Spring Boot 1.5.6.RELEASE（Undertow）配置二级SSL监听器并开启client-auth=need

先确认你当前的application.yml配置已经正常启用了9443端口的SSL，这个配置没问题：

server:
  session:
    cookie:
      http-only: true
  contextPath: /webapp
  port: 9443
  ssl:
    key-store: /etc/pki/mycert.jks
    key-store-password: ${SSL_KEYSTORE_PWD}
    keyStoreType: JKS
    keyAlias: alias

接下来咱们补全并完善配置类，实现添加额外SSL监听器并设置client-auth=need（强制要求客户端证书认证）的需求：

import io.undertow.Undertow;
import io.undertow.UndertowOptions;
import io.undertow.util.SSLClientAuthMode;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.context.embedded.undertow.UndertowEmbeddedServletContainerFactory;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import java.io.FileInputStream;
import java.security.KeyStore;

@Configuration
public class UndertowAdditionalSSLConfig {

    // 直接读取application.yml中已配置的SSL参数，避免重复配置
    @Value("${server.ssl.key-store}")
    private String keyStorePath;

    @Value("${server.ssl.key-store-password}")
    private String keyStorePassword;

    @Value("${server.ssl.keyStoreType}")
    private String keyStoreType;

    @Value("${server.ssl.keyAlias}")
    private String keyAlias;

    @Bean
    public UndertowEmbeddedServletContainerFactory undertowEmbeddedServletContainerFactory() {
        UndertowEmbeddedServletContainerFactory factory = new UndertowEmbeddedServletContainerFactory();
        
        factory.addBuilderCustomizers(builder -> {
            try {
                // 构建和原有SSL配置一致的SSL上下文
                SSLContext sslContext = createSSLContext();
                
                // 添加额外的SSL监听器，示例用9444端口，可按需修改
                builder.addHttpsListener(9444, "0.0.0.0", sslContext)
                        // 设置强制客户端证书认证，对应client-auth=need
                        .setSocketOption(UndertowOptions.SSL_CLIENT_AUTH_MODE, SSLClientAuthMode.REQUIRED);
            } catch (Exception e) {
                throw new RuntimeException("创建额外SSL监听器失败", e);
            }
        });

        return factory;
    }

    private SSLContext createSSLContext() throws Exception {
        KeyStore keyStore = KeyStore.getInstance(keyStoreType);
        try (FileInputStream fis = new FileInputStream(keyStorePath)) {
            keyStore.load(fis, keyStorePassword.toCharArray());
        }

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(keyManagerFactory.getKeyManagers(), null, null);
        
        return sslContext;
    }
}

关键细节说明： #

• 参数复用：通过@Value直接读取已有配置，避免重复编写SSL密钥库相关参数；
• SSL上下文一致性：手动构建的SSL上下文和原有9443端口使用相同的密钥库，保证证书配置统一；
• 强制客户端认证：通过UndertowOptions.SSL_CLIENT_AUTH_MODE设置为SSLClientAuthMode.REQUIRED，完全对应你需要的client-auth=need；
• 端口自定义：示例中额外监听器用了9444端口，你可以根据业务需求修改为其他端口；
• 异常处理：将构建过程中的异常转为RuntimeException，确保启动时如果配置出错能快速定位问题。

配置完成后，你的应用会同时监听9443（原有SSL，无客户端认证强制）和9444（新SSL，强制客户端证书认证）两个端口，满足你的需求。

内容的提问来源于stack exchange，提问作者Jim Kennedy