Spring Boot SSL | Together Java | Page 1

crimson plaza Dec 7, 2023, 12:43 PM

#

Hey I have a normal Backend in Spring Boot and it only runs on Port 8080 (HTTP)…I have this Backend in a Docker container where I exposed this Port. Everytime someone tries to connect via my Domain, my Nginx Proxy Manager reroutes the connection with SSL to my backend. Should I continue this method or should I rather activate SSL on my Spring Boot Backend too?

twin wadiBOT Dec 7, 2023, 12:43 PM

#

<@&987246964494204979> please have a look, thanks.

#

Here is an AI assisted attempt to answer your question 🤖. Maybe it helps! In any case, a human is on the way 👍. To continue talking to the AI, you can use </chatgpt:1108714622413963314>.

#

to my backend, they have to use http://<ip>:8080. Now I want to secure the communication between the client and the backend by using SSL/TLS. How can I achieve this in Spring Boot?

To enable SSL/TLS in your Spring Boot application, you need to follow these steps:

Generate a self-signed SSL certificate or obtain a valid SSL certificate from a trusted Certificate Authority (CA). You can use tools like OpenSSL to generate a self-signed certificate.
Place the generated SSL certificate and private key in a keystore file. The keystore file is typically in Java KeyStore (JKS) format.
Configure your Spring Boot application to use the SSL certificate and private key by adding the following properties to your application.properties or application.yml file:

#

   server.port=8443
   server.ssl.key-store-type=JKS
   server.ssl.key-store=classpath:keystore.jks
   server.ssl.key-store-password=your_keystore_password
   server.ssl.key-alias=your_certificate_alias

#

Make sure to replace keystore.jks, your_keystore_password, and your_certificate_alias with appropriate values.

Restart your Spring Boot application, and it should now be accessible over HTTPS on port 8443.

Note: If you are using Docker, make sure to expose port 8443 in your Dockerfile or when running the container.

Now, clients can connect to your backend using https://<ip>:8443. However, since you are using a self-signed certificate, clients may see warnings about an untrusted certificate. To avoid these warnings, you can obtain a valid SSL certificate from a trusted CA.

Additionally, if you want to redirect all HTTP requests to HTTPS automatically, you can add the following configuration:

#

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.requiresChannel()
                .anyRequest()
                .requiresSecure();
    }
}

#

With this configuration, any HTTP request will be automatically redirected to HTTPS.

Remember to secure the keystore file and its password properly, as it contains sensitive information.

idle hedge Dec 7, 2023, 2:18 PM

#

It highly depends on what you consider safe environment, many systems communicate using HTTP internally and some proxy does SSL offloading for them

#

The project I am working on right now is running inside OpenShift (Redhat kubernetes), internally the pods communicate using HTTP, SSL is done by openshift itself

crimson plaza Dec 7, 2023, 11:44 PM

#

idle hedge It highly depends on what you consider safe environment, many systems communicat...

Yes mine does use HTTP internally but I only expose the port 8080 and use NGINX Proxy Manager to secure my connection to this port...Is this dumb?

idle hedge Dec 8, 2023, 8:11 AM

#

crimson plaza Yes mine does use HTTP internally but I only expose the port 8080 and use NGINX ...

So the communication between nginx and your application is unsecured, the question is whether you consider the environment it goes trough secure

#

Inside openshift with limited access -> likely secure
Inside company network where every computer can run wireshark and listen in -> not secure

crimson plaza Dec 8, 2023, 9:37 AM

#

So I should secure it then?

idle hedge Dec 8, 2023, 10:44 AM

#

If it is the latter case I would say yes, even if you consider the environment technically internal it can be compromised.
But certificates and keys have expiration date, so you should have some process for renewing them

crimson plaza Dec 8, 2023, 3:25 PM

#

idle hedge If it is the latter case I would say yes, even if you consider the environment t...

Cant I use the same cert from my nginx proxy manger? It does renew it automatically

idle hedge Dec 8, 2023, 3:46 PM

#

crimson plaza Cant I use the same cert from my nginx proxy manger? It does renew it automatica...

