SpringBoot2.x配置HTTPS访问,总体上可以分为两大步:一.生成SSL证书;二.配置HTTPS访问。
一.生成SSL证书
取得SSL证书的方法有:(1)阿里云购买免费的ssl证书 (2)用命令生成ssl证书
命令生成证书
keytool -genkey -alias tomcat -keypass 12345678 -keyalg RSA -keysize 2048 -validity 365 -keystore ./tomcat.keystore -storepass 12345678
生成客户端证书
keytool -genkey -alias client -keypass 12345678 -keyalg RSA -keysize 2048 -validity 365 -storetype PKCS12 -keystore ./client.p12 -storepass 12345678
二.配置HTTPS访问
将证书文件:client.p12复制到resources目录下
修改application.yml
修改启动类
添加servletContainer()和initiateHttpConnector()两个方法,完整代码如下:
package com.xxxx;
import org.apache.catalina.Context;
import org.apache.catalina.connector.Connector;
import org.apache.tomcat.util.descriptor.web.SecurityCollection;
import org.apache.tomcat.util.descriptor.web.SecurityConstraint;
import org.mybatis.spring.annotation.MapperScan;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.context.annotation.Bean;
@SpringBootApplication
@MapperScan({"com.xxxx.dao"})
public class WebsitebackApplication {
public static void main(String[] args) {
SpringApplication.run(WebsitebackApplication.class, args);
}
@Bean
public TomcatServletWebServerFactory servletContainer() { //springboot2 新变化
TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
@Override
protected void postProcessContext(Context context) {
SecurityConstraint securityConstraint = new SecurityConstraint();
securityConstraint.setUserConstraint("CONFIDENTIAL");
SecurityCollection collection = new SecurityCollection();
collection.addPattern("/*");
securityConstraint.addCollection(collection);
context.addConstraint(securityConstraint);
}
};
tomcat.addAdditionalTomcatConnectors(initiateHttpConnector());
return tomcat;
}
private Connector initiateHttpConnector() {
Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
connector.setScheme("http");
connector.setPort(8080);
connector.setSecure(false);
connector.setRedirectPort(8443);
return connector;
}
}
启动Springboot项目
浏览器访问 https://localhost:8443/getAllUser
问题:此方式只支持https访问,访问http端口会自动转到https方式访问。如果项目只需要https访问这样配置已经够用,如果需要http和https方式同时访问的话,继续看如下配置。
配置既能支持https又能支持http的方式如下:
1.修改application.yml,添加http port配置
server:
port: 8443 #注意,这里是https访问的的端口号
http:
port: 8081
ssl:
key-store: {path}\client.p12
key-store-password: 12345678
key-store-type: PKCS12
key-alias: client
还原启动类(WebsitebackApplication.java):删除或注释掉servletContainer和initiateHttpConnector方法
添加配置类TomcatConfig.java
import org.apache.catalina.connector.Connector;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@Configuration
public class TomcatConfig {
@Value("${server.http.port}")
private int httpPort;
@Bean
public ServletWebServerFactory servletContainer() {
TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
tomcat.addAdditionalTomcatConnectors(createStandardConnector()); // 添加http
return tomcat;
}
private Connector createStandardConnector() {
Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
connector.setPort(httpPort);
return connector;
}
}
这样配置就可以用http和https都能访问了。