前言

  如果您觉得有用的话，记得给博主点个赞，评论，收藏一键三连啊，写作不易啊^ _ ^。
  而且听说点赞的人每天的运气都不会太差，实在白嫖的话，那欢迎常来啊!!!

---

SpringBoot 2.x 配置ssl - 自签证书/信用库

1. yml 配置

用于配置嵌入式 Tomcat 服务器及其 SSL/TLS 设置

server:
  port: 8088  # 默认端口
  tomcat:
    remote-ip-header: x-forwarded-for
    protocol-header: x-forwarded-proto
    uri-encoding: UTF-8
  ssl:
    key-store: classpath:yzy_service.p12 #服务端的证书
    key-store-password: yzy@yzy
    key-store-type: PKCS12
    key-alias: yzy_service # 指定服务端证书的别名
    trust-store: classpath:rootca.p12 #指向包含可信任客户端证书的信任库
    trust-store-password: changeit
    trust-store-type: PKCS12
    client-auth: need # 启用双向 TLS

  tomcat:
    remote-ip-header: x-forwarded-for
    protocol-header: x-forwarded-proto
    uri-encoding: UTF-8

remote-ip-header: 用于获取客户端的真实 IP 地址。设置为 x-forwarded-for 表示从此头部获取客户端 IP，通常用于负载均衡器或代理服务器的场景。
protocol-header: 用于获取原始协议（HTTP 或 HTTPS）。设置为 x-forwarded-proto 表示从此头部获取协议信息。
uri-encoding: 设置 URI 编码格式。这里设置为 UTF-8。

  ssl:
    key-store: classpath:yzy_service.p12 # 服务端的证书
    key-store-password: yzy@yzy
    key-store-type: PKCS12
    key-alias: yzy_service # 指定服务端证书的别名
    trust-store: classpath:rootca.p12 # 指向包含可信任客户端证书的信任库
    trust-store-password: changeit
    trust-store-type: PKCS12
    client-auth: need # 启用双向 TLS

key-store: 指定服务端证书的路径。这里是一个类路径下的 yzy_service.p12 文件，存储服务端的私钥和公钥证书。
key-store-password: 用于访问密钥库的密码。
key-store-type: 指定密钥库类型，这里是 PKCS12。
key-alias: 指定要使用的服务端证书的别名。
trust-store: 指向包含可信任客户端证书的信任库。这里是一个类路径下的 rootca.p12 文件。
trust-store-password: 用于访问信任库的密码。
trust-store-type: 指定信任库类型，这里是 PKCS12。
client-auth: 设置为 need 表示需要客户端认证，即启用双向 TLS。

2. 当服务器为客户端发送https请求时改造

这里以RestTemplate为例子。
改造内容:

1. 发送https时要带上证书；
2. 服务端验证的时候将主机验证关闭；

改造代码:

package org.example.config;

import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContextBuilder;
import org.example.common.ServerX509TrustHandler;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Primary;
import org.springframework.core.io.Resource;
import org.springframework.core.io.ResourceLoader;
import org.springframework.http.client.ClientHttpRequest;
import org.springframework.http.client.ClientHttpRequestFactory;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.http.client.SimpleClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import java.io.FileInputStream;
import java.io.InputStream;
import java.security.KeyManagementException;
import java.security.KeyStore;
import java.security.NoSuchAlgorithmException;
import java.util.function.Supplier;

@Configuration
public class RestTemplateSslConfig {

    @Value("${server.ssl.key-store}")
    private String keyStorePath;

    @Value("${server.ssl.key-store-password}")
    private String keyStorePassword;

    @Value("${server.ssl.trust-store}")
    private String trustStorePath;

    @Value("${server.ssl.trust-store-password}")
    private String trustStorePassword;
    private final ResourceLoader resourceLoader;

    public RestTemplateSslConfig(ResourceLoader resourceLoader) {
        this.resourceLoader = resourceLoader;
    }

    @Bean
    public RestTemplate restTemplate() throws Exception {
        Resource keyStoreResource = resourceLoader.getResource(keyStorePath);
        Resource trustStoreResource = resourceLoader.getResource(trustStorePath);
        KeyStore keyStore = KeyStore.getInstance("PKCS12");
        try (InputStream keyStoreInputStream = keyStoreResource.getInputStream()) {
            keyStore.load(keyStoreInputStream, keyStorePassword.toCharArray());
        }

        KeyStore trustStore = KeyStore.getInstance("PKCS12");
        try (InputStream trustStoreInputStream = trustStoreResource.getInputStream()) {
            trustStore.load(trustStoreInputStream, trustStorePassword.toCharArray());
        }

        SSLContext sslContext = SSLContextBuilder.create()
                .loadKeyMaterial(keyStore, keyStorePassword.toCharArray())
                .loadTrustMaterial(trustStore, null)
                .build();

        SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);

        CloseableHttpClient httpClient = HttpClients.custom()
                .setSSLSocketFactory(socketFactory)
                .build();

        HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);

        return new RestTemplate(factory);
    }
}