{"id":27021488,"url":"https://github.com/rhidoyhasanmahmud/springboot-two-way-ssl-authentication","last_synced_at":"2026-05-02T19:32:43.409Z","repository":{"id":126812119,"uuid":"467819381","full_name":"rhidoyhasanmahmud/springboot-two-way-ssl-authentication","owner":"rhidoyhasanmahmud","description":"Two way SSL Authentication Between Two Services ","archived":false,"fork":false,"pushed_at":"2022-03-13T06:09:36.000Z","size":805,"stargazers_count":4,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-04-04T19:53:40.017Z","etag":null,"topics":["2-way-ssl","java","mutual-authentication","spring-boot","springboot","ssl-certificates","two-way-ssl-authentication"],"latest_commit_sha":null,"homepage":"","language":"Java","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rhidoyhasanmahmud.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-03-09T07:21:22.000Z","updated_at":"2025-03-04T08:20:19.000Z","dependencies_parsed_at":"2023-06-18T04:15:14.245Z","dependency_job_id":null,"html_url":"https://github.com/rhidoyhasanmahmud/springboot-two-way-ssl-authentication","commit_stats":null,"previous_names":["rhidoyhasanmahmud/springboot-two-way-ssl-authentication","codemechanix/springboot-two-way-ssl-authentication"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/rhidoyhasanmahmud/springboot-two-way-ssl-authentication","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rhidoyhasanmahmud","download_url":"https://codeload.github.com/rhidoyhasanmahmud/springboot-two-way-ssl-authentication/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":32547645,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-02T19:18:06.202Z","status":"ssl_error","status_checked_at":"2026-05-02T19:16:21.335Z","response_time":132,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["2-way-ssl","java","mutual-authentication","spring-boot","springboot","ssl-certificates","two-way-ssl-authentication"],"created_at":"2025-04-04T19:50:48.913Z","updated_at":"2026-05-02T19:32:43.391Z","avatar_url":"https://github.com/rhidoyhasanmahmud.png","language":"Java","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003e \u003e Project Background Study:\n\nSSL (Secure Socket Layer) is the standard technology used for enabling secure communication between a client and server\nto ensure data security \u0026 integrity. SSL has evolved with time and several versions have been introduced to deal with\nany potential vulnerabilities. SSL V2 released in 1995 was the first public version of SSL followed by SSL V3 in 1996\nfollowed by TLS V1.0 in 1999, TLS V1.1 in 2006, and TLS V1.2 in 2008.\n\nFor ensuring the security of the data being transferred between a client and server, SSL can be implemented either\none-way or two-way.\n\n### How one-way-SSL works?\n\nIn one way SSL, the only client validates the server to ensure that it receives data from the intended server. For\nimplementing one-way SSL, the server shares its public certificate with the clients.\n\nBelow is the high-level description of the steps involved in the establishment of connection and transfer of data\nbetween a client and server in case of one-way SSL:\n\n1. Client requests for some protected data from the server on HTTPS protocol. This initiates SSL/TLS handshake process.\n2. Server returns its public certificate to the client along with server hello message.\n3. Client validates/verifies the received certificate. The client verifies the certificate through the certification\n   authority (CA) for CA-signed certificates.\n4. SSL/TLS client sends the random byte string that enables both the client and the server to compute the secret key to\n   be used for encrypting subsequent message data. The random byte string itself is encrypted with the server’s public\n   key.\n5. After agreeing on this secret key, the client and server communicate further for actual data transfer by\n   encrypting/decrypting data using this key.\n\nBelow is the pictorial description explaining how one-way SSL works:\n\n![One-Way-SSL-Communication](images/one-way%20ssl.jpg)\n\n### How Two-Way (Mutual) SSL works?\n\nContrary to one-way SSL; in case of two-way SSL, both client and server authenticate each other to ensure that both\nparties involved in the communication are trusted. Both parties share their public certificates to each other and then\nverification/validation is performed based on that.\n\nBelow is the high-level description of the steps involved in the establishment of connection and transfer of data\nbetween a client and server in the case of two-way SSL:\n\n1. Client requests a protected resource over HTTPS protocol and the SSL/TSL handshake process begins.\n2. Server returns its public certificate to the client along with server hello.\n3. Client validates/verifies the received certificate. The client verifies the certificate through the certification\n   authority (CA) for CA-signed certificates.\n4. If the Server certificate was validated successfully, the client will provide its public certificate to the server.\n5. Server validates/verifies the received certificate. The server verifies the certificate through the certification\n   authority (CA) for CA-signed certificates.\n6. After completion of the handshake process, the client and server communicate and transfer data with each other\n   encrypted with the secret keys shared between the two during the handshake.\n\nThe below image explains the same in the pictorial format:\n\n![Two-way-ssl-communication](images/2-way-ssl.png)\n\n### Terminology:\n\n##### SSL handshakes:\n\nSSL handshakes are a mechanism by which a client and server establish the trust and logistics required to secure their connection over the network.\n\n##### The Handshake in One-way SSL:\n\nIf we refer to the steps mentioned above, step two mentions the certificate exchange. One-way SSL requires that a client can trust the server through its public certificate. This leaves the server to trust all clients that request a connection. There is no way for a server to request and validate the public certificate from clients which can pose a security risk.