How to configure truststore at springboot

In this tutorial, we would like to setup a truststore in our springboot application. To support https in SpringBoot, we need to generate self-signed certificate by java keytool. I assume that a springboot application is ready. We are going to focus on keystore and truststore configuration.

In this step, we as a server. We need to generate a java keystore by keytool.

keytool -genkey -keyalg RSA -alias dataflow -keystore dataflow.jks -keypass dataflow -storepass dataflow -validity 365 -keysize 4096 -dname "CN=localhost, OU=spring"

if we run our application at local environment, CN set to localhost. eg. CN=localhost.

Now, we as a client. We want to generate client certificate. We named the keystore as client_keystore. The step is similar the step on top. 

keytool -genkey -keyalg RSA -alias client -keystore client_keystore.jks -keypass password -storepass password -validity 365 -keysize 4096 -dname "CN=user, OU=spring"

After that, We would like to convert keystore type from JKS to PCKS12 .

keytool -importkeystore -srckeystore client_keystore.jks -destkeystore client.p12 -srcstoretype JKS -deststoretype PKCS12 -srcstorepass password -deststorepass 123456 -destkeypass 123456 -srcalias client -destalias client

Generate certificate

keytool -export -keystore client_keystore.jks -alias client -file client.der -storepass password

Import certificate into truststore.jks

keytool -import -file client.der -alias client -keystore truststore.jks -storepass 123456 -noprompt

For safety, remove the client_keystore.jks and client.der

# rm client_keystore.jks client.der

Now, let us configure application.yml. The parameter client-auth can be set to 'need' or 'want'

server:

  port: 8443

  ssl:

    enabled: true

    key-alias: dataflow

    key-store: /home/nicklim/tmp/keystore_tutorial/dataflow.jks

    key-store-type: jks

    key-store-password: dataflow

    key-password: dataflow

    trust-store: /home/nicklim/tmp/keystore_tutorial/truststore.jks

    trust-store-password: 123456

    trust-store-type: jks

    client-auth: need

Import key into chrome

Click Settings -> Advanced -> Privacy and security -> Manage Certificates. Import the client.p12 into Chrome.

You are able to run https://localhost:8443/test1 on chrome browser. Select the certificate which you have imported.

Finally, we are able to get the response from our server app.