I am using PEM based SSL Bundle in Spring Boot for mTLS APIs:

spring.ssl.bundle.pem.server.reload-on-update=true
spring.ssl.bundle.pem.server.keystore.certificate=/etc/spring/ssl/server.crt
spring.ssl.bundle.pem.server.keystore.private-key=/etc/spring/ssl/server.key
spring.ssl.bundle.pem.server.truststore.certificate=/etc/spring/ssl/rootCA.crt

# configure server to use "server" ssl bundle
server.port=8443
server.ssl.bundle=server
server.ssl.client-auth=need

I want some API endpoints to be accessible without mTLS, using one-sided TLS. For e.g. for healthCheck endpoints. So I am creating another Tomcat connector on port 8444 for TLS connection. This is the @Configuration file for Tomcat:

@Configuration 
public class TomcatConnectorConfig {

private int tlsPort = 8444;
private final SSLContext sslContext;

public TomcatConnectorConfig(SSLContext sslContext) {
    this.sslContext = sslContext;
}

@Bean
public TomcatServletWebServerFactory servletContainer(SSLContext sslContext) {
    TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
    factory.addAdditionalTomcatConnectors(createTlsConnector(sslContext));
    return factory;
}

private Connector createTlsConnector(SSLContext sslContext) {
    // Create a new connector using the default HTTPS protocol
    Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
    connector.setPort(tlsPort);
    connector.setSecure(true);
    connector.setScheme("https");

    // Create a new SSLHostConfig instance for this connector
    SSLHostConfig sslHostConfig = new SSLHostConfig();
    sslHostConfig.setSslProtocol("TLS"); // or "TLSv1.2" etc.

    SSLHostConfigCertificate certificate = new SSLHostConfigCertificate(sslHostConfig, SSLHostConfigCertificate.Type.RSA);
    certificate.setSslContext(sslContext.getDefault()); //This is a mismatch
    sslHostConfig.addCertificate(certificate);
    // Add the SSLHostConfig to the connector
    connector.addSslHostConfig(sslHostConfig);
    return connector;
}

} I am trying to use SSLContext provided by SSL Bundle here:

@Configuration
public class SslConfiguration {
    @Bean
    public SSLContext sslContext(SslBundles sslBundles) {
        return sslBundles.getBundle("server").createSslContext();
    }
}

How do I use this SSL Bundle within tomcat connector? I want to use the same PEM bundle with this port also

I am using PEM based SSL Bundle in Spring Boot for mTLS APIs:

spring.ssl.bundle.pem.server.reload-on-update=true
spring.ssl.bundle.pem.server.keystore.certificate=/etc/spring/ssl/server.crt
spring.ssl.bundle.pem.server.keystore.private-key=/etc/spring/ssl/server.key
spring.ssl.bundle.pem.server.truststore.certificate=/etc/spring/ssl/rootCA.crt

# configure server to use "server" ssl bundle
server.port=8443
server.ssl.bundle=server
server.ssl.client-auth=need

I want some API endpoints to be accessible without mTLS, using one-sided TLS. For e.g. for healthCheck endpoints. So I am creating another Tomcat connector on port 8444 for TLS connection. This is the @Configuration file for Tomcat:

@Configuration 
public class TomcatConnectorConfig {

private int tlsPort = 8444;
private final SSLContext sslContext;

public TomcatConnectorConfig(SSLContext sslContext) {
    this.sslContext = sslContext;
}

@Bean
public TomcatServletWebServerFactory servletContainer(SSLContext sslContext) {
    TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
    factory.addAdditionalTomcatConnectors(createTlsConnector(sslContext));
    return factory;
}

private Connector createTlsConnector(SSLContext sslContext) {
    // Create a new connector using the default HTTPS protocol
    Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
    connector.setPort(tlsPort);
    connector.setSecure(true);
    connector.setScheme("https");

    // Create a new SSLHostConfig instance for this connector
    SSLHostConfig sslHostConfig = new SSLHostConfig();
    sslHostConfig.setSslProtocol("TLS"); // or "TLSv1.2" etc.

    SSLHostConfigCertificate certificate = new SSLHostConfigCertificate(sslHostConfig, SSLHostConfigCertificate.Type.RSA);
    certificate.setSslContext(sslContext.getDefault()); //This is a mismatch
    sslHostConfig.addCertificate(certificate);
    // Add the SSLHostConfig to the connector
    connector.addSslHostConfig(sslHostConfig);
    return connector;
}

} I am trying to use SSLContext provided by SSL Bundle here:

@Configuration
public class SslConfiguration {
    @Bean
    public SSLContext sslContext(SslBundles sslBundles) {
        return sslBundles.getBundle("server").createSslContext();
    }
}

How do I use this SSL Bundle within tomcat connector? I want to use the same PEM bundle with this port also

• java
• spring-boot
• ssl
• tomcat
• pem

• Can you show configuration of SSLBundle what named client? – Vy Do Commented Mar 28 at 10:20
• Sorry, that should be server. Edited the post. – Dhruv Agarwal Commented Mar 31 at 3:47

1 Answer 1

It seems like you are in the right direction, but missing some small adjustments. Can you retry with the additiona following code in your createTlsConnector method?

AbstractHttp11Protocol<?> protocol = (AbstractHttp11Protocol<?>) connector.getProtocolHandler();
protocol.setSSLEnabled(true);
protocol.addSslHostConfig(sslHostConfig);