企业微信API接口对接中Java后端的HTTPS证书配置与数据传输加密技巧

1. 企业微信通信的安全要求

企业微信所有API均使用TLS 1.2+。在Java后端对接时需处理：

• 客户端调用API时的HTTPS信任链验证；
• 接收回调事件时的自签名证书兼容（如内网穿透调试）；
• 敏感数据（如用户手机号、客户信息）在内存与日志中的脱敏。

错误的SSL配置将导致 javax.net.ssl.SSLHandshakeException 或中间人攻击风险。

2. 标准HTTPS调用（信任CA证书）

企业微信使用由可信CA签发的证书，无需额外配置：

package wlkankan.cn.wecom.http;

import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class StandardHttpsConfig {

    @Bean("wecomHttpClient")
    public CloseableHttpClient wecomHttpClient() {
        // 默认信任系统CA，适用于生产环境
        return HttpClients.createDefault();
    }
}

调用示例：

package wlkankan.cn.wecom.service;

import wlkankan.cn.wecom.http.StandardHttpsConfig;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.util.EntityUtils;

@Service
public class TokenService {

    private final CloseableHttpClient httpClient;

    public TokenService(@Qualifier("wecomHttpClient") CloseableHttpClient httpClient) {
        this.httpClient = httpClient;
    }

    public String fetchToken(String corpId, String secret) throws Exception {
        String url = "https://qyapi.weixin.qq.com/cgi-bin/gettoken?corpid=" + corpId + "&corpsecret=" + secret;
        HttpGet get = new HttpGet(url);
        try (var resp = httpClient.execute(get)) {
            return EntityUtils.toString(resp.getEntity(), StandardCharsets.UTF_8);
        }
    }
}

3. 跳过证书验证（仅限开发/内网调试）

严禁在生产环境使用！

package wlkankan.cn.wecom.http;

import javax.net.ssl.*;
import java.security.cert.X509Certificate;

public class UnsafeSSL {

    public static SSLContext createUnsafeSSLContext() {
        try {
            SSLContext sslContext = SSLContext.getInstance("TLS");
            sslContext.init(null, new TrustManager[]{new X509TrustManager() {
                @Override
                public void checkClientTrusted(X509Certificate[] chain, String authType) {}
                @Override
                public void checkServerTrusted(X509Certificate[] chain, String authType) {}
                @Override
                public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }
            }}, new java.security.SecureRandom());
            return sslContext;
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    public static CloseableHttpClient createUnsafeClient() {
        SSLConnectionSocketFactory factory = new SSLConnectionSocketFactory(
            createUnsafeSSLContext(),
            NoopHostnameVerifier.INSTANCE
        );
        return HttpClients.custom()
            .setSSLSocketFactory(factory)
            .build();
    }
}

4. 自定义信任特定证书（推荐方案）

从企业微信服务器导出证书（或使用其CA），加载到Java Keystore：

# 导出证书
openssl s_client -connect qyapi.weixin.qq.com:443 < /dev/null | openssl x509 > wecom.crt
# 导入到JKS
keytool -import -alias wecom -file wecom.crt -keystore wecom-truststore.jks

Java加载：

package wlkankan.cn.wecom.http;

import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;

import javax.net.ssl.SSLContext;
import java.io.InputStream;
import java.security.KeyStore;

public class CustomTrustStoreSSL {

    public static CloseableHttpClient createClientWithTrustStore(String path, String password) {
        try (InputStream is = CustomTrustStoreSSL.class.getResourceAsStream(path)) {
            KeyStore trustStore = KeyStore.getInstance("JKS");
            trustStore.load(is, password.toCharArray());

            SSLContext sslContext = org.apache.http.ssl.SSLContexts.custom()
                .loadTrustMaterial(trustStore, null)
                .build();

            SSLConnectionSocketFactory factory = new SSLConnectionSocketFactory(sslContext);

            return HttpClients.custom()
                .setSSLSocketFactory(factory)
                .build();
        } catch (Exception e) {
            throw new RuntimeException("Failed to load truststore", e);
        }
    }
}

