If your Spring Boot app is running on embedded Tomcat, you need to use the TomcatConnectionCustomizer class to set up the HTTPS in Tomcat.
Get the source code
Source Code for this tutorial is available on my github under the SpringBootHttps tag: https://github.com/yacekmm/looksok/tree/SpringBootHttps
1. Prepare keystore and certificate
First you need to have your certificate. If you already have it, go to point 2., else, follow the step 1 and 2 from this tutorial: https://looksok.wordpress.com/2014/11/16/configure-sslhttps-on-tomcat-with-self-signed-certificate/
2. Put your keystore in defined location
You need to locate your keystore file in path on your machine. On my machine this is:
D:\keystore\server.p12
This path I will use in my app configuration.
3. Customize Tomcat Connection
Create class implementing the TomcatConnectorCustomizer, and override its customize(Connection) method. As you can see, in customize() I set exactly the same properties as in stantalone Tomcat xml configuration (see this post). Note that in class constructor I convert the alias string to lowercase – in keystore only these are allowed.
public class MyTomcatConnectionCustomizer implements TomcatConnectorCustomizer { private String absoluteKeystoreFile; private String keystorePassword; private String keystoreType; private String keystoreAlias; public MyTomcatConnectionCustomizer(String absoluteKeystoreFile, String keystorePassword, String keystoreType, String keystoreAlias) { this.absoluteKeystoreFile = absoluteKeystoreFile; this.keystorePassword = keystorePassword; this.keystoreType = keystoreType; this.keystoreAlias = keystoreAlias.toLowerCase(); } @Override public void customize(Connector connector) { connector.setPort(443); connector.setSecure(true); connector.setScheme("https"); connector.setAttribute("SSLEnabled", true); connector.setAttribute("sslProtocol", "TLS"); connector.setAttribute("protocol", "org.apache.coyote.http11.Http11Protocol"); connector.setAttribute("clientAuth", false); connector.setAttribute("keystoreFile", absoluteKeystoreFile); connector.setAttribute("keystoreType", keystoreType); connector.setAttribute("keystorePass", keystorePassword); connector.setAttribute("keystoreAlias", keystoreAlias); connector.setAttribute("keyPass", keystorePassword); } }
4. Create containerCustomizer Bean
Now to use the TomcatConnectionCustomizer, create the bean as follows:
@Bean public EmbeddedServletContainerCustomizer containerCustomizer() throws FileNotFoundException { final String absoluteKeystoreFile = ResourceUtils.getFile("D:\\keystore\\server.p12").getAbsolutePath(); final TomcatConnectorCustomizer customizer = new MyTomcatConnectionCustomizer( absoluteKeystoreFile, "keyPwd", "PKCS12", "keyalias"); return new EmbeddedServletContainerCustomizer() { @Override public void customize(ConfigurableEmbeddedServletContainer container) { if(container instanceof TomcatEmbeddedServletContainerFactory) { TomcatEmbeddedServletContainerFactory containerFactory = (TomcatEmbeddedServletContainerFactory) container; containerFactory.addConnectorCustomizers(customizer); } }; }; }
5. Test it
Start Spring Boot App and go to the:
https:\\127.0.0.1
Your browser will propably warn you about the untrusted certificate:
Note: Don’t use Self_signed certificates in production! Use it only in test / dev environment
Get the source code
Source Code for this tutorial is available on my github under the SpringBootHttps tag: https://github.com/yacekmm/looksok/tree/SpringBootHttps
Did I help you?
I manage this blog and share my knowledge for free, sacrificing my time. If you appreciate it and find this information helpful, please consider making a donation in order to keep this page alive and improve quality
Thank You!
Aren’t there properties you can define in application.properties that do the same ?
yes but if you’re putting your ssl keystore password in code in your app you’re a noob.
Don’t worry, here it’s for sake of simplicity. In production code i keep it externalized
thanks
Please share the Date from this post. I’m new to Spring and to read this is very confusing. Because it can be more easier than written here.