An SSL bundle is a named set of trust material, such as a keystore or truststore, defined under the spring.ssl.bundle prefix and referred to by name wherever Spring Boot configures a secure connection. It centralises certificate settings for the embedded web server and for clients, so each connection does not carry its own copy.
Definitions
- Keystore: holds your own certificate and private key, used when your app presents an identity.
- Truststore: holds certificates your app trusts, used when it calls another service.
- Bundle: a user named group of those settings.
The Spring Boot SSL documentation says properties with the prefix spring.ssl.bundle specify named sets of trust material, and that bundles can be applied to several types of connections.
Two formats
| Format | Prefix | Holds |
|---|---|---|
| Java KeyStore | spring.ssl.bundle.jks | JKS or PKCS12 files made with keytool |
| PEM | spring.ssl.bundle.pem | PEM encoded certificate and private key text |
Instead of a file location you can supply Base64 encoded content that starts with base64, and PEM text can be placed directly in the property if it has BEGIN and END markers. If you set a bundle through environment variables, the bundle name is always converted to lowercase.
Why it helps security
- One bundle, one place to review and rotate.
- Web server, data clients and REST clients can share a bundle by name rather than copying keystore settings.
- Spring auto configures an SslBundles bean, so code can fetch a bundle and build clients consistently instead of using system wide trust settings.
What to avoid
The docs' own examples show keystore passwords in properties. That is fine for illustration but not for production. Keep passwords out of files in the artifact and read them from a secret store, as described in how to read secrets in Spring Boot. Also avoid embedding private keys on the classpath inside a jar, because anyone with the jar has the key.
Steps
- Inventory every keystore and truststore your app uses today.
- Define a named bundle per purpose, for example one for inbound and one for a partner API.
- Reference bundles by name in server and client configuration.
- Source passwords and keys from mounted secrets, not from the packaged jar.
- Document expiry dates and rotate before they pass.
- Review any code that disables certificate checks. That is a separate bug, found through code review rather than a dependency scan.
Safeguard scans dependencies, produces SBOMs and uses reachability analysis to show which findings your code can actually reach. You can run a free scan at gold.safeguard.sh/scan.
Quick check
Can I use PEM files instead of a keystore?
Yes. The docs support PEM bundles through the spring.ssl.bundle.pem prefix.
Does a bundle replace certificate validation?
No. It supplies trust material. Validation still happens in the client or server using it.
Sources
Last reviewed: 19 October 2026.