Spring配置：

@Bean("secureWecomClient")
public CloseableHttpClient secureWecomClient() {
    return CustomTrustStoreSSL.createClientWithTrustStore("/wecom-truststore.jks", "changeit");
}

5. 回调URL的HTTPS服务端配置

当企业微信向你的服务器推送事件时，你的服务必须提供有效HTTPS。使用Let’s Encrypt证书：

// application.properties
server.port=443
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=your_password
server.ssl.key-store-type=PKCS12
server.ssl.key-alias=tomcat

控制器示例（自动解密消息）：

package wlkankan.cn.wecom.controller;

import wlkankan.cn.wecom.crypto.WXBizMsgCrypt;
import org.springframework.web.bind.annotation.*;

@RestController
public class CallbackController {

    @PostMapping("/wecom/callback")
    public String handleCallback(@RequestParam String msg_signature,
                                 @RequestParam String timestamp,
                                 @RequestParam String nonce,
                                 @RequestBody String postData) {
        try {
            WXBizMsgCrypt pc = new WXBizMsgCrypt("token", "aes_key", "corp_id");
            String decrypted = pc.decryptMsg(msg_signature, timestamp, nonce, postData);
            // 处理 decrypted XML
            return "success";
        } catch (Exception e) {
            return "error";
        }
    }
}

6. 敏感数据内存加密

避免明文存储access_token或用户信息：

package wlkankan.cn.wecom.security;

import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
import java.util.Base64;

public class DataEncryptor {

    private static final String ALGORITHM = "AES";
    private static final byte[] KEY = "wlkankan_cn_2026".getBytes(); // 16字节

    public static String encrypt(String data) {
        try {
            SecretKeySpec keySpec = new SecretKeySpec(KEY, ALGORITHM);
            Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
            cipher.init(Cipher.ENCRYPT_MODE, keySpec);
            return Base64.getEncoder().encodeToString(cipher.doFinal(data.getBytes()));
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }

    public static String decrypt(String encrypted) {
        try {
            SecretKeySpec keySpec = new SecretKeySpec(KEY, ALGORITHM);
            Cipher cipher = Cipher.getInstance("AES/ECB/PKCS5Padding");
            cipher.init(Cipher.DECRYPT_MODE, keySpec);
            return new String(cipher.doFinal(Base64.getDecoder().decode(encrypted)));
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
}

在Redis中存储加密后的token：

redisTemplate.opsForValue().set("token:" + corpId, DataEncryptor.encrypt(token), 7100, SECONDS);

7. 日志脱敏处理

使用Logback过滤器：

<!-- logback-spring.xml -->
<configuration>
  <conversionRule conversionWord="masked" converterClass="wlkankan.cn.wecom.log.MaskingConverter" />
  <appender name="STDOUT" class="ch.qos.logback.core.ConsoleAppender">
    <encoder>
      <pattern>%d{HH:mm:ss.SSS} [%thread] %-5level %logger{36} - %masked(%msg)%n</pattern>
    </encoder>
  </appender>
</configuration>

实现脱敏逻辑：

package wlkankan.cn.wecom.log;

import ch.qos.logback.classic.pattern.MessageConverter;
import ch.qos.logback.classic.spi.ILoggingEvent;

public class MaskingConverter extends MessageConverter {
    @Override
    public String convert(ILoggingEvent event) {
        String msg = super.convert(event);
        if (msg != null) {
            msg = msg.replaceAll("access_token=[^&\\s]+", "access_token=***");
            msg = msg.replaceAll("\"mobile\":\"[^\"]+\"", "\"mobile\":\"***\"");
        }
        return msg;
    }
}

通过严格管理HTTPS证书信任链、服务端TLS配置、内存数据加密与日志脱敏，可构建符合企业微信安全规范的高可靠对接系统。