Well yes, but you have to somehow get it into the app configuration

crimson plaza Dec 8, 2023, 3:46 PM

#

I think I will just generate one which is valid for one year

#

where can I generate certs?

idle hedge Dec 8, 2023, 3:46 PM

#

openssh ?

#

I mean, the thing is, the client has to trust your certificate

#

So it should be signed by an authority

unique onyx Dec 8, 2023, 4:49 PM

#

crimson plaza Yes mine does use HTTP internally but I only expose the port 8080 and use NGINX ...

Nope totally fine

unique onyx Dec 8, 2023, 4:49 PM

#

crimson plaza where can I generate certs?

Use nginix and letsencrypt w/certbot

#

That will be the easiest way to do SSL on your own machine

#

I'd say to not secure your spring app itself

#

It adds complications and doesn't buy you much

#

There are exceptions to that statement, but I don't think you are in one of those cases

crimson plaza Dec 8, 2023, 4:51 PM

#

So that I opened my HTTP port of my container and then secure every connection to it via Nginx Proxy Manager is fine?

unique onyx Dec 8, 2023, 4:51 PM

#

Yes

#

Because the http port on your container isn't exposed to the wider internet

#

Basically, set up nginix to do http

#

Run certbot, and it will move you to https

#

Then you're golden

crimson plaza Dec 8, 2023, 4:52 PM

#

unique onyx Because the http port on your container isn't exposed to the wider internet

I mean I think you could connect if you enter the IP and the port 8080

#

it only secures it if you use the domain afaik

unique onyx Dec 8, 2023, 4:52 PM

#

crimson plaza I mean I think you could connect if you enter the IP and the port 8080

That is unideal. There is no reason you should be exposing 8080 from your web server

#

Just 80 and 443

#

And 8080 can be running locally

#

But I also can't think of anything horrid that would happen. Just people can get MITM'ed if they go directly to your ip

#

Which is unlikely

crimson plaza Dec 8, 2023, 4:54 PM

#

unique onyx That is unideal. There is no reason you should be exposing 8080 from your web se...

No wait…I mean my Backend container is exposed at 8080….And if you use my Domain to connect to it…You will end up on my nginx proxy Manager which secures it and redirects to the container

unique onyx Dec 8, 2023, 4:54 PM

#

What is nginix proxy manager

#

Vs nginix

#

So I would expect something like an ec2 machine with a public up that exposes 80 and 443

crimson plaza Dec 8, 2023, 4:55 PM

#

unique onyx What is nginix proxy manager

It’s more light weight afaik…Pretty good if you just use it for stuff like this

#

#

THATS how it’s set up

unique onyx Dec 8, 2023, 4:56 PM

#

And then some containers on that machine

crimson plaza Dec 8, 2023, 4:56 PM

#

Yep

unique onyx Dec 8, 2023, 4:56 PM

#

But I would expect nginix and the containers to be on the same machine

#

(they don't have to be, but I would expect it)

crimson plaza Dec 8, 2023, 4:56 PM

#

Different container but same machine

unique onyx Dec 8, 2023, 4:57 PM

#

Okay so wait

#

That's dumb

#

Why does nginix go out to the wider internet

#

Just to get back to the same machine

#

Why not localhost:8080

#

Or 0.0.0.0:8080

crimson plaza Dec 8, 2023, 4:58 PM

#

Should I change that?

unique onyx Dec 8, 2023, 4:58 PM

#

Try it

crimson plaza Dec 8, 2023, 4:58 PM

#

Ok 1s

unique onyx Dec 8, 2023, 4:58 PM

#

If that works, then you don't need to expose 8080 on the public ip

#

And then it's gucci

crimson plaza Dec 8, 2023, 4:59 PM

#

unique onyx If that works, then you don't need to expose 8080 on the public ip

NGINX and my backend are in different container and not in the same network

#

And if I dont expose 8080...Not even localhost could open a connection

unique onyx Dec 8, 2023, 5:00 PM

#

Fuckin docker

#

You can expose 8080 of one container to another container in a docker compose or whatevrr

