Introduction

Spring Boot can serve HTTPS directly, but only one embedded server connector is configured from properties by default. If you want the application to listen on both HTTPS and HTTP ports at the same time, the usual pattern is to configure HTTPS as the main connector and then add a second HTTP connector programmatically. For many production systems, a reverse proxy is even simpler, but it is still useful to know how to do it inside the app.

Configure HTTPS as the Main Connector

Start by configuring SSL in application.properties or application.yml. This makes the embedded server listen on the secure port.

1server.port=8443
2server.ssl.enabled=true
3server.ssl.key-store=classpath:keystore.p12
4server.ssl.key-store-password=changeit
5server.ssl.key-store-type=PKCS12
6server.ssl.key-alias=tomcat

With this setup alone, your app serves HTTPS on port 8443.

You can create a local test certificate with keytool:

1keytool -genkeypair \
2  -alias tomcat \
3  -keyalg RSA \
4  -storetype PKCS12 \
5  -keystore keystore.p12 \
6  -validity 3650

That gives Spring Boot the keystore it needs for TLS termination.

Add a Second HTTP Connector in Tomcat

There is no built-in property such as server.http.port that automatically adds a second connector. For embedded Tomcat, you add the extra connector yourself.

1import org.apache.catalina.connector.Connector;
2import org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory;
3import org.springframework.boot.web.servlet.server.ServletWebServerFactory;
4import org.springframework.context.annotation.Bean;
5import org.springframework.context.annotation.Configuration;
6
7@Configuration
8public class DualPortConfig {
9
10    @Bean
11    public ServletWebServerFactory servletContainer() {
12        TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory();
13        tomcat.addAdditionalTomcatConnectors(httpConnector());
14        return tomcat;
15    }
16
17    private Connector httpConnector() {
18        Connector connector =
19            new Connector(TomcatServletWebServerFactory.DEFAULT_PROTOCOL);
20        connector.setScheme("http");
21        connector.setPort(8080);
22        connector.setSecure(false);
23        connector.setRedirectPort(8443);
24        return connector;
25    }
26}

After this:

• 'https://localhost:8443 serves HTTPS'
• 'http://localhost:8080 is available as a plain HTTP connector'

The redirectPort tells Tomcat where secure traffic should go if security constraints trigger a redirect.

Redirect HTTP Traffic to HTTPS

If the goal is "accept both ports, but force browsers onto HTTPS," configure your security rules to require secure requests.

In modern Spring Security:

1import org.springframework.context.annotation.Bean;
2import org.springframework.context.annotation.Configuration;
3import org.springframework.security.config.annotation.web.builders.HttpSecurity;
4import org.springframework.security.web.SecurityFilterChain;
5
6@Configuration
7class SecurityConfig {
8    @Bean
9    SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
10        http
11            .requiresChannel(channel -> channel
12                .anyRequest().requiresSecure()
13            );
14
15        return http.build();
16    }
17}

That way, the HTTP connector can exist for compatibility or redirection, while real application traffic ends up on HTTPS.

When a Reverse Proxy Is Better

Running both connectors inside the app is valid, but it is not always the best architecture. In many deployments, a reverse proxy or load balancer handles TLS and forwards traffic to a single internal HTTP port.

That approach is often better when you need:

• centralized certificate management
• HTTP to HTTPS redirects outside the JVM
• consistent edge security across several services

So the embedded dual-port setup is useful, but not automatically the production default.

Common Pitfalls

One common mistake is inventing a property such as server.port.https or server.http.port. Spring Boot does not auto-wire a second connector from those names.

Another issue is forgetting that the connector example above is Tomcat-specific. If your app uses Jetty or Undertow, the code changes because the server implementation is different.

Keystore errors are also frequent. If the file path, password, or alias is wrong, the app may fail at startup before the HTTP connector logic even matters.

Finally, do not assume redirectPort alone forces all traffic to HTTPS. Redirection also depends on security configuration and request handling.

Summary

• Spring Boot config properties usually define one embedded server connector.
• Configure HTTPS as the primary connector with SSL properties.
• Add a second HTTP connector programmatically for embedded Tomcat.
• Use Spring Security if you want HTTP requests redirected to HTTPS.
• In many production systems, handling TLS and redirects in a reverse proxy is simpler than dual-port app configuration.