Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish “Allow management server SSL to be configured independently”

Browse Source 
This commit polishes b0fbc7e, throwing an exception when an attempt is
made to configure management-specific SSL without also configuring a
custom management port. The testing of management-specific SSL
configuration has also been improved.

See gh-6057
Closes gh-4810
This commit is contained in:
Andy Wilkinson
2016-06-27 12:33:21 +01:00
parent 3546ae399e
commit 618535f576
5 changed files with 162 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
View File

@@ -1006,10 +1006,25 @@ content into your application; rather pick only the properties that you need.
management.add-application-context-header=true # Add the "X-Application-Context" HTTP header in each response.
management.address= # Network address that the management endpoints should bind to.
management.context-path= # Management endpoint context-path. For instance `/actuator`
management.port= # Management endpoint HTTP port. Use the same port as the application by default.
management.port= # Management endpoint HTTP port. Uses the same port as the application by default. Configure a different port to use management-specific SSL.
management.security.enabled=true # Enable security.
management.security.roles=ADMIN # Comma-separated list of roles that can access the management endpoint.
management.security.sessions=stateless # Session creating policy to use (always, never, if_required, stateless).
management.ssl.ciphers= # Supported SSL ciphers. Requires a custom management.port.
management.ssl.client-auth= # Whether client authentication is wanted ("want") or needed ("need"). Requires a trust store. Requires a custom management.port.
management.ssl.enabled= # Enable SSL support. Requires a custom management.port.
management.ssl.enabled-protocols= # Enabled SSL protocols. Requires a custom management.port.
management.ssl.key-alias= # Alias that identifies the key in the key store. Requires a custom management.port.
management.ssl.key-password= # Password used to access the key in the key store. Requires a custom management.port.
management.ssl.key-store= # Path to the key store that holds the SSL certificate (typically a jks file). Requires a custom management.port.
management.ssl.key-store-password= # Password used to access the key store. Requires a custom management.port.
management.ssl.key-store-provider= # Provider for the key store. Requires a custom management.port.
management.ssl.key-store-type= # Type of the key store. Requires a custom management.port.
management.ssl.protocol=TLS # SSL protocol to use. Requires a custom management.port.
management.ssl.trust-store= # Trust store that holds SSL certificates. Requires a custom management.port.
management.ssl.trust-store-password= # Password used to access the trust store. Requires a custom management.port.
management.ssl.trust-store-provider= # Provider for the trust store. Requires a custom management.port.
management.ssl.trust-store-type= # Type of the trust store. Requires a custom management.port.
# HEALTH INDICATORS (previously health.*)
management.health.db.enabled=true # Enable database health check.

33
spring-boot-docs/src/main/asciidoc/production-ready-features.adoc
View File

@@ -595,6 +595,39 @@ disable the management security in this way, and it might even break the applica
[[production-ready-management-specific-ssl]]
=== Configuring management-specific SSL
When configured to use a custom port, the management server can also be configured with
its own SSL using the various `management.ssl.*` properties. For example, this allows a
management server to be available via HTTP while the main application uses HTTPS:
[source,properties,indent=0]
----
server.port=8443
server.ssl.enabled=true
server.ssl.key-store=classpath:store.jks
server.ssl.key-password=secret
management.port=8080
management.ssl.enable=false
----
Alternatively, both the main server and the management server can use SSL but with
different key stores:
[source,properties,indent=0]
----
server.port=8443
server.ssl.enabled=true
server.ssl.key-store=classpath:main.jks
server.ssl.key-password=secret
management.port=8080
management.ssl.enable=true
management.ssl.key-store=classpath:management.jks
management.ssl.key-password=secret
----
[[production-ready-customizing-management-server-address]]
=== Customizing the management server address
You can customize the address that the management endpoints are available on by