AFAIK Tomcat doesn't support HTTP/2 so far. Therefore, I want to use Jetty (or Undertow as another alternative), but don't know how configure the Embedded Jetty so that the ALPN JAR file can be used. Any hint is appreciated.
Related
Since we are using spring boot with an embedded tomcat server, so there is no Apache.
How to enable strong Ciphersonly and disallow all the weak Ciphers.
For Apache, modify the SSLCipherSuite directive in the httpd.conf.
SSLCipherSuite HIGH:MEDIUM:!MD5:!RC4
But how to do this in spring boot?
In Spring you usually use the property server.ssl.ciphers for this, e.g.
server.ssl.ciphers=HIGH,MEDIUM,!MD5,!RC4
For embedded Tomcat you might need to do some customization as shown in How to set HTTPS SSL Cipher Suite Preference in Spring boot embedded tomcat
I'm searching about how to harden embedded tomcat according to CIS security Benchmark, how I can configure CATALINAHOME, BASE, and how can I configure the security manager with polices.
I did not find a flexible way to configure the embedded tomcat as stand-alone tomcat.
Any help regarding the customized of the embedded tomcat rather than the limited configuration in the applicaiton.properties .
Without SSL the following configurations to configure acceptors and selectors work fine.
server.jetty.acceptors=4
server.jetty.selectors=32
But when I enable SSL , then this configuration for Jetty in Spring Boot doesnt work. Tried using
jetty.ssl.acceptors=4
jetty.ssl.selectors=32
I am using Spring Boot with Embedded Jetty. Everytime it runs it configures 1 Acceptor in SSL mode. Any help is appreciated.
I am supposed to make an application with Spring Boot and WebSockets. But I should not use Jetty, JavaEE or Tomcat (or any other webcontainer servlet stuff). Is that even possible using "plain spring boot"???? Every example I am finding uses some kind of WebContainer. How would Spring Boot work without that to manage Http Connections and WebSocket communication?
I didnt find any working example with websockets and without a servlet. So it seems mandatory.
Is there a simple way to use (or reuse) external Jetty configuration files to configure an embedded Jetty web container with Spring Boot.
Programmatic configuration to change only the listening port for example is acceptable, but a full configuration including multiple connectors, thread pools, etc. seems to be better suited with usual Jetty files.
Thanks for your help.
Regards.
There's no support in Spring Boot for configuring Jetty via XML. You can use application.properties for simpler cases or programmatic configuration for things that are more complex.
Boot's Tomcat integration is a little bit ahead of its Jetty integration in terms of what you can configure via application.properties. For example, you can configure Tomcat's thread pool. If you'd like to see some improvements to the Jetty integration then please open an issue, or, even better, a pull request.