Using TLS on your Spring-Boot SOAP Service

Some time ago I wrote an article about how to implement a SOAP Service based on Camel-CXF in Spring Boot. This is one of those articles that make me feel happy, because it helps me to quickly create a new SOAP service even today. However, this article did not include the implementation of TLS.

The implementation of TLS should not be difficult. In the case of an implementation in Karaf, using blueprint.xml you should add something like the following:

[embed]

This snippet sets the TLS Server Parameters on the Jetty server of Karaf. Easy does it. In my case, I use Red Hat Fuse with Spring Boot.

Red Hat recommends using Undertow as the HTTP-server. So, I was looking for a snippet like this to use for Undertow. I indeed found some examples, but they did not work.

In the Apache CXF you can set the sslContextParameters, but those are meant for invoking a SOAP Endpoint (producer).

In Spring Boot you only need to set the correct properties. I found the solution on How to create a SOAP web service with two way SSL using Springboot.

Generate Keystore and Truststore

To create a Keystore and a Truststore I created a set of scripts in my GitHub project. It starts with keystore_env.sh. I have several little “one-command-scripts” that create a Keystore, export the Public Key and then create a TrustStore by importing the public key. I find these are especially handy, because most of the times I do not need to remember the commands. And in some cases you may need to create a certificate signing request (for which I have not supplied a script, yet). I also created a combined script that does these 3 steps altogether.

Enable TLS in Spring Boot

Instead of defining sslContextParameters or a httpj/u-engine bean hierarchy, we can set TLS just by enabling it through Spring Boot properties in the application.properties:

[embed]

The enabling property is server.ssl.enabled. Then the server.ssl-properties key-store, key-store-password, key-password, trust-store and trust-store-password define the references to the used keystore and truststore. Using the client-auth property toggling between none or need, you can switch between 1 way SSL or 2 way SSL.

In our project we have defined properties for keystore, keystore.password, truststore and truststore.password. These properties are set through the corresponding environment variables: KEYSTORE, KEYSTORE_PASSWORD, TRUSTSTORE and TRUSTSTORE_PASSWORD. So, I use the application.properties file to map these properties to the server.ssl properties.

Conclusion

I need to search the Red Hat Knowledgebase more…