How to encrypt server.ssl.key-store-password value and use it in SpringBoot

Question

I would like to know is there anyway we can encrypt the server.ssl.key-store-password value and store it in application.properties file instead of storing it in plain text.

i couldn't find any documentation on this. Any help on this is highly appreciated.

Thanks in advance.

Where would you store the encryption key? – holmis83 Sep 13 '17 at 16:30 — holmis83, Sep 13 '17 at 16:30
i would like to store it in a file and use it. – Nagaraju Chitimilla Sep 14 '17 at 13:00 — Nagaraju Chitimilla, Sep 14 '17 at 13:00
@holmis83 did you get a chance to look at it? – Nagaraju Chitimilla Sep 23 '17 at 06:50 — Nagaraju Chitimilla, Sep 23 '17 at 06:50

score 2 · Answer 1 · answered May 17 '18 at 22:59

2

Spring allows you to encrypt the properties file but the key for that encryption needs to be kept somewhere. This answer suggest keeping them in environment variables and points to a guide about how to encrypt them if you still want to.

answered May 17 '18 at 22:59

Guy Grin

1,968
2
17
38

score -1 · Answer 2 · answered Aug 14 '20 at 10:55

You can use "jasypt-spring-boot-starter" for your need. All you to need to do are the following steps.

Download the "jasypt-spring-boot-starter" from maven central repo.
com.github.ulisesbocchio jasypt-spring-boot-starter x.x.x
In your Spring Boot start file where the "@SpringBootApplication" annotation is located, just include "@EnableEncryptableProperties". A point to note here is that once you place encryptable properties annotation on the main start file, all the property files of your application will be loaded and scanned by Jaspyt module for any property value that is marked starting with "ENC".
In your "application.properties" file there are few more configurations that needed to be added like below (all these are defaults and you can change these according to your requirement):

jasypt.encryptor.password=<Some password for encryption>
jasypt.encryptor.algorithm=PBEWITHHMACSHA256ANDAES_128
jasypt.encryptor.key-obtention-iterations=1000
jasypt.encryptor.pool-size=1
jasypt.encryptor.salt-generator-classname=org.jasypt.salt.RandomSaltGenerator
jasypt.encryptor.iv-generator-classname=org.jasypt.iv.RandomIvGenerator
jasypt.encryptor.string-output-type=base64

Once you are done with the above steps, now you can place your encrypted property value under the ENC(). Jasypt will scan values which are enclosed in ENC() and will try to decrypt the value.

For e.g. spring.datasource.password=ENC(tHe0atcRsE+uOTxt2GmFYPXNHREch9R/12qD082gw7vv6bby5Rk)

This won't work. It is too far into the boot sequence. – B Randall Jul 21 '23 at 02:01 — B Randall, Jul 21 '23 at 02:01

How to encrypt server.ssl.key-store-password value and use it in SpringBoot

2 Answers2

Linked