启用HTTPS

server.port=8443
server.ssl.key-store=classpath:keystore.jks
server.ssl.key-store-password=secret
server.ssl.key-password=another-secret

management server可以使用不同的端口，不使用HTTPS:

server.port=8443
server.ssl.enabled=true
server.ssl.key-store=classpath:store.jks
server.ssl.key-password=secret
management.server.port=8080
management.server.ssl.enabled=false

management server也可以使用不同的key store：

server.port=8443
server.ssl.enabled=true
server.ssl.key-store=classpath:main.jks
server.ssl.key-password=secret
management.server.port=8080
management.server.ssl.enabled=true
management.server.ssl.key-store=classpath:management.jks
management.server.ssl.key-password=secret

通过配置application.properties不支持同时启用HTTP和HTTPS，如要两者同时启用，推荐在配置文件中配置HTTPS，在程序中增加HTTP支持：

import org.apache.catalina.connector.Connector;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
import org.springframework.context.annotation.Bean;

/**
* Sample Application to show Tomcat running two connectors.
*
* @author Brock Mills
* @author Andy Wilkinson
*/
@SpringBootApplication
public class SampleTomcatTwoConnectorsApplication {

@Bean
public ServletWebServerFactory servletContainer() {
TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
tomcat.addAdditionalTomcatConnectors(createStandardConnector());
return tomcat;
}

private Connector createStandardConnector() {
Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
connector.setPort(0);
return connector;
}

public static void main(String[] args) {
SpringApplication.run(SampleTomcatTwoConnectorsApplication.class, args);
}

}

使用keytool生成证书：

keytool -genkeypair -alias itrunner -keyalg RSA -dname "cn=www.itrunner.org, ou=itrunner, o=itrunner, c=CN" -validity 365 -keystore keystore.jks -storepass secret -storetype pkcs12

调用HTTPS REST服务

在调用HTTPS REST服务时需要配置受信证书，可使用keytool导入证书，生成trust-store文件：

keytool -import -alias "my server cert" -file server.crt -keystore my.truststore

Java默认受信证书存储在${JAVA_HOME}/jre/lib/security/cacerts内，初始密码为"changeit"，可使用keytool查看：

keytool -list -keystore cacerts -v

也可自定义信任策略(TrustStrategy)，忽略标准的信任验证流程。下面分别示例使用Spring RestTemplate和JAX-RS调用HTTPS REST服务，忽略验证证书和Hostname。

RestTemplate

import org.apache.http.client.HttpClient;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.ssl.SSLContextBuilder;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;

import javax.net.ssl.SSLContext;
import java.security.cert.X509Certificate;

public class HttpsRest {
public static void main(String[] args) throws Exception {
SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(null, (X509Certificate[] x509Certificates, String s) -> true).build();
SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, new String[]{"SSLv3", "TLSv1", "TLSv1.2"}, null, NoopHostnameVerifier.INSTANCE);

HttpClient httpClient = HttpClientBuilder.create().setSSLSocketFactory(sslSocketFactory).build();
HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(httpClient);

RestTemplate restTemplate = new RestTemplate(requestFactory);
restTemplate.postForObject(url, request, responseType);
}
}

JAX-RS

如使用Jboss服务器，配置如下依赖：

<dependency>
<groupId>org.jboss.spec.javax.ws.rs</groupId>
<artifactId>jboss-jaxrs-api_2.1_spec</artifactId>
<version>1.0.2.Final</version>
<scope>provided</scope>
</dependency>

示例代码：

import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.ssl.SSLContextBuilder;

import javax.net.ssl.SSLContext;
import javax.ws.rs.client.Client;
import javax.ws.rs.client.ClientBuilder;
import javax.ws.rs.client.Entity;
import javax.ws.rs.core.MediaType;
import java.security.cert.X509Certificate;

public class HttpsRest {
public static void main(String[] args) throws Exception {
SSLContext sslContext = SSLContextBuilder.create().loadTrustMaterial(null, (X509Certificate[] x509Certificates, String s) -> true).build();
Client client = ClientBuilder.newBuilder().hostnameVerifier(NoopHostnameVerifier.INSTANCE).sslContext(sslContext).build();
Entity<User> requestEntity = Entity.entity(new User(), MediaType.APPLICATION_JSON_TYPE);
client.target(url).request().post(requestEnti
b68
ty, responseType);
client.close();
}
}

参考文档

Spring Boot Reference Guide
spring-boot-sample-tomcat-multi-connectors