说明

• nginx端使用http2+https,如果不使用https,浏览器会默认走http1.1
• 后台使用http2,不使用https,因为内部服务之间没必要每次校验证书

nginx配置

# user  root;
worker_processes  auto;

error_log  D://nginx-log/error.log;
# error_log /dev/null;

#pid        logs/nginx.pid;

events {
    worker_connections  20000;
}

http {
    access_log      off;
    include         mime.types;
    default_type    application/octet-stream;

    # 部分优化
    sendfile        on;
    # 等数据包累积到一定大小才发送
    tcp_nopush      on;
    #尽快发送数据包，和上面的二者相互矛盾。实际上，它们确实可以一起用，最终的效果是先填满包，再尽快发送。
    tcp_nodelay     on;
    # 服务端为每个TCP连接最多可以保持多长时间,Nginx 的默认值是75秒，有些浏览器最多只保持60秒，所以我统一设置为 60
    keepalive_timeout  60;

    # 开启gzip
    gzip  on;
    # 允许压缩的最小字节数
    gzip_min_length 100;
    # IE浏览器1-6版本禁用gzip
    gzip_disable "msie6";
    # 启用gzip的文件类型
    gzip_types text/plain text/css application/json application/x-javascript text/xml application/xml application/xml+rss text/javascript application/javascript;

    upstream gateway{
        server 127.0.0.1:43797;
    }

    # http server
    server {
       listen           80;
       listen           [::]:80;
       server_name      yalong.com;
       return           301 https://yalong.com$request_uri;
    }

    # HTTPS server
    server {
        listen                    443 ssl http2;
        listen                    [::]:443 ssl http2;
        server_name               yalong.com;
        ssl_certificate           C:/myssl/selfsigned.crt;
        ssl_certificate_key       C:/myssl/selfsigned.key;
        ssl_session_cache         shared:SSL:100m;
        ssl_session_timeout       1d;
        ssl_buffer_size           1400;
        ssl_protocols             TLSv1.1 TLSv1.2 TLSv1.3;
        ssl_ciphers               EECDH+CHACHA20:EECDH+AES128:RSA+AES128:EECDH+AES256:RSA+AES256:EECDH+3DES:RSA+3DES:!MD5;
        ssl_prefer_server_ciphers on;
        location ^~ / {
                       # 后台服务使用h2c,这样不用校验两次证书
                       proxy_pass http://gateway/;
                       proxy_set_header host $host;
                       proxy_set_header X-Real-IP      $remote_addr;
                       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                       add_header Kss-Upstream $upstream_addr;
                    }
        }

}

java代码配置

    <properties>
        <java.version>8</java.version>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <!-- 只要4.x支持http2 -->
        <okhttp.version>4.10.0</okhttp.version>
    </properties>

    <dependencies>
<!--   feign也使用okhttp,因为项目中更改了resttemplate的默认客户端为okhttp,并设置了h2c -->
<!--        <dependency>-->
<!--            <groupId>org.springframework.cloud</groupId>-->
<!--            <artifactId>spring-cloud-starter-openfeign</artifactId>-->
<!--        </dependency>-->

<!--        <dependency>-->
<!--            <groupId>io.github.openfeign</groupId>-->
<!--            <artifactId>feign-okhttp</artifactId>-->
<!--        </dependency>-->

        <dependency>
            <groupId>com.squareup.okhttp3</groupId>
            <artifactId>okhttp</artifactId>
            <version>${okhttp.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-tomcat</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- 用undertow替换tomcat,这样java8即可支持http2/h2c -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-undertow</artifactId>
        </dependency>
   </dependencies>