#

But, tbh, it's a lot less of a PITA to just use a platform as a service

#

Which does SSL for you on a free tier

#

Like render, railway, heroku, etc

crimson plaza Dec 8, 2023, 5:01 PM

#

But I would have to buy a new service...Thats not nice

unique onyx Dec 8, 2023, 5:01 PM

#

Free tier

#

But whatever

#

I'll look up how to use compose for this later if I remember

crimson plaza Dec 8, 2023, 5:03 PM

#

ok thx

twin wadiBOT Dec 8, 2023, 6:39 PM

#

我是一个基于深度学习的对话模型，使用了自然语言处理和人工智能技术来进行对话。

#

不好意思，我是GPT-3，一个由OpenAI开发的人工智能语言模型。目前还没有GPT-4存在。有什么我可以帮助你的吗？

twin wadiBOT Dec 9, 2023, 7:12 AM

#

@crimson plaza

Your question has been closed due to inactivity.

If it was not resolved yet, feel free to just post a message below
to reopen it, or create a new thread.

Note that usually the reason for nobody calling back is that your
question may have been not well asked and hence no one felt confident
enough answering.

When you reopen the thread, try to use your time to improve the quality
of the question by elaborating, providing details, context, all relevant code
snippets, any errors you are getting, concrete examples and perhaps also some
screenshots. Share your attempt, explain the expected results and compare
them to the current results.

Also try to make the information easily accessible by sharing code
or assignment descriptions directly on Discord, not behind a link or
PDF-file; provide some guidance for long code snippets and ensure
the code is well formatted and has syntax highlighting. Kindly read through
https://stackoverflow.com/help/how-to-ask for more.

With enough info, someone knows the answer for sure 👍

crimson plaza Dec 9, 2023, 4:58 PM

#

twin wadi 我是一个基于深度学习的对话模型，使用了自然语言处理和人工智能技术来进行对话。

?

unique onyx Dec 9, 2023, 7:19 PM

#

no clue

#

also i havent looked anything up yet

twin wadiBOT Dec 10, 2023, 8:12 AM

#

@crimson plaza

Your question has been closed due to inactivity.

If it was not resolved yet, feel free to just post a message below
to reopen it, or create a new thread.

Note that usually the reason for nobody calling back is that your
question may have been not well asked and hence no one felt confident
enough answering.

When you reopen the thread, try to use your time to improve the quality
of the question by elaborating, providing details, context, all relevant code
snippets, any errors you are getting, concrete examples and perhaps also some
screenshots. Share your attempt, explain the expected results and compare
them to the current results.

Also try to make the information easily accessible by sharing code
or assignment descriptions directly on Discord, not behind a link or
PDF-file; provide some guidance for long code snippets and ensure
the code is well formatted and has syntax highlighting. Kindly read through
https://stackoverflow.com/help/how-to-ask for more.

With enough info, someone knows the answer for sure 👍

crimson plaza Dec 11, 2023, 3:27 PM

#

unique onyx also i havent looked anything up yet

Did you look it up?

unique onyx Dec 11, 2023, 3:36 PM

#

crimson plaza Did you look it up?

No i got high and played baldurs gate

#

you get what you pay for, yknow

crimson plaza Dec 11, 2023, 3:37 PM

#

unique onyx No i got high and played baldurs gate

That sounds amazing

unique onyx Dec 11, 2023, 3:37 PM

#

https://docs.docker.com/compose/networking/

Docker Documentation

Networking in Compose

How Docker Compose sets up networking between containers

#

I think links is the thing though

crimson plaza Dec 11, 2023, 3:38 PM

#

You mean I should Link the nginx proxy manager container with my backend container and it should Reroute everythng to my docker?

unique onyx Dec 11, 2023, 3:39 PM

#

yeah so you don't have any extra ports exposed to the wider internet

#

and you don't hop over the internet to get to your local site

#

for context, the one site I run that uses a physical machine + nginix is this

#

https://run.mccue.dev

Run Java Code

A browser interface to the Java compiler to experiment with the language

#

and i got most of the instructions from the repo I forked from

#

and in that there is no docker involved, so its a bit simpler

#Spring Boot SSL