May 5, 2023
How to Configure Spring Boot for HTTPS
Securing a Spring Boot application with HTTPS is a common requirement before shipping to production, and the good news is that Spring Boot makes it fairly painless once you know the pieces involved. Configuring HTTPS comes down to five steps: generating or obtaining an SSL certificate, configuring the SSL properties and web server, optionally redirecting HTTP requests to HTTPS, and testing the application.
1. Generate or Obtain an SSL Certificate
For local development and testing, a self-signed certificate is enough. For a production environment, you'll want a certificate issued by a trusted certificate authority instead.
2. Configure the SSL Properties
With the certificate in hand, point Spring Boot at your keystore in application.properties:
server.ssl.key-store-type=PKCS12
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=password
server.ssl.key-password=password3. Configure the Web Server
Spring Boot's default embedded web server is Tomcat, so you'll also want to set the port it should listen on and enable SSL explicitly:
server.port=8443
server.ssl.enabled=true
server.ssl.key-store-type=PKCS12
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=password
server.ssl.key-password=password4. Redirect HTTP to HTTPS (Optional)
If you'd like plain HTTP requests to be redirected automatically, add a configuration class that registers aTomcatServletWebServerFactory bean. That bean adds a security constraint requiring a confidential (HTTPS) channel, along with an additional connector that redirects traffic from port 8080 to port 8443.
5. Test the Application
Once everything is wired up, start the application and browse to https://localhost:8443/ to confirm HTTPS is working as expected.
In short, configuring a Spring Boot application for HTTPS involves generating or obtaining an SSL certificate, configuring the SSL properties and web server, optionally redirecting HTTP requests to HTTPS, and testing the application.