Shahul Basha
From the archive · 2020

How to Enable HTTPS (SSL/TLS) in a Java Spring Boot Application

Create a self-signed certificate with keytool, point Spring Boot at the keystore, and make Spring Security accept HTTPS requests only.

  • 2 min read
  • Spring Boot, HTTPS, TLS, Java

Archive note I wrote this in 2020 on my old blog. It moved here in 2026 with the code and diagrams redone; library versions and APIs may have changed since. Original post.

Contents

In this article we’ll enable HTTPS for a Spring Boot application.

HTTPS vs SSL vs TLS

HTTPS is the secure version of HTTP (Hypertext Transfer Protocol). SSL (Secure Sockets Layer) is the encryption protocol that protects communication over a network, and it’s what makes HTTPS secure. TLS (Transport Layer Security) is the successor to SSL; SSL itself has been deprecated. The name stuck, though, so people use SSL and TLS interchangeably.

Why HTTPS?

HTTPS gives you privacy, integrity and identification.

  • Privacy: data sent over the network is encrypted with TLS, so even if the traffic is intercepted it’s extremely hard to decrypt.
  • Integrity: the data reaches the intended receiver without being tampered with.
  • Identification: the sender and the receiver are who they say they are.

Enabling HTTPS in two steps

  1. Get an SSL certificate.
  2. Configure the Spring Boot application to use it.

Step 1: Get an SSL certificate

There are two ways to get a certificate:

  1. Create a self-signed certificate. This is fine for development and test environments.
  2. Use a certificate issued by a certificate authority (CA). You need this for production.

Keytool is the certificate management utility that ships with Java. We’ll use it to create a self-signed certificate. It generates a keystore file holding a private/public key pair and a certificate for the public key.

Shell
keytool -genkeypair -alias springboot -keyalg RSA -keysize 2048 \
  -storetype PKCS12 -keystore app.p12 -validity 3650

This command creates a key pair and stores it in a keystore file, app.p12, in PKCS12 format. After you press Enter, you’ll be asked for a password and some details such as your organisation name. A single keystore can hold more than one key pair.

PKCS12 (Public Key Cryptography Standards #12) is the industry-standard, language-neutral format for storing keys and certificates, and Spring Boot supports it. The other format Spring Boot supports is JKS (Java KeyStore), which is specific to Java.

To generate a JKS keystore instead:

Shell
keytool -genkeypair -alias springboot -keyalg RSA -keysize 2048 \
  -keystore app.jks -validity 3650

In production you don’t want a self-signed certificate. You need a certificate issued by a CA, imported into the keystore that holds its private key. This imports the CA-signed certificate cert.crt under the same alias:

Shell
keytool -import -alias springboot -file cert.crt -keystore app.p12

Step 2: Configure the Spring Boot application

Put the keystore file in the application’s resources folder, then add these properties to application.properties:

application.propertiesProperties
server.port=8443

server.ssl.key-store-type=PKCS12
server.ssl.key-store=classpath:app.p12
server.ssl.key-store-password=963852
server.ssl.key-alias=springboot

These are the values we used to create the keystore in step 1. Next, make Spring Security accept secure requests only:

SecurityConfig.javaJava
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .requiresChannel()
            .anyRequest()
            .requiresSecure();
    }
}

Plain HTTP requests to port 8443 are now rejected with 400 Bad Request. For a self-signed certificate, you can give the certificate to clients so their browsers trust your URL.

Conclusion

We created a self-signed certificate and enabled HTTPS in Spring Boot. If the project needs it, you can also configure the embedded server to redirect every HTTP request to HTTPS.

References

← All writing