037abaeb26
* New naming convention using webflux and webmvc
The new suffixes are gateway-server-web{flux|mvc} and gateway-proxyexchange-web{flux|mvc}.
This commit updates the starters to use gateway-server-web{flux|mvc} suffixes.
* Adds new spring-cloud-gateway-server-web{flux|mvc} modules.
These simply depend on the old ones. A warning is logged if not using the new module.
* Adds s-c-g-proxyexchange-{webflux|webmvc} modules
* Updates docs for s-c-g-{proxyexchange|server}-{webflux|webmvc} modules
71 lines
1.8 KiB
Plaintext
71 lines
1.8 KiB
Plaintext
[[tls-and-ssl]]
|
|
= TLS and SSL
|
|
|
|
The gateway can listen for requests on HTTPS by following the usual Spring server configuration.
|
|
The following example shows how to do so:
|
|
|
|
.application.yml
|
|
[source,yaml]
|
|
----
|
|
server:
|
|
ssl:
|
|
enabled: true
|
|
key-alias: scg
|
|
key-store-password: scg1234
|
|
key-store: classpath:scg-keystore.p12
|
|
key-store-type: PKCS12
|
|
----
|
|
|
|
You can route gateway routes to both HTTP and HTTPS backends.
|
|
If you are routing to an HTTPS backend, you can configure the gateway to trust all downstream certificates with the following configuration:
|
|
|
|
.application.yml
|
|
[source,yaml]
|
|
----
|
|
spring:
|
|
cloud:
|
|
gateway:
|
|
httpclient:
|
|
ssl:
|
|
useInsecureTrustManager: true
|
|
----
|
|
|
|
Using an insecure trust manager is not suitable for production.
|
|
For a production deployment, you can configure the gateway with a set of known certificates that it can trust with the following configuration:
|
|
|
|
.application.yml
|
|
[source,yaml]
|
|
----
|
|
spring:
|
|
cloud:
|
|
gateway:
|
|
httpclient:
|
|
ssl:
|
|
trustedX509Certificates:
|
|
- cert1.pem
|
|
- cert2.pem
|
|
----
|
|
|
|
If the Spring Cloud Gateway is not provisioned with trusted certificates, the default trust store is used (which you can override by setting the `javax.net.ssl.trustStore` system property).
|
|
|
|
[[tls-handshake]]
|
|
== TLS Handshake
|
|
|
|
The gateway maintains a client pool that it uses to route to backends.
|
|
When communicating over HTTPS, the client initiates a TLS handshake.
|
|
A number of timeouts are associated with this handshake.
|
|
You can configure these timeouts can be configured (defaults shown) as follows:
|
|
|
|
.application.yml
|
|
[source,yaml]
|
|
----
|
|
spring:
|
|
cloud:
|
|
gateway:
|
|
httpclient:
|
|
ssl:
|
|
handshake-timeout-millis: 10000
|
|
close-notify-flush-timeout-millis: 3000
|
|
close-notify-read-timeout-millis: 0
|
|
----
|