spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2026-09-17 12:09:16 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #50222 from henriquejsza

Browse Source 
* gh-38275-letsencrypt-ssl-reload-docs-3.5.x:
  Polish "Document SSL reloading with Let's Encrypt"
  Document SSL reloading with Let's Encrypt

Closes gh-50222
This commit is contained in:
Stéphane Nicoll
2026-05-30 12:09:41 +02:00
parent 30876aacc2 f53d9571eb
commit 8288b8fc36
1 changed files with 30 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spring-boot-project/spring-boot-docs/src/docs/antora/modules/reference/pages/features/ssl.adoc
+30
View File
@@ -181,3 +181,33 @@ A file watcher is then watching the files and if they change, the SSL bundle wil
This in turn triggers a reload in the consuming component, e.g. Tomcat rotates the certificates in the SSL enabled connectors.
You can configure the quiet period (to make sure that there are no more changes) of the file watcher with the configprop:spring.ssl.bundle.watch.file.quiet-period[] property.
[[features.ssl.reloading.lets-encrypt]]
=== Reloading SSL Bundles With Let's Encrypt
If you use certificates issued by https://letsencrypt.org/[Let's Encrypt] and renewed by an external tool, such as https://certbot.eff.org/[Certbot], you can configure a PEM bundle to use the generated files and enable reloading.
Certbot typically stores these in `/etc/letsencrypt/live/` under a directory named after your domain.
The following example shows how to configure a PEM bundle for `example.com`:
[configprops,yaml]
----
spring:
ssl:
bundle:
pem:
webserver:
reload-on-update: true
keystore:
certificate: "file:/etc/letsencrypt/live/example.com/fullchain.pem"
private-key: "file:/etc/letsencrypt/live/example.com/privkey.pem"
server:
ssl:
bundle: "webserver"
----
Spring Boot does not request or renew Let's Encrypt certificates.
When Certbot or another ACME client updates the configured files, the SSL bundle is reloaded.
Compatible consumers, such as Tomcat and Netty web servers, can then use the updated certificate without restarting the application.
The files in `/etc/letsencrypt/live` are typically symbolic links to files in `/etc/letsencrypt/archive`.
The file watcher follows symbolic links so that updates to the target files can trigger a reload.