Spring WebSocket配置TLS/SSL未生效，请求技术协助

问题背景 #

使用IntelliJ社区版+Maven搭建的Spring WebSocket服务可正常运行，但配置SSL参数后，Tomcat仍在8080端口以HTTP协议启动，未切换到HTTPS。已准备keystore.jks证书文件，路径与application.properties一致，配置项如下：

# Enable HTTPS
server.ssl.key-store-type=JKS
server.ssl.key-store=classpath:keystore.jks 
server.ssl.key-store-password=*****
server.ssl.key-alias=tomcat
server.ssl.enabled-protocols=TLSv1.2
server.ssl.protocol=TLS
server.ssl.enabled=true

WebSocket核心配置类：

package com.chess.web;

import org.springframework.context.annotation.Configuration;
import org.springframework.web.socket.config.annotation.EnableWebSocket;
import org.springframework.web.socket.config.annotation.WebSocketConfigurer;
import org.springframework.web.socket.config.annotation.WebSocketHandlerRegistry;

@Configuration
@EnableWebSocket
public class WebSocketConfig implements WebSocketConfigurer{

    @Override
    public void registerWebSocketHandlers(WebSocketHandlerRegistry registry){
        registry.addHandler(new ChessWebSocketHandler(), "/chess").setAllowedOrigins("*");
    }
}

启动类：

package com.chess.web;

import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.context.annotation.PropertySource;

@SpringBootApplication
@PropertySource("classpath:application.properties")
public class ChessGameApplication {

    public static void main(String[] args){
        SpringApplication.run(ChessGameApplication.class,args);
    }
}

排查要点 #

1. 配置加载验证：Spring Boot默认自动加载classpath:application.properties，添加@PropertySource可能导致配置加载冲突。可通过日志打印server.ssl.enabled值，确认配置是否被读取。
2. 端口配置缺失：Spring Boot默认HTTPS端口为8443，未指定server.port时，若SSL配置生效，服务应启动在8443而非8080。
3. 证书文件有效性：使用keytool命令验证keystore.jks：

   keytool -list -keystore keystore.jks
   

   输入密码后确认证书列表是否正常，且key-alias与配置中的tomcat一致。
4. 路径正确性：classpath:keystore.jks需确保文件在src/main/resources目录下（Maven项目资源目录），可临时改为绝对路径file:./keystore.jks测试。

解决方案 #

方案1：修正配置文件 #

调整application.properties，补充HTTPS端口并移除冗余注解：

# 指定HTTPS端口
server.port=8443
# 启用SSL
server.ssl.enabled=true
server.ssl.key-store-type=JKS
server.ssl.key-store=classpath:keystore.jks
server.ssl.key-store-password=你的证书密码
server.ssl.key-alias=tomcat
server.ssl.enabled-protocols=TLSv1.2
server.ssl.protocol=TLS

同时移除启动类中的@PropertySource("classpath:application.properties")，避免配置加载冲突。

启动后查看日志，若出现Tomcat started on port(s): 8443 (https)则说明配置生效，WebSocket客户端连接地址需改为wss://localhost:8443/chess。

方案2：Java代码手动配置Tomcat SSL #

若配置文件方式无效，可通过代码直接配置Tomcat连接器：

package com.chess.web;

import org.apache.catalina.connector.Connector;
import org.apache.coyote.http11.Http11NioProtocol;
import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

@Configuration
public class TomcatSslConfig {

    @Bean
    public TomcatServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
        tomcat.addAdditionalTomcatConnectors(createSslConnector());
        return tomcat;
    }

    private Connector createSslConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        Http11NioProtocol protocol = (Http11NioProtocol) connector.getProtocolHandler();
        try {
            connector.setPort(8443);
            connector.setSecure(true);
            connector.setScheme("https");
            protocol.setSSLEnabled(true);
            protocol.setKeystoreType("JKS");
            protocol.setKeystoreFile("classpath:keystore.jks");
            protocol.setKeystorePass("你的证书密码");
            protocol.setKeyAlias("tomcat");
            protocol.setSslProtocol("TLS");
            protocol.setEnabledProtocols(new String[] {"TLSv1.2"});
            return connector;
        } catch (Exception ex) {
            throw new IllegalStateException("SSL配置失败", ex);
        }
    }
}

此方式绕过配置文件直接控制Tomcat SSL参数，确保生效。

内容的提问来源于stack exchange，提问作者babilon1210