How can I set up a letsencrypt SSL certificate and use it in a Spring Boot application?

I wrote 2 blog posts about Let's Encrypt and Spring Boot.

1. Issuing a certificate. Spring Boot Application Secured by Let’s Encrypt Certificate
2. Renewing a certificate. Let’s Encrypt Certificate Renewal: for Spring Boot

In a nutshell, steps are as follows:

1. Pulling the Let's Encrypt client (certbot).

2. Generating a certificate for your domain (e.g. example.com)

   ./certbot-auto certonly -a standalone -d example.com -d www.example.com

Things are generated in /etc/letsencrypt/live/example.com. Spring Boot expects PKCS#12 formatted file. It means that you must convert the keys to a PKCS#12 keystore (e.g. using OpenSSL). As follows:

3. Open /etc/letsencrypt/live/example.com directory.

4. `openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out keystore.p12 -name tomcat -CAfile chain.pem -caname root` 

The file keystore.p12 with PKCS12 is now generated in /etc/letsencrypt/live/example.com.

It's time to configure your Spring Boot application. Open the application.properties file and put following properties there:

server.port=8443 security.require-ssl=true server.ssl.key-store=/etc/letsencrypt/live/example.com/keystore.p12 server.ssl.key-store-password=<your-password> server.ssl.keyStoreType=PKCS12 server.ssl.keyAlias=tomcat 

Read my blog post for further details and remarks.

Step 1: Download certbot from git

You need to fetch the source code of Let's Encrypt on your server which your domain address is pointing to. This step may take a couple minutes.

$ git clone https://github.com/certbot/certbot

$ cd certbot

$ ./certbot-auto --help

Remark: Python 2.7.8 (or above) should be installed beforehand.

Step2: generates certificates and a private key

By executing following command in your terminal, Let's Encrypt generates certificates and a private key for you.

$ ./certbot-auto certonly -a standalone \

-d example.com -d example.com 

Remark:Keys are generated in /etc/letsencrypt/live/example.com directory

Step3: Generate PKCS12 Files From PEM Files

To convert the PEM files to PKCS12 version: Go to /etc/letsencrypt/live/example.com convert the keys to PKCS12 using OpenSSL in the terminal as follows.

$ openssl pkcs12 -export -in fullchain.pem \

 -inkey privkey.pem \ -out keystore.p12 \ -name tomcat \ -CAfile chain.pem \ -caname root 

Enter Export Password:

Verifying - Enter Export Password:

(Note:- Write single line at a time and press enter)

Step4: Configuration of Spring Boot Application

Open your 'application.properties' Put this configuration there.

server.port=8443 security.require-ssl=true

server.ssl.key-store=/etc/letsencrypt/live/example.com/keystore.p12

server.ssl.key-store-password= password

server.ssl.keyStoreType= PKCS12

server.ssl.keyAlias= tomcat

Another option is to use Spring Boot Starter ACME:

https://github.com/creactiviti/spring-boot-starter-acme

ACME (Automatic Certificate Management Environment) it the protocol used by LetsEncrypt to automatically issue certs.

For spring boot webflux the configuration of properties changed

server.port=443 server.ssl.enabled=true//the changed line server.ssl.keyAlias=netty server.ssl.key-store=path server.ssl.key-store-password=password server.ssl.keyStoreType=PKCS12 

I've created a small library in pure Java that allows embedded Tomcat in Spring-Boot to obtain and keep Lets Encrypt certificate fresh automatically: Spring-Boot LetsEncrypt helper

It is just one Java file + dependencies on ACME4J/BouncyCastle, so that one can re-use it as a code

In short, it does the following:

1. On application start it creates KeyStore as defined in your server.ssl properties if it does not exist yet (and adds self-signed expired cert there).
2. Registers Tomcat connector on port 80 for HTTP-01 ACME challenge from LetsEncrypt
3. Launches thread that checks if the certificate in KeyStore is outdated or missing
4. If the certificate is outdated/missing it issues an order to LetsEncrypt and passes HTTP-01 ACME challenge on port 80.
5. After passing the challenge it stores the certificate into KeyStore defined in server.ssl and issues reloadSslHostConfigs on Tomcat HTTPS enabled connector

With these steps, the entire LetsEncrypt certificate lifecycle from the issuing to update is covered within Java application itself without any non-Java 3rd parties

letsencrypt-tomcat queries and refreshes certs via Let's encrypt at runtime (no restarts needed).
It works with standalone and embedded Tomcat as well as Spring Boot.

It's packaged into a Docker image, allowing for easy reuse. The image contains:

• dehydrated to manage certs via Let’s Encrypt,
• tomcat-reloading-connector for hot reloading certs at runtime after renewal,
• an init system (dumb-init) for properly handling tomcat and dehydrated processes,
• an entrypoint script that starts up tomcat and dehydrated as well as
• a pre-compiled version of Apache Portable Runtime (APR) and JNI wrappers for APR used by Tomcat (libtcnative), so tomcat delivers the best TLS performance possible.

Read this blog post to learn how to use it with your application and more about the technical details.

1. Get an SSL certificate from letsencrypt
2. Add it into a keystore using the keytool command in Java
3. Configure your Spring application to use the keystore generated above

The file should look like:

 server.port = 8443 server.ssl.key-store = classpath:sample.jks server.ssl.key-store-password = secret server.ssl.key-password = password 

I've had some trouble when exporting .pem to .p12, keytool was not recognizing file format. Here follows the command that worked for me after many searches:

openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out keystore.p12 -name tomcat -CAfile chain.pem -caname root -legacy -passout pass:changeit 

After that, you'll have your file keystore.p12, so set the configs in application.properties like Emad Van Ben told before