我正在使用Spring Boot Framework开发带有嵌入式Tomcat的Web应用程序。需要为多个端口获得一些https连接。

为此,我使用了SpringApplicationBuilder,如下所示:

SpringApplicationBuilder parentBuilder
            = new SpringApplicationBuilder(ApplicationConfiguration.class);

    parentBuilder.child(WithoutClientAuth.class)
            .properties("server.port:8443")
            .properties("security.require_ssl=true")
            .properties("ssl.key-store=server.jks")
            .properties("ssl.key-store-password=password")
            .properties("ssl.key-password=password")
            .run(args);

    parentBuilder.child(WithClientAuth.class)
            .properties("server.port:9443")
            .properties("security.require_ssl=true")
            .properties("ssl.key-store=server.jks")
            .properties("ssl.key-store-password=password")
            .properties("ssl.key-password=password")
            .run(args);


但是,启动应用程序后,通信协议并不安全。可以在输出中看到:

TomcatEmbeddedServletContainer : Tomcat initialized with port(s):  9443 (http)
StandardService                : Starting service Tomcat
StandardEngine                 : Starting Servlet Engine: Apache Tomcat/8.5.4


您是否有以这种方式进行安全通信的想法?

最佳答案

您用于SSL配置的属性错误。它们都应以server.为前缀:

parentBuilder.child(WithoutClientAuth.class)
        .properties("server.port:8443")
        .properties("security.require_ssl=true")
        .properties("server.ssl.key-store=server.jks")
        .properties("server.ssl.key-store-password=password")
        .properties("server.ssl.key-password=password")
        .run(args);

10-01 22:18