如何在Spring Boot 3中为Tomcat程序化配置自签名证书？

Tomcat 10 重构了SSL配置逻辑，原Http11NioProtocol中的setKeystoreFile、setKeystorePass等方法被移除，需通过SslHostConfig和SslHostConfigCertificate类来完成证书参数配置，替代代码如下：

@Component
public class MyTomcatWebServerFactoryCustomizer implements WebServerFactoryCustomizer<TomcatServletWebServerFactory> {

    // 替换为你的证书常量定义
    private static final String CERTIFICATE_PATH = "/path/to/your/keystore.jks";
    private static final String CERTIFICATE_PASSWORD = "your-keystore-password";
    private static final String KEYSTORE_TYPE = "JKS";
    private static final String CERTIFICATE_ALIAS = "your-cert-alias";

    @Override
    public void customize(TomcatServletWebServerFactory server) {
        server.addConnectorCustomizers(connector -> {
            // 标记连接器为HTTPS类型
            connector.setSecure(true);
            connector.setScheme("https");
            
            // 创建SSL主机配置实例
            SslHostConfig sslHostConfig = new SslHostConfig();
            sslHostConfig.setSslProtocol("TLS"); // 可根据需求调整SSL协议版本
            
            // 创建证书配置实例，指定证书类型为RSA（根据你的证书类型调整）
            SslHostConfigCertificate certificate = new SslHostConfigCertificate(sslHostConfig, SslHostConfigCertificate.Type.RSA);
            certificate.setCertificateKeystoreFile(CERTIFICATE_PATH);
            certificate.setCertificateKeystorePassword(CERTIFICATE_PASSWORD);
            certificate.setCertificateKeystoreType(KEYSTORE_TYPE);
            certificate.setCertificateKeyAlias(CERTIFICATE_ALIAS);
            
            // 将SSL配置添加到连接器
            connector.addSslHostConfig(sslHostConfig);
        });
    }
}

关键说明 #

• SslHostConfig负责SSL全局配置，比如协议版本、密码套件等，可通过对应setter方法扩展配置
• SslHostConfigCertificate负责具体的证书存储参数，对应原API中的keystore相关配置
• 若你的证书类型不是RSA，可替换SslHostConfigCertificate.Type为DSA或EC

内容的提问来源于stack exchange，提问作者gsrunion