SSL handshake failure when RestTemplate calls self‑signed HTTPS endpoint in Grails

Answer the question first

Use a named RestTemplate bean, not @Primary, and inject it into the service that needs the self‑signed endpoint. The default RestTemplate (used by Actuator and other libraries) remains unchanged.

1. Where to declare the bean

• grails-app/conf/spring/resources.groovy – the Grails‑style bean registry.
• or a @Configuration class – the Spring Boot‑style approach.

Both work; the resources.groovy file is processed after auto‑configuration, so a bean with the same name will not override the default unless marked @Primary.

2. Build a RestTemplate that trusts the self‑signed cert

// src/main/groovy/com/example/Config.groovy
package com.example

import org.springframework.context.annotation.Bean
import org.springframework.context.annotation.Configuration
import org.springframework.http.client.ClientHttpRequestFactory
import org.springframework.http.client.HttpComponentsClientHttpRequestFactory
import org.springframework.web.client.RestTemplate
import org.apache.http.conn.ssl.SSLConnectionSocketFactory
import org.apache.http.conn.ssl.TrustSelfSignedStrategy
import org.apache.http.ssl.SSLContexts
import org.apache.http.impl.client.CloseableHttpClient
import org.apache.http.impl.client.HttpClients

@Configuration
class RestTemplateConfig {

    @Bean(name = "trustedRestTemplate")
    RestTemplate trustedRestTemplate() {
        // Load a truststore that contains the self‑signed cert
        def trustStore = KeyStore.getInstance(KeyStore.defaultType)
        trustStore.load(new FileInputStream("src/main/resources/keystore.jks"), 'changeit'.toCharArray())
        def sslContext = SSLContexts.custom()
                .loadTrustMaterial(trustStore, null)
                .build()
        def socketFactory = new SSLConnectionSocketFactory(sslContext, new DefaultHostnameVerifier())
        CloseableHttpClient httpClient = HttpClients.custom()
                .setSSLSocketFactory(socketFactory)
                .build()
        ClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient)
        return new RestTemplate(factory)
    }
}

Replace the keystore path, password, and hostname verifier with values that match your environment. If the cert is a PEM file, load it into a KeyStore or use SSLContexts.custom().loadTrustMaterial(new File("cert.pem"), null).

3. Inject the named bean into the service that needs it

package com.example.service

import org.springframework.beans.factory.annotation.Autowired
import org.springframework.beans.factory.annotation.Qualifier
import org.springframework.stereotype.Service
import org.springframework.web.client.RestTemplate

@Service
class ExternalApiService {

    @Autowired
    @Qualifier("trustedRestTemplate")
    RestTemplate restTemplate

    String callSelfSignedEndpoint() {
        restTemplate.getForObject("https://selfsigned.example.com/api", String)
    }
}

Because the bean is named, only components that request trustedRestTemplate receive it. The default RestTemplate stays untouched.

4. Verify isolation

• Run ./gradlew test and assert that ExternalApiService uses the named bean.
• Access /actuator/health and confirm it still uses the default RestTemplate.
• Call the self‑signed endpoint in an integration test and expect a 200 OK.

5. Optional: scope the bean

By default the bean is a singleton, which is usually fine. If you need per‑request isolation, add @Scope("prototype") to the bean definition.

Follow‑up question

Do you have the self‑signed certificate in a JKS keystore, a PEM file, or another format? The loading code above assumes a JKS file; a different format would change the loadTrustMaterial call.