[Spring Boot Security] #15 Enable HTTPS/SSL in Spring Boot

[@krztuszenie]

If you are running ubuntu just open terminal and write: keytool -genkeypair -alias myssl -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore myssl.p12 -validity 3650 Nice video btw :)

[@martinbozinovski]

This is one of the flawless videos on youtube. Just perfect. Works as charm. Thank you very much!!

[@bluex217]

Just to add on to this great video if you are using your Spring Boot app as a restful service like I am (AKA Spring Boot app is ONLY used as your backend) you may have tried to send an HTTP request via Postman, rather than the browser. When you try this, you will initially get "Could not get a response" and the reason is because Postman by default rejects self-signed certificates. Go into the Postman settings -> general -> and toggle off the ssl-certificate feature and then it will work. This is of course until you buy a truly signed cert for deployment

[@Bloome_BlueFolf]

I am damn thankful I found your tutorial series! It's amazing and let me improve much as beginner.

[@mostinho7]

Done thanks! Took notes in onenote

[@perumalsamy5346]

Thank you so much for great tutorial.. Keep going..

[@lordekamil]

good, quick and works, but you should paste key generation command in description of video

[@websimo1000]

just Excellent !!

[@eliasalvest.i.646]

Vc é incrível!!!

[@mubaraktube1]

Very good, thanks for helping many people out there

[@RomanianCoder]

It's my pleasure!

[@mateenmansoori6128]

I was in depression for how the security n all things works... This video made me stable🏂

[@benjamine.ndugga729]

This guy is the best!!(

[@newnew1507]

thank you, keep going

[@RomanianCoder]

Thanks for the encouragement

[@yilsonalexismalambomadriga5376]

Gracias me funciono para conectar mi api a una app web desde un hosting

[@ALhajrasAlgdiry]

I have a ssl certificate however when I do the same steps I get an error of Alias name [tomcat] does not identify a key entry

[@nikolapashov5181]

Hey, how can I disable the ssl? I tried to comment out the configuration in the application.properties and in both methods in BootSecurityApplication (httpToHttpsRedirectConnector, servletContainer) but it still doesn't work.

[@SavranTaha]

Hi I have .crt .csr .key and .ca-bundle files but not the .p14 file from the video. Can you please help me to get the .p14 file or can you show me how I can use the other files. Thank you.

[@dinobulja]

What if I dont use embedded Tomcat container? For example, what if I use OpenLiberty?

[@jordibellver802]

Hi there, I tried from the code at GH to go back from https to http, comenting the settings at application.properties and commenting the code at BootSecurityApplication: the @Bean and the redirector, but then authentication fails at login as it is not triggering loadUserByUsername. I have no idea why !?!?!? Can any explain what else must be reverted to get an http connection? (please, don't ask why i need http if i have https... i'm just willing to understand the details, ok?)

[@gajanangaikwad8934]

Hi Can you tell me how to download the certificate from hostinger or godaddy so that I can use that certificate with my spring boot application

[@harivignesh100]

i am convert .p12 to jks this error happen keytool error: java.io.IOException: toDerInputStream rejects tag type 45

[@andresfelipevalenciamontes7069]

Hola funciona perfecto, pero cual podría ser la mejor forma para ponerle un certificado ssl?

[@rajukapadne6502]

I want to know the scenario , How to get username by reading client certificate ?

[@hendisantika]

I already followed the steps. But, current chrome said that certificate is invalid. What should I do? Thanks

[@jamesfrank1159]

Still uses port 8080 despite doing my configurations the way you have done.

[@fanuelguill]

First of all thanks for this amazing series I've a situation when i'm trying to access admin or manager page i can't open them

[@fanuelguill]

PS: I've the good login code i can just access to profile page which is a problem for(sorry my english is not good) Need help plz

[@rohaslob2]

The answer is in 18 - Database Authentication - User Repository video. When authorities and roles are used together authorities takes precedence.

[@RedCurlyHead]

Isn't better to have proxy like Nginx that handles SSL Termination?!

[@RahulKumar-zz4wo]

Brother, If possible please make a tutorial on microservices

[@rohaslob2]

Thanks for the great tutorial. Same issue as FG-69 reported below. Post 15 Enable HTTPS/SSL in Spring Boot the roles for ADMIN and MANAGER do not work anymore after putting in the code mentioned in the video. Maybe its resolved in future episodes. The rest endpoint authorities based security still work. Just the roles based security does not work. Please check when you get some time.

[@rohaslob2]

i saw that you covered this issue in 18 - Database Authentication - User Repository video. When authorities and roles are used together authorities takes precedence. Thanks

[@godoyeverton]

​@@rohaslob2 Thank you for this information. I had the same problem, and a I didn’t have Idea. I am going to copy only for reinforce "" When authorities and roles are used together authorities takes precedence "" Thank you, best!

[@fuadshirinov2116]

This site can’t be reachedThe connection was reset. Try: Checking the connection Checking the proxy and the firewall ERR_CONNECTION_RESET

[@just_a_simple_man]

My application runs only on the port 8443, but you have it running the both ports 8082 and 8443. How can I solve this problem?

[@tiagonascimento7613]

its just add in your properties -> server.port =

[@blackyaga2500]

not secure problem?

[@stormdark90]

friend.. why it is not recommended to use self-signed certificates in production? nice vid :)

[@RomanianCoder]

Hello! Thanks for the message. Self signed certificates are not recognized and validated by any certificate authority. The browsers will issue warning messages due to this and it will decrease trust levels among users. You probably would not input your bank details in a form that uses self signed :)

[@rudradash2343]

i am really confused between AuthenticationProvider vs UserDetailsService.

[@wyguy7258]

Hopefully this explanation helps a bit, but if you have ever worked with springboots controller, service, and repository setup for domain objects (so just objects stored to a database), then you can think of UserDetailsService as the service class to UserDetails. AuthenticationProvider is what you actually customize to authenticate a user attempting a login by overriding Authenticate() method. The only difference between UserDetails and say for example just a custom User entity that has a controller, service, and repository class is that UserDetails is not persisted to a database. So it's basically just a way to model a user trying attempting to login. Hopefully that made sense, I'm not the best at explaining things.

[@JarTSW]

you should have shown how to get rid of that warning in browser

[@SavranTaha]

You can only do that for your own computer by installing the certificate. For youre clients you have to buy a real certificate

[@danrleybrasil]

Hi, my name is Danrley and my nickname is Dan, when I saw "Dan" (3:31) I was like "what?" hahahaha

[@drisschebbi8368]

not funny dan

[@jeremiasmedrano1384]

keytool -genkey -alias "kt"-storetype PKCS12 -keyalg RSA -keysize 2048 -keystore "kt".p12 -validity 3650 replace things betweens " "

[@drisschebbi8368]

Thanks buddy !!!!