SpringBoot实现国密通信的流程步骤

gmssl ecparam -genkey -name sm2p256v1 -out ca-key.pem
gmssl req -new -x509 -sm3 -key ca-key.pem -out ca-cert.pem -subj "/CN=GM CA"

gmssl ecparam -genkey -name sm2p256v1 -out server-key.pem
gmssl req -new -key server-key.pem -out server-req.pem -subj "/CN=localhost"
gmssl x509 -req -in server-req.pem -sm3 -CA ca-cert.pem -CAkey ca-key.pem -out server-cert.pem -days 365 -CAcreateserial

gmssl ecparam -genkey -name sm2p256v1 -out client-key.pem
gmssl req -new -key client-key.pem -out client-req.pem -subj "/CN=localhost"
gmssl x509 -req -in client-req.pem -sm3 -CA ca-cert.pem -CAkey ca-key.pem -out client-cert.pem -days 365 -CAcreateserial

gmssl pkcs12 -export -in server-cert.pem -inkey server-key.pem -out server-keystore.p12 -name server -CAfile ca-cert.pem -caname root

gmssl pkcs12 -export -in client-cert.pem -inkey client-key.pem -out client-keystore.p12 -name client -CAfile ca-cert.pem -caname root

server:
  port: 8443
  ssl:
    # server-keystore.p12文件放在工程src/main/resource目录下
    key-store: classpath:server-keystore.p12
    key-store-password: changeit # 使用导出时设置的密码
    key-store-type: PKCS12
    key-alias: server

@RestController
public class HelloController {

    @GetMapping("/hello")
    public String sayHello() {
        return "Hello from Project B with GMSSL!";
    }
}

server:
  ssl:
   # client-keystore.p12文件放在工程src/main/resource目录下
    key-store: classpath:client-keystore.p12
    key-store-password: changeit
    key-store-type: PKCS12
    key-alias: client

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.web.client.RestTemplate;
import javax.net.ssl.SSLContext;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContextBuilder;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;

@Configuration
public class RestTemplateConfig {

    @Bean
    public RestTemplate restTemplate() throws Exception {
        SSLContext sslContext = SSLContextBuilder
                .create()
                .loadKeyMaterial(
                        new File("src/main/resources/client-keystore.p12"), // 客户端证书路径
                        "changeit".toCharArray(), // KeyStore 密码
                        "changeit".toCharArray()) // Key 密码
                // 如果使用的是第三方权威 CA 签发的标准证书（如 DigiCert、GlobalSign、Let's Encrypt 等），通常不需要在客户端手动配置 CA 证书。因为这些权威 CA 的根证书已经被包含在大多数 JDK 的默认信任库中。省略下面一行
                .loadTrustMaterial(new File("src/main/resources/ca-cert.pem"), new TrustSelfSignedStrategy())
                .build();

        HttpComponentsClientHttpRequestFactory requestFactory = new HttpComponentsClientHttpRequestFactory(
                HttpClients.custom().setSSLContext(sslContext).build());
        return new RestTemplate(requestFactory);
    }
}

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
import org.springframework.web.client.RestTemplate;

@RestController
public class TestController {

    @Autowired
    private RestTemplate restTemplate;

    @GetMapping("/call-hello")
    public String callHello() {
        String url = "https://localhost:8443/hello"; // 项目 B 的 HTTPS 地址
        return restTemplate.getForObject(url, String.class);
    }
}

keytool -list -v -keystore server-keystore.p12 -storepass <password>

import javax.net.ssl.SSLSession;
import javax.net.ssl.HttpsURLConnection;
import java.net.URL;

public void checkSSLConnection() throws Exception {
    URL url = new URL("https://localhost:8443/hello");
    HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
    connection.connect();

    SSLSession session = connection.getSession();
    System.out.println("Cipher Suite: " + session.getCipherSuite()); // 确认是否为 SM 算法
}