[Spring boot] mTLS相互認証の実装サンプル

import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;

@RestController
public class ServerController {

    @GetMapping(value = "/server")
    public String server() {
        return "ok";
    }
}

spring:
  profiles:
    active: local

server:
  port: 8443
  ssl:
    # TLS settings
    enabled: true
    key-store: keystore.jks
    key-store-password: changeit
    key-alias: localhost
    key-password: changeit

    # mTLS settings
    client-auth: need
    trust-store: server-truststore.p12
    trust-store-password: changeit

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestTemplate;

@RestController
public class ClientController {
    @Autowired
    RestTemplate restTemplate;

    @GetMapping("/client")
    public String client() {
        return restTemplate.getForObject("https://localhost:8443/server", String.class);
    }
}

import org.apache.http.client.HttpClient;
import org.apache.http.client.HttpRequestRetryHandler;
import org.apache.http.client.config.RequestConfig;
import org.apache.http.config.Registry;
import org.apache.http.config.RegistryBuilder;
import org.apache.http.conn.socket.ConnectionSocketFactory;
import org.apache.http.conn.socket.PlainConnectionSocketFactory;
import org.apache.http.conn.ssl.NoopHostnameVerifier;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.impl.client.DefaultHttpRequestRetryHandler;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.boot.web.client.RestTemplateBuilder;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.ClientHttpRequestFactory;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;

import javax.net.ssl.*;
import java.io.BufferedInputStream;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.security.*;
import java.security.cert.Certificate;
import java.security.cert.CertificateException;
import java.security.cert.CertificateFactory;
import java.util.concurrent.TimeUnit;
import java.util.function.Supplier;

@Configuration
public class RestTemplateConfig {
    @Autowired
    private RestTemplateBuilder restTemplateBuilder;

    @Bean
    RestTemplate restTemplate(
            @Value("${myapp.keystore.filepath}") String keyStorePath,
            @Value("${myapp.keystore.password}") String keyStorePassword,
            @Value("${myapp.cacert.filepath}") String caCertPath,
            @Value("${myapp.cacert.alias}") String caCertAlias
    ) {
        Supplier<ClientHttpRequestFactory> requestFactory = () -> {
            try {
                SSLContext sslContext =
                        createSslContext("TLSv1.3", keyStorePath, keyStorePassword, caCertPath, caCertAlias);

                HttpClient httpClient = createHttpClient(sslContext);

                return new HttpComponentsClientHttpRequestFactory(httpClient);
            } catch (Exception e) {
                return null;
            }
        };

        return restTemplateBuilder
                .requestFactory(requestFactory)
                .build();
    }

    private SSLContext createSslContext(String protocol, String keyStorePath, String keyStorePassword,
                                        String certificatePath, String alias)
            throws NoSuchAlgorithmException, KeyStoreException, CertificateException, IOException, UnrecoverableKeyException, KeyManagementException {
        SSLContext sslContext = SSLContext.getInstance(protocol);

        // Create Key Manager
        KeyManager[] keyManagers = createKeyManagers(keyStorePath, keyStorePassword);

        // Create Trust Manager
        TrustManager[] trustManagers = createTrustManagers(certificatePath, alias);

        // Init SSLContext
        sslContext.init(keyManagers, trustManagers, new SecureRandom());

        return sslContext;
    }

    private KeyManager[] createKeyManagers(String keyStorePath, String keyStorePassword)
            throws KeyStoreException, CertificateException, IOException, NoSuchAlgorithmException, UnrecoverableKeyException {
        KeyManager[] keyManagers = null;

        if (keyStorePath != null) {
            try (InputStream is = new BufferedInputStream(new FileInputStream(keyStorePath))) {
                // See https://docs.oracle.com/javase/jp/8/docs/technotes/guides/security/StandardNames.html#KeyStore
                KeyStore keyStore = KeyStore.getInstance("pkcs12");
                keyStore.load(is, keyStorePassword.toCharArray());

                KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
                kmf.init(keyStore, keyStorePassword.toCharArray());
                keyManagers = kmf.getKeyManagers();
            }
        }

        return keyManagers;
    }

    private TrustManager[] createTrustManagers(String certificatePath, String alias)
            throws KeyStoreException, CertificateException, IOException, NoSuchAlgorithmException {
        TrustManager[] trustManagers = null;

        if (certificatePath != null) {
            KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
            trustStore.load(null);

            try (InputStream is = new BufferedInputStream(new FileInputStream(certificatePath))) {
                // See https://docs.oracle.com/javase/jp/8/docs/technotes/guides/security/StandardNames.html#CertificateFactory
                Certificate certificate = CertificateFactory.getInstance("X.509")
                        .generateCertificate(is);

                trustStore.setCertificateEntry(alias, certificate);

                TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
                tmf.init(trustStore);
                trustManagers = tmf.getTrustManagers();
            }
        }

        return trustManagers;
    }

    private HttpClient createHttpClient(SSLContext sslContext) {
        String[] supportedProtocols = {"TLSv1.2", "TLSv1.3"};
        String[] supportedCipherSuites = null;
        HostnameVerifier hostnameVerifier = NoopHostnameVerifier.INSTANCE;

        SSLConnectionSocketFactory socketFactory =
                new SSLConnectionSocketFactory(sslContext, supportedProtocols, supportedCipherSuites, hostnameVerifier);

        Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory>create()
                .register("http", PlainConnectionSocketFactory.getSocketFactory())
                .register("https", socketFactory)
                .build();

        PoolingHttpClientConnectionManager connectionManager =
                new PoolingHttpClientConnectionManager(registry, null, null, null,
                        3000, TimeUnit.MILLISECONDS);
        connectionManager.setMaxTotal(20);
        connectionManager.setDefaultMaxPerRoute(2);

        RequestConfig requestConfig = RequestConfig.custom().build();
        HttpRequestRetryHandler retryHandler = new DefaultHttpRequestRetryHandler(5, true);

        return HttpClientBuilder.create()
                .setConnectionManager(connectionManager)
                .setDefaultRequestConfig(requestConfig)
                .setRetryHandler(retryHandler)
                .build();
    }
}

spring:
  profiles:
    active: local

myapp:
  # Client certificate settings
  keystore:
    filepath: clientBob.p12
    password: changeit
  # Server-side is using self-signed certificate, so root CA certificate is required
  cacert:
    filepath: rootCA.crt
    alias: rootCA