUID}")
.header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE)
.exchange()
.expectStatus().isOk()
}
def "when TLSv1.3 allowed cipher suite used then accepted"() {
given:
def client = getHttpClient(TestConstants.TLSV1_3, List.of("TLS_CHACHA20_POLY1305_SHA256"))
expect:
client
.get()
.uri("/posts/${TestConstants.TEST_UUID}")
.header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON_VALUE)
.exchange()
.expectStatus().isOk()
}