# 使用OpenSSL生成
openssl req -x509 -newkey rsa:4096 -nodes \
  -keyout server.key -out server.crt \
  -days 365 -subj "/CN=yourdomain.com"

server:
  port: 443
  ssl:
    enabled: true
    key-store: classpath:ssl/keystore.p12
    key-store-password: yourpassword
    key-store-type: PKCS12
    key-alias: tomcat
    protocol: TLS
    enabled-protocols: TLSv1.2,TLSv1.3
    ciphers: TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256...

@Configuration
public class HttpsConfig {
    @Bean
    public ServletWebServerFactory servletContainer() {
        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {
            @Override
            protected void postProcessContext(Context context) {
                SecurityConstraint securityConstraint = new SecurityConstraint();
                securityConstraint.setUserConstraint("CONFIDENTIAL");
                SecurityCollection collection = new SecurityCollection();
                collection.addPattern("/*");
                securityConstraint.addCollection(collection);
                context.addConstraint(securityConstraint);
            }
        };
        tomcat.addAdditionalTomcatConnectors(redirectConnector());
        return tomcat;
    }
    private Connector redirectConnector() {
        Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");
        connector.setScheme("http");
        connector.setPort(8080);
        connector.setSecure(false);
        connector.setRedirectPort(443);
        return connector;
    }
}

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .headers()
            .httpStrictTransportSecurity()
            .includeSubDomains(true)
            .maxAgeInSeconds(31536000); // 1年
    }
}

@Scheduled(cron = "0 0 3 * * ?") // 每天凌晨3點(diǎn)檢查
public void renewCertificate() {
    try {
        Process process = Runtime.getRuntime().exec("certbot renew --quiet");
        int exitCode = process.waitFor();
        if (exitCode == 0) {
            logger.info("證書(shū)續(xù)期成功");
            // 重新加載證書(shū)
            ((TomcatWebServer) webServer).getTomcat().getConnector().reload();
        }
    } catch (Exception e) {
        logger.error("證書(shū)續(xù)期失敗", e);
    }
}

server:
  ssl:
    enabled-protocols: TLSv1.3 # 優(yōu)先使用TLS 1.3
    ciphers: 
      - TLS_AES_256_GCM_SHA384       # TLS 1.3
      - TLS_CHACHA20_POLY1305_SHA256 # 移動(dòng)設(shè)備優(yōu)化
      - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
      - TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

@Bean
public WebServerFactoryCustomizer<TomcatServletWebServerFactory> tomcatCustomizer() {
    return factory -> factory.addConnectorCustomizers(connector -> {
        connector.setProperty("sslEnabledProtocols", "TLSv1.2,TLSv1.3");
        connector.setProperty("sslSessionTimeout", "3600"); // 1小時(shí)會(huì)話(huà)緩存
        connector.setProperty("sslSessionCacheSize", "20480"); // 緩存大小
    });
}

# 生成OCSP響應(yīng)文件
openssl ocsp -issuer chain.pem -cert server.crt \
  -url http://ocsp.digicert.com -respout ocsp.der
# Nginx配置示例（Spring Boot需通過(guò)前置代理實(shí)現(xiàn)）
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /path/to/chain.pem;

cat server.crt intermediate.crt > fullchain.crt

<meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

openssl s_client -connect example.com:443 -servername example.com -tlsextdebug -showcerts

server:
  ssl:
    enabled-protocols: TLSv1.2,TLSv1.3
    ciphers: "HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK"

@Bean
public WebServerFactoryCustomizer<TomcatServletWebServerFactory> ctEnforcer() {
    return factory -> factory.addContextCustomizers(context -> {
        context.addParameter("certificateTransparency", "true");
    });
}

# 生成新密鑰對(duì)
openssl ecparam -genkey -name prime256v1 -out newkey.pem