Configure multiple SSL certificates for a single domain in Spring-Boot

user_7189597 0
Viewed 627

A year ago I have bought an SSL certificate for the wxyz.com domain.

With some researches, I have created an sslKeyStore.p12 and added my certificate with Alias=wxyz in it.

Then I added that keyStore to the root of my project.

Also I have configured my Spring-Boot application with the following variables:

server.port=443
server.ssl.key-store=keystore.p12
server.ssl.key-store-password=myPass
server.ssl.keyStoreType=PKCS12
server.ssl.keyAlias=wxyz

Now after a year my certificate will expire soon, so I have bought another certificate and added the new certificate to the keystore with Alias=wxyz2.

But the question is: How can I configure my Spring-Boot application so that it works with both certificates at the same time?

In my configuration file, I can only define one server.ssl.keyAlias

Is it possible to define both of the following variables at the same time?

server.ssl.keyAlias=wxyz
server.ssl.keyAlias=wxyz2

Any help would be appreciated.

spring-boot keystore ssl-certificate spring java
1 Answers

What you want to achieve is not possible by design. It is not the way that SSL is intended to work - you cannot sign your HTTP responses with two keys concurrently.

The best option I see here is - as Andreas mentioned in the comments - to deploy a client app that accepts both certificates and change your server to use the new certificate on the day the old one expires. When some clients won‘t have updated on that day, there‘s nothing you can do but implementing a better software design in the future ;)

For the future you should consider switching to an SSL infrastructure that is wildly accepted by default and don‘t rely on proprietary SSL certificates. Have a look at Let‘s Encrypt, it issues certificates for free that are accepted on most platforms that you will encounter today.

user_30905060
Related