# 生成密鑰庫(kù)（JKS格式）
keytool -genkeypair \
  -alias mydomain \
  -keyalg RSA \
  -keysize 2048 \
  -validity 365 \
  -keystore keystore.jks \
  -storepass changeit \
  -dname "CN=localhost, OU=Dev, O=MyCompany, L=Beijing, ST=BJ, C=CN"

# 導(dǎo)出證書(shū)（用于客戶(hù)端導(dǎo)入）
keytool -exportcert \
  -alias mydomain \
  -keystore keystore.jks \
  -file certificate.crt \
  -storepass changeit

# 使用Certbot自動(dòng)獲取
sudo apt install certbot
sudo certbot certonly --standalone -d yourdomain.com

# 轉(zhuǎn)換證書(shū)為JKS格式
openssl pkcs12 -export \
  -in /etc/letsencrypt/live/yourdomain.com/fullchain.pem \
  -inkey /etc/letsencrypt/live/yourdomain.com/privkey.pem \
  -out keystore.p12 \
  -name mydomain \
  -passout pass:changeit

keytool -importkeystore \
  -srckeystore keystore.p12 \
  -srcstoretype PKCS12 \
  -destkeystore keystore.jks \
  -deststorepass changeit

server:
  port: 8443
  ssl:
    enabled: true
    key-store: classpath:keystore.jks
    key-store-password: changeit
    key-alias: mydomain
    key-password: changeit
    protocol: TLS
    enabled-protocols: TLSv1.2, TLSv1.3

@Configuration
public class HttpsRedirectConfig {

    @Bean
    public ServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection collection = new SecurityCollection();
                collection.addPattern("/*");
                securityConstraint.addCollection(collection);
                context.addConstraint(securityConstraint);
            }
        };
        tomcat.addAdditionalTomcatConnectors(redirectConnector());
        return tomcat;
    }

    private Connector redirectConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        connector.setPort(8080);
        connector.setSecure(false);
        connector.setRedirectPort(8443); // 重定向到HTTPS端口
        return connector;
    }
}

@Bean
public WebServerFactoryCustomizer<TomcatServletWebServerFactory> servletContainerCustomizer() {
    return factory -> factory.addAdditionalTomcatConnectors(
        createSslConnector(8443), // HTTPS端口
        createHttpConnector(8080)  // HTTP端口
    );
}

???????private Connector createSslConnector(int port) {
    Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
    Http11NioProtocol protocol = (Http11NioProtocol) connector.getProtocolHandler();
    try {
        connector.setScheme("https");
        connector.setPort(port);
        connector.setSecure(true);
        protocol.setSSLEnabled(true);
        protocol.setKeystoreFile("keystore.jks");
        protocol.setKeystorePass("changeit");
        protocol.setKeyAlias("mydomain");
        return connector;
    } catch (Exception ex) {
        throw new IllegalStateException("Failed to create SSL connector", ex);
    }
}

@Bean
public RestTemplate restTemplate() throws Exception {
    SSLContext sslContext = new SSLContextBuilder()
        .loadTrustMaterial(null, (certificate, authType) -> true).build();

    HttpClient client = HttpClients.custom()
        .setSSLContext(sslContext)
        .build();

    return new RestTemplate(new HttpComponentsClientHttpRequestFactory(client));
}

server:
  tomcat:
    remote-ip-header: x-forwarded-for
    protocol-header: x-forwarded-proto

server:
  ssl:
    ciphers: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
    enabled-protocols: TLSv1.3 # 禁用不安全的TLSv1.0/1.1

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .headers()
                .httpStrictTransportSecurity()
                    .maxAgeInSeconds(31536000) // 1年有效期
                    .includeSubDomains(true);
    }
}

# 添加定時(shí)任務(wù)
0 3 1 * * /usr/bin/certbot renew --quiet --post-hook "systemctl restart myapp"

# Nginx前端代理配置
upstream backend {
    server 127.0.0.1:8080;
}

server {
    listen 443 ssl http2;
    ssl_certificate /etc/letsencrypt/live/domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/domain.com/privkey.pem;
    
    location / {
        proxy_pass http://backend;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

management:
  endpoint:
    health:
      show-details: always
  endpoints:
    web:
      exposure:
        include: health,metrics