HTTPS与TLS/SSL：加密通信原理与证书验证

# OpenSSL查看证书
openssl s_client -connect baidu.com:443 -showcerts

# 输出
Certificate chain
 0 s:/CN=baidu.com
   i:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2
 1 s:/C=BE/O=GlobalSign nv-sa/CN=GlobalSign Organization Validation CA - SHA256 - G2
   i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA

# 生成keystore（JKS格式）
keytool -genkeypair \
  -alias my-app \
  -keyalg RSA \
  -keysize 2048 \
  -keystore keystore.jks \
  -validity 365

# 输入密码和证书信息
Enter keystore password: 123456
What is your first and last name? localhost
What is the name of your organizational unit? IT
What is the name of your organization? MyCompany
...

# application.yml
server:
  port: 8443
  ssl:
    enabled: true
    key-store: classpath:keystore.jks
    key-store-password: 123456
    key-alias: my-app
    key-store-type: JKS

// HTTPS监听
@SpringBootApplication
public class Application {
    public static void main(String[] args) {
        SpringApplication.run(Application.class, args);
    }
}

// 访问
// https://localhost:8443/api/users

@Configuration
public class RestTemplateConfig {

    @Bean
    public RestTemplate httpsRestTemplate() throws Exception {
        // 信任所有证书（仅开发环境！生产禁用）
        TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -> true;

        SSLContext sslContext = SSLContexts.custom()
            .loadTrustMaterial(null, acceptingTrustStrategy)
            .build();

        SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(
            sslContext,
            NoopHostnameVerifier.INSTANCE  // 不验证主机名（仅开发环境）
        );

        CloseableHttpClient httpClient = HttpClients.custom()
            .setSSLSocketFactory(csf)
            .build();

        HttpComponentsClientHttpRequestFactory factory =
            new HttpComponentsClientHttpRequestFactory(httpClient);

        return new RestTemplate(factory);
    }
}

// 生产环境：信任特定证书
@Bean
public RestTemplate productionRestTemplate() throws Exception {
    // 加载信任的证书
    KeyStore trustStore = KeyStore.getInstance("JKS");
    try (InputStream trustStoreStream = getClass().getResourceAsStream("/truststore.jks")) {
        trustStore.load(trustStoreStream, "password".toCharArray());
    }

    SSLContext sslContext = SSLContexts.custom()
        .loadTrustMaterial(trustStore, null)
        .build();

    SSLConnectionSocketFactory csf = new SSLConnectionSocketFactory(sslContext);

    CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLSocketFactory(csf)
        .build();

    HttpComponentsClientHttpRequestFactory factory =
        new HttpComponentsClientHttpRequestFactory(httpClient);

    return new RestTemplate(factory);
}

# application.yml
feign:
  client:
    config:
      user-service:
        url: https://user-service:8443  # HTTPS

// Feign配置（信任所有证书，仅开发）
@Configuration
public class FeignConfig {

    @Bean
    public Client feignClient() throws Exception {
        TrustManager[] trustAllCerts = new TrustManager[]{
            new X509TrustManager() {
                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }
                public void checkClientTrusted(X509Certificate[] certs, String authType) {}
                public void checkServerTrusted(X509Certificate[] certs, String authType) {}
            }
        };

        SSLContext sslContext = SSLContext.getInstance("TLS");
        sslContext.init(null, trustAllCerts, new SecureRandom());

        return new Client.Default(
            sslContext.getSocketFactory(),
            (hostname, session) -> true  // 不验证主机名
        );
    }
}

# 安装Certbot
sudo apt-get install certbot

# 生成证书（需要域名解析到服务器）
sudo certbot certonly --standalone -d api.example.com

# 证书位置
/etc/letsencrypt/live/api.example.com/fullchain.pem  # 证书链
/etc/letsencrypt/live/api.example.com/privkey.pem    # 私钥

# 转换为JKS格式
openssl pkcs12 -export \
  -in /etc/letsencrypt/live/api.example.com/fullchain.pem \
  -inkey /etc/letsencrypt/live/api.example.com/privkey.pem \
  -out keystore.p12 \
  -name api.example.com

keytool -importkeystore \
  -srckeystore keystore.p12 -srcstoretype PKCS12 \
  -destkeystore keystore.jks -deststoretype JKS

# 自动续期（Let's Encrypt证书有效期90天）
sudo crontab -e
0 0 1 * * /usr/bin/certbot renew --quiet

# nginx.conf
server {
    listen 443 ssl http2;
    server_name api.example.com;

    # SSL证书
    ssl_certificate /etc/letsencrypt/live/api.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/api.example.com/privkey.pem;

    # SSL配置
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;

    # 代理到后端服务（HTTP）
    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# HTTP重定向到HTTPS
server {
    listen 80;
    server_name api.example.com;
    return 301 https://$server_name$request_uri;
}