I have configured my trustsore and keystore information in the external tomcat's server.xml in the Connector tag. The certificates are stored in the tomcat's /base/lib directory.
I need to deploy a spring boot application to this external tomcat.
How can I make the information about trustsore and keystore available to the spring boot application?
Where in the spring boot application do I need to store the trsustore and keystore .jks files?
I did the same with the datasource in Resource tag in server.xml, and in spring boot application I used
spring.datasource.jndi-name=some name to jndi. How can I configure the same for trsustore and keystore?
The keystore and truststore in Tomcat's <Connector> have a single purpose:
the keystore contains the certificate (and private key) used by the server's SSL port,
the truststore contains the list of CAs, which are trusted if mutual SSL authentication is enabled.
Therefore these settings are specific to each deployment of your application. You shouldn't provide them yourself.
You should only provide system administrators a way to configure those settings. In your case Spring Boot already takes care of it (cf. server.ssl properties).
See also:
What is the difference between javax.net.ssl.keyStore and server.ssl.key-store properties when specifying keystore for a SpringBoot app
Related
I need to enable SSL to my Spring boot application, So please guide to create a p12 Keystore using the below files for a Spring boot application.
****.crt
****.pem
gd_bundle****.crt
The use case is, in spring boot application,
I am using jks truststore, and I want my application to update the truststore in context if it is updated at runtime without application restart.
/**set truststore before you code create the connection, file is ***.jks file*/
System.setProperty("javax.net.ssl.trustStrore",file.getPath());
System.setProperty("javax.net.ssl.trustStrorePassword","changeit");
System.setProperty("https.protocols","TLSv1.2,TLSv1.1,SSLv3");
I have two different spring boot application with SSL enabled in it and also there is an eureka discovery server and these two applications are linked to eureka server.I need to make some https call between these two SSL enabled applications. So I decided to go ahead with feign client .Eureka is able to resolve https url properly for feign client. But while making the call I'm getting "unable to find valid certification path to requested target". I can understand this error is because public key of my client application is not present in truststore of the application from which I'm making feign call. I have already added the public key in my custom truststore, But it is of no use.Property file for the same is below
server.ssl.enabled=true
server.ssl.key-store=classpath:springboot.p12
server.ssl.key-store-password= Pass#123
server.ssl.keyStoreType= PKCS12
server.ssl.keyAlias= springboot
server.ssl.trust-store=classpath:springboot.jks
server.ssl.trust-store-password=Pass#123
eureka.instance.nonSecurePortEnabled=false
eureka.instance.securePortEnabled=true
After digging more into the issue I found that "server.ssl.trust-store" property will set truststore in the embeded tomcat server of spring boot application, But some have my https call is taking default JDK truststore. When I added system properties in my application then everything is working fine. But with spring boot properties file configuration it is not working .
System.setProperty("javax.net.ssl.trustStore", trustStorePath);
System.setProperty("javax.net.ssl.trustStorePassword",trustStorePassword);
I feel setting system properties is an workaround and I'm looking for a better solution .
I even tried enabling ribbon client and added "ribbon.IsSecure=true" property also. But still getting the same issue.
Can someone please provide a suggestion for the same.
Thank you
I have a spring boot application running on SSL programmatically using TomcatServletWebServerFactory where we set the following from configuration file:
proto.setSSLCertificateKeyFile(classLoader.getResource(certificateKeyFile).getPath());
proto.setSSLCertificateFile(classLoader.getResource(certificateFile).getPath());
proto.setSSLCertificateChainFile(classLoader.getResource(certificateChainFile).getPath());
However, i would like to enable on SSL on the actuator endpoint too. I found online that we do this using the following in application.properties:
management.server.ssl.enabled=true
management.server.ssl.key-store=
management.server.ssl.key-password=
This is not working in my case as i need to reuse the above certificate. If i add an additional connector to TomcatServletWebServerFactory programmatically, it throws an error as already bind port as if actuator have different tomcat connector. How can i programmatically enable SSL on actuator while providing the certificate files as above?
I ended up removing my programmed configuration and used the following:
security.require-ssl=true
server.ssl.key-store-type=PKCS12
server.ssl.key-store=classpath:name.pfx
server.ssl.key-store-password=password
without using SSL of actuator: management.server.ssl.xxx configuration
I am new to spring web services and am currently trying to implement spring-ws security for secure transport and encryption/decryption of incoming and outgoing SOAP messages. We have a keystore on our server that is installed in the conf directory under Tomcat. How do I reference that keystore in my spring web app? I'd like to avoid having to move the keystore since it will be utilized by other applications in the future. I've searched for answers most of yesterday, but all the examples I've come across put the keystore file on the class path.
I am assuming you are using WSS4J with Spring-WS, you can put any valid resource to refer to the certificate location.
eg.
<property name="keyStoreLocation" value="file://C:/tomcat/.."/>