securityspring-bootsslssl-certificateserver-configuration

Using wildcard ssl certificate for Spring Boot backend

I have acquired a wildcard SSL certificate from my hoster (Hoster X) for my domain, e.g. domain.com.

Now I have a Spring Boot Backend running on Server A (Not hosted at Hoster X, IP: 1.1.1.1, URL: api.domain.com) and my Frontend running on another Server B (Hosted at Hoster X, IP:2.2.2.2, URL app.domain.com).

The redirection of api.domain.com to the IP 1.1.1.1 is set via an A Resource Record in the DNS configuration of Hoster X because domain.com is registered here.

enter image description here

What's the general approach here to install the certificate on my Spring Boot Backend so that the communication between my Frontend and Backend is secured? Do I have to download the wildcard certificate to install it into the backends keystore? For what I can tell I can only configure the SSL certificate in my hosters menu on domains which are hosted on Hoster X Servers.

Solution

  • On the backend server, merge the private key file, the certificate file and the CA file into a pkcs12 keystore with openssl and the following command:

    openssl pkcs12 -export -in <certfile> -inkey <keyfile> -out <keystorefile> -name tomcat -CAfile <cacertfile> -caname root

    You are prompted to enter a keystore password. Now copy the generated keystore file (extension 'p12') to the Spring Boot application's resources directory.

    Now set the Spring Boot SSL configuration in the application.yml:

    server:
    port: 8443

# Spring SSL configuration
    ssl:
        enabled: true
        key-store: classpath:keystore.p12
        key-store-password: "<KeystorePassword>"
        keyStoreType: PKCS12
        keyAlias: tomcat

    Alternatively, copy the keystore.p12 somewhere on the backend server and point to the location with the absolute path:

    server:
    ssl:
        key-store: /path/to/keystore.p12

    It is important to create an A Record in the DNS settings on the Frontend machine, so that all Frontend requests to the Backend go via a call to the domain and not the IP since the wildcard certificate is only valid for the domain.