Spring Boot 3嵌入式Tomcat中如何设置HTTPS SSL加密套件优先级

算力阿峰

2026-7-12

Spring Boot 3.x 配置Tomcat服务器端加密套件优先级替代方案

Spring Boot 3.x适配的Tomcat 10.1+版本中，AbstractHttp11Protocol类的setUseServerCipherSuitesOrder方法已被移除，相关SSL配置逻辑统一迁移到SSLHostConfig类中，你可以通过以下方式实现服务器端加密套件优先级设置：

调整WebServerFactoryCustomizer实现逻辑
继续使用WebServerFactoryCustomizer接口，但将配置目标切换为SSLHostConfig，示例代码如下：

import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.stereotype.Component;

@Component
public class TomcatSslCustomizer implements WebServerFactoryCustomizer<TomcatServletWebServerFactory> {

    @Override
    public void customize(TomcatServletWebServerFactory factory) {
        factory.addConnectorCustomizers(connector -> {
            // 获取或创建SSLHostConfig实例
            org.apache.tomcat.util.net.SSLHostConfig sslHostConfig = connector.findSslHostConfigs().length > 0 
                ? connector.findSslHostConfigs()[0] 
                : new org.apache.tomcat.util.net.SSLHostConfig();
            
            if (connector.findSslHostConfigs().length == 0) {
                connector.addSslHostConfig(sslHostConfig);
            }
            // 启用服务器端加密套件优先级排序
            sslHostConfig.setHonorCipherOrder(true);
        });
    }
}