HTTPS / TLS

## application.yml — TLS 설정
##
## server:
##   port: 443
##   ssl:
##     enabled: true
##     key-store: classpath:keystore.p12
##     key-store-password: ${SSL_KEY_STORE_PASSWORD}
##     key-store-type: PKCS12
##     protocol: TLS
##     enabled-protocols: TLSv1.3,TLSv1.2

import org.springframework.boot.web.embedded.tomcat.*;
import org.springframework.context.annotation.*;
import javax.net.ssl.*;
import java.net.http.*;
import java.net.URI;

/* ── HTTPS 리다이렉트 설정 ─────────────────────────────── */
@Configuration
public class HttpsConfig {

    // HTTP(8080) → HTTPS(443) 자동 리다이렉트
    @Bean
    public TomcatServletWebServerFactory servletContainer() {
        var factory = new TomcatServletWebServerFactory();
        factory.addAdditionalTomcatConnectors(httpConnector());
        return factory;
    }

    private Connector httpConnector() {
        var connector = new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
        connector.setScheme("http");
        connector.setPort(8080);
        connector.setSecure(false);
        connector.setRedirectPort(443); // HTTP → HTTPS 리다이렉트
        return connector;
    }
}

/* ── HSTS 헤더 설정 ────────────────────────────────────── */
@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .requiresChannel(ch -> ch.anyRequest().requiresSecure())
            .headers(headers -> headers
                .httpStrictTransportSecurity(hsts -> hsts
                    .maxAgeInSeconds(31536000) // HSTS 1년
                    .includeSubDomains(true)
                    .preload(true)
                )
            );
        return http.build();
    }
}

/* ── Java HTTP Client로 HTTPS 요청 ─────────────────────── */
public class HttpsClient {
    public static void main(String[] args) throws Exception {
        var client = HttpClient.newBuilder()
            .version(HttpClient.Version.HTTP_2)
            // TLS 1.3 자동 협상, 인증서 검증 포함
            .build();

        var request = HttpRequest.newBuilder()
            .uri(URI.create("https://example.com"))
            .GET()
            .build();

        var response = client.send(request,
            HttpResponse.BodyHandlers.ofString());

        System.out.println("상태: " + response.statusCode());
        System.out.println("버전: " + response.version());
    }
}

import ssl
import socket
import json

# ── TLS 연결 정보 상세 확인 ─────────────────────────────
def inspect_tls(host: str, port: int = 443):
    context = ssl.create_default_context()

    with socket.create_connection((host, port)) as sock:
        with context.wrap_socket(sock, server_hostname=host) as ssock:

            # TLS 버전 확인
            print(f"TLS 버전: {ssock.version()}")        # TLSv1.3

            # 협상된 암호 스위트
            cipher = ssock.cipher()
            print(f"암호 스위트: {cipher[0]}")         # TLS_AES_256_GCM_SHA384
            print(f"프로토콜: {cipher[1]}")            # TLSv1.3
            print(f"키 길이: {cipher[2]} bits")       # 256

            # 서버 인증서 정보
            cert = ssock.getpeercert()
            subject = dict(x[0] for x in cert['subject'])
            issuer  = dict(x[0] for x in cert['issuer'])

            print(f"도메인: {subject.get('commonName')}")
            print(f"발급자: {issuer.get('organizationName')}")
            print(f"만료일: {cert['notAfter']}")

            # SAN (Subject Alternative Names)
            sans = cert.get('subjectAltName', [])
            print(f"SAN: {[s[1] for s in sans]}")

# ── 인증서 체인 확인 ────────────────────────────────────
def check_cert_chain(host: str):
    context = ssl.create_default_context()
    context.check_hostname = True
    context.verify_mode    = ssl.CERT_REQUIRED

    with socket.create_connection((host, 443)) as sock:
        with context.wrap_socket(sock, server_hostname=host) as ssock:
            # DER 형식 인증서 체인
            der_certs = ssock.getpeercert(binary_form=True)
            print(f"인증서 체인 크기: {len(der_certs)} bytes")

# ── 실행
inspect_tls("example.com")
# $ openssl s_client -connect example.com:443 -tls1_3 로도 확인 가능