如何在Spring Boot中复用SSL Bundle创建非mTLS的Tomcat连接器

核心思路 #

直接复用Spring Boot已配置的server SSL Bundle，为8444端口的连接器单独关闭客户端认证，无需重复指定PEM文件路径，也不需要自定义SSLContext Bean。

步骤1：移除自定义的SslConfiguration类 #

Spring Boot已通过SslBundles自动管理SSL Bundle，无需手动创建SSLContext Bean，删除以下代码：

@Configuration
public class SslConfiguration {
    @Bean
    public SSLContext sslContext(SslBundles sslBundles) {
        return sslBundles.getBundle("server").createSslContext();
    }
}

步骤2：修改Tomcat连接器配置类 #

直接注入SslBundles，复用server Bundle的证书/私钥，同时关闭客户端认证：

@Configuration 
public class TomcatConnectorConfig {

    private int tlsPort = 8444;
    private final SslBundles sslBundles;

    public TomcatConnectorConfig(SslBundles sslBundles) {
        this.sslBundles = sslBundles;
    }

    @Bean
    public TomcatServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory factory = new TomcatServletWebServerFactory();
        factory.addAdditionalTomcatConnectors(createTlsConnector());
        return factory;
    }

    private Connector createTlsConnector() {
        Connector connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
        connector.setPort(tlsPort);
        connector.setSecure(true);
        connector.setScheme("https");

        // 获取已配置的server SSL Bundle
        SslBundle serverBundle = sslBundles.getBundle("server");
        SslStoreBundle storeBundle = serverBundle.getStores();

        // 配置SSLHostConfig，关闭客户端认证
        SSLHostConfig sslHostConfig = new SSLHostConfig();
        sslHostConfig.setSslProtocol("TLS");
        sslHostConfig.setClientAuth(SSLHostConfig.ClientAuth.NONE); // 关键：禁用mTLS

        // 复用Bundle中的证书和私钥
        SSLHostConfigCertificate certificate = new SSLHostConfigCertificate(sslHostConfig, SSLHostConfigCertificate.Type.RSA);
        certificate.setCertificateKeystore(storeBundle.getKeyStore());
        certificate.setCertificateKeyAlias(serverBundle.getKey().getAlias());

        sslHostConfig.addCertificate(certificate);
        connector.addSslHostConfig(sslHostConfig);
        
        return connector;
    }
}

关键说明 #

• 复用server Bundle的密钥库（证书+私钥），保证8444端口与8443端口使用同一套PEM证书配置。
• 通过sslHostConfig.setClientAuth(SSLHostConfig.ClientAuth.NONE)关闭强制客户端认证，实现单向TLS访问。
• 无需手动处理SSLContext，直接利用Tomcat的SSLHostConfig与Spring Boot的SslBundles集成，避免配置不一致问题。

内容的提问来源于stack exchange，提问作者Dhruv Agarwal