Springboot配置websocket ssl双向认证

Spring Boot 配置WebSocket SSL双向认证通常涉及到以下几个步骤：

1. **添加依赖**：首先，在`pom.xml`或`build.gradle`文件中添加WebSocket相关的Spring Websocket依赖，以及支持SSL/TLS的Spring Security依赖。

<!-- Maven -->
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-websocket</artifactId>
</dependency>
<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

<!-- Gradle (Kotlin) -->
implementation("org.springframework.boot:spring-boot-starter-websocket")
implementation("org.springframework.boot:spring-boot-starter-security")

2. **创建SSL证书**：生成一对公钥私钥对，比如使用`keytool`工具。在命令行运行类似下面的命令：

keytool -genkey -alias server-cert -keyalg RSA -keystore keystore.jks -storepass password -keypass password

3. **配置服务器端点**：在`Application.java`或其他启动类里，启用WebSocket并设置HTTPS监听：

@Configuration
@EnableWebSockets
public class WebSocketConfig extends AbstractWebSocketMessageBrokerConfigurer {

    @Override
    public void configureMessageBroker(MessageBrokerRegistry config) {
        // ...
    }

    @Override
    public void registerStompEndpoints(StompEndpointRegistry registry) {
        registry.addEndpoint("/websocket").withSockJS();
    }

    @Bean
    public ServletServerContainerFactoryBean createWebSocketContainer() {
        ServletServerContainer container = new StandardServletWebSocketContainer();
        container.setSecure(true); // 使用HTTPS
        // 如果需要SSLEngine设置，请在这里配置
        return container;
    }
}

4. **配置Spring Security**：在`SecurityConfig`类中，启用WebSocket安全，并指定客户端证书验证：

@Configuration
@EnableWebSecurity
@EnableWebsocketAuthentication
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    private CertificateAuthenticationProvider certificateAuthProvider;

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .authorizeRequests()
                .antMatchers("/ws/**").authenticated()
                .anyRequest().permitAll(); // 可能需要根据实际需求调整

        http.certificateBasedAuthentication()
            .authenticationManager(authenticationManager())
            .and()
            .apply(securityConfigurerAdapter);
    }

    @Bean
    public AuthenticationManager authenticationManagerBean() throws Exception {
        return new DefaultWebSecurityConfigurerAdapter().authenticationManager();
    }

    @Override
    protected void configure(WebSocketSecurity web) throws Exception {
        web.authorizeRequests()
            .anyMessage().authenticated()
            .and()
            .addCustomizer(new WebSocketSessionManagementExtensionAdapter(certificateAuthProvider));
    }
}

5. **提供证书**：将生成的keystore文件放在应用目录下，并在`application.properties`或`application.yml`中指定路径：

server.ssl.key-store=classpath:keystore.jks
server.ssl.key-store-password=password
server.ssl.trust-store=classpath:truststore.jks
server.ssl.trust-store-password=password

6. **启动应用并测试**：启动Spring Boot应用，客户端连接到HTTPS地址，并提供正确的证书进行验证。