\n\n##### The Handshake in Two-way SSL:\n\nWith one-way SSL, the server must trust all clients. But two-way SSL adds the ability for the server to be able to establish trusted clients as well. During a two-way handshake, both the client and server must present and accept each other's public certificates before a successful connection can be established.\n\n##### Keystore:\n\nKeystore is used to store private key and identity certificates that a specific program should present to both parties (server and client) for verification.\n\n##### Truststore:\n\nTruststore is used to store certificates from Certified Authorities (CA) that verify the certificate presented by the server in SSL connection.\n\n##### Keystore vs Truststore\n\nA Keystore contains private keys and certificates with their corresponding public keys. A truststore contains certificates from other parties that you expect to communicate with, or from Certificate Authorities that you trust to identify other parties.\n\n1. Keystore stores your credential. (Server or client) but Truststore stores other credentials (CA).\n2. Keystore is needed when you are setting up the server-side on SSL, but Truststore setup is required for the successful connection at the client-side.\n3. Keystore contains private and sensitive information, but Truststore doesn’t contain private and sensitive information.\n\n\u003e \u003e Project Implementation Process\n\n## Create Self signed Certificate for Client and Server\n\n### Client Self signed Certificate:\n\n```text\nkeytool -genkeypair -alias client-service -keyalg RSA -keysize 2048 -storetype JKS -keystore client-service.jks -validity 3650 -ext SAN=dns:localhost,ip:127.0.0.1\n```\n\n### Server Self signed Certificate:\n\n```text\nkeytool -genkeypair -alias server-service -keyalg RSA -keysize 2048 -storetype JKS -keystore server-service.jks -validity 3650 -ext SAN=dns:localhost,ip:127.0.0.1\n```\n\nNow we have client and server certs. So we need to set up trust between the certs. For gain the trust-ability we will\nimport client cert into servers trusted certificates and vice-versa.\n\nBefore doing this we extract public certificate from the jks files.\n\n# Create public certificate file from Client and Server cert\n\n### Extract public certificate from Client cert\n\n```text\nkeytool -export -alias client-service -file client-service.crt -keystore client-service.jks\n```\n\n### Extract public certificate from Server cert\n\n```text\nkeytool -export -alias server-service -file server-service.crt -keystore server-service.jks\n```\n\nNow, we will have to import client’s cert to server’s keystore and server’s cert to client’s keystore file.\n\n### Import Client Certificate to Server jks file\n\n```text\nkeytool -import -alias client-service -file client-service.crt -keystore server-service.jks\n```\n\n### Import Server Cert to Client jks File:\n\n```text\nkeytool -import -alias server-service -file server-service.crt -keystore client-service.jks\n```\n\n# Configure Server For 2 Way SSL:\n\n1. Firstly, Copy final server jks file (in my case, server-service.jks) to the src/main/resources/ folder of\n   server-service application.\n2. Secondly, copy final client jks (in my case client-service.jks) to src/main/resources/ folder of client-service\n   application.\n\n### Add the entries shown below in application.yml into client-service\n\n```yaml\nspring:\n  application:\n    name: client-service\n\nserver:\n  port: 9001\n  ssl:\n    enabled: true\n    client-auth: need\n    key-store: classpath:client-service.jks\n    key-store-password: client-service\n    key-alias: client-service\n    key-store-type: JKS\n    key-store-provider: SUN\n    trust-store: classpath:client-service.jks\n    trust-store-password: client-service\n    trust-store-type: JKS\n```\n\n### Add the entries shown below in application.yml into server-service\n\n```yaml\nspring:\n  application:\n    name: server-service\n\nserver:\n  port: 9002\n  ssl:\n     enabled: true\n    client-auth: need\n     key-store: classpath:server-service.jks\n     key-store-password: server-service\n     key-alias: server-service\n     key-store-type: JKS\n     key-store-provider: SUN\n     trust-store: classpath:server-service.jks\n     trust-store-password: server-service\n     trust-store-type: JKS\n```\n\nBecause it’s 2 way SSL. When we access gateway url in browser, our browser becomes the client to our gateway application\nand so, our gateway web app will ask the browser to present a cert for authentication.\n\nTo overcome this, we will have to import a cert to our browser. But our browser can’t understand a .jks file. Instead,\nit understands PKCS12 format. So, how do we convert .jks file to PKCS12 format? Again, keytool command to the rescue!!\n\n```text\nkeytool -importkeystore -srckeystore server-service.jks -destkeystore server-service.p12 -srcstoretype JKS -deststoretype PKCS12 -srcstorepass server-service-password -deststorepass server-service-password -srcalias server-service -destalias server-service -srckeypass server-service-password -destkeypass server-service-password -noprompt\n```\n\n# Project Output Demo:\n\n\u003e Step - 01 :: Running two Services\n\n1. Client Service Running\n   ![Client-Service-Running](images/Client-Service-Running.PNG)\n\n2. Server Service Running\n   ![Server-Service-Running](images/Server-Service-Running.PNG)\n\n\u003e Step - 02 :: Call Client Service To Server Service with maintain mutual SSL Communication\n\n1. Hit the API\n   ![Hit The API](images/Hit_On_The_API.PNG)\n\n2. Client Service Console\n   ![Hit The API](images/Client-Service-Console.PNG)\n\n3. Server Service Console\n   ![Hit The API](images/Server-Service-Console.PNG)\n\n\u003e Step - 03 :: Call Client Service To Server Service without maintain mutual SSL Communication\n\n1. Hit the API\n   ![Hit The API](images/Hit_On_The_API_2.PNG)\n\n2. Client Service Console\n   ![Hit The API](images/Client-Service-Error-Console.PNG)\n\n3. Server Service Console\n   ![Hit The API](images/Server-Service-Error-Console.PNG)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frhidoyhasanmahmud%2Fspringboot-two-way-ssl-authentication/lists"}