server:
  port: 43797
  compression:
    enabled: true
    min-response-size: 1024
    mime-types: text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json
  http2:
    # 开启h2(HTTP/2 over TLS)
    enabled: true
  undertow:
    # 设置IO线程数, 它主要执行非阻塞的任务,它们会负责多个连接, 默认设置每个CPU核心一个线程
    io-threads: 4
    # 阻塞任务线程池, 当执行类似servlet请求阻塞操作, undertow会从这个线程池中取得线程,它的值设置取决于系统的负载
    worker-threads: 20
    # 以下的配置会影响buffer,这些buffer会用于服务器连接的IO操作,有点类似netty的池化内存管理
    # 每块buffer的空间大小,越小的空间被利用越充分
    buffer-size: 1024
    # 是否分配的直接内存
    direct-buffers: true
  ssl:
    # 关闭ssl,使用h2c(HTTP/2 over TCP),这样内部服务间调用就不需要使用https,使用http即可,并且是http2协议
    # https://docs.spring.io/spring-boot/docs/2.5.8/reference/htmlsingle/#howto-configure-http2-h2c
    enabled: false
#    key-store: classpath:keystore.p12
#    key-store-password: 123456
#    key-store-type: PKCS12
#    protocol: TLSv1.3

package com.example.demo.config;

import lombok.extern.slf4j.Slf4j;
import okhttp3.ConnectionPool;
import okhttp3.OkHttpClient;
import okhttp3.Protocol;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.client.ClientHttpRequestFactory;
import org.springframework.http.client.OkHttp3ClientHttpRequestFactory;
import org.springframework.web.client.RestTemplate;

import javax.net.ssl.*;
import java.security.KeyStore;
import java.security.SecureRandom;
import java.security.cert.X509Certificate;
import java.util.Arrays;
import java.util.Collections;
import java.util.concurrent.TimeUnit;


/**
 * @author YaLong
 * @date 2023/6/2
 */
@Configuration
@Slf4j
public class RestTemplateConfig {

    @Bean
    public RestTemplate restTemplate() {
        ClientHttpRequestFactory factory = httpRequestFactory();
        return new RestTemplate(factory);
    }

    /**
     * 工厂
     */
    private ClientHttpRequestFactory httpRequestFactory() {
        return new OkHttp3ClientHttpRequestFactory(okHttpConfigClient());
    }

    private SSLSocketFactory getSslSocketFactory() {
        try {
            SSLContext sslContext = SSLContext.getInstance("TLSv1.3");
            sslContext.init(null, trustAllCerts(), new SecureRandom());
            return sslContext.getSocketFactory();
        } catch (Exception e) {
            throw new RuntimeException(e);
        }
    }
    private TrustManager[] trustAllCerts() {
        return new TrustManager[]{
                new X509TrustManager() {
                    @Override
                    public void checkClientTrusted(X509Certificate[] chain, String authType) {
                    }

                    @Override
                    public void checkServerTrusted(X509Certificate[] chain, String authType) {
                    }

                    @Override
                    public X509Certificate[] getAcceptedIssuers() {
                        return new X509Certificate[]{};
                    }
                }
        };
    }

    private  X509TrustManager getX509TrustManager() {
        X509TrustManager trustManager = null;
        try {
            TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
            trustManagerFactory.init((KeyStore) null);
            TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
            if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
                throw new IllegalStateException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
            }
            trustManager = (X509TrustManager) trustManagers[0];
        } catch (Exception e) {
            e.printStackTrace();
        }

        return trustManager;
    }

    /**
     * 客户端
     */
    private OkHttpClient okHttpConfigClient() {
        return new OkHttpClient().newBuilder()
                .connectionPool(pool())
                .connectTimeout(30, TimeUnit.SECONDS)
                .retryOnConnectionFailure(Boolean.TRUE)
                .readTimeout(30, TimeUnit.SECONDS)
                .writeTimeout(30, TimeUnit.SECONDS)
                // 若要使用h2c,必须用H2_PRIOR_KNOWLEDGE
//                .protocols(Arrays.asList(Protocol.HTTP_1_1,Protocol.HTTP_2))
                .protocols(Collections.singletonList(Protocol.H2_PRIOR_KNOWLEDGE))
                .hostnameVerifier((hostname, session) -> true)
                .sslSocketFactory(getSslSocketFactory(), getX509TrustManager())
                .build();
    }

    /**
     * 连接池
     */
    public ConnectionPool pool() {
        return new ConnectionPool(200, 5, TimeUnit.MINUTES);
    }
}