[Question] How to support GM/T SSL (or GMSSL)？

### Question

I expect to implement GM SSL by integrating the BGMProvider cryptographic suite from OpenEuler.

Maven

~~~xml

org.openeuler
bgmprovider
1.1.3

~~~

application.yml

~~~yaml
server:
port: 9195
address: 0.0.0.0
servlet:
context-path: /
ssl:
enabled: true
key-alias: server-sm2-enc
key-store: classpath:server.keystore
key-store-password: 12345678
key-store-type: PKCS12
protocol: GMTLS
enabled-protocols: GMTLS
~~~

Modify the NettyReactiveWebServerFactory configuration in the ShenyuNettyWebServerConfiguration class by adding the following code.

~~~java
try {
File keyStoreFile = FileUtil.file(sslProperties.getKeyStore());
KeyStore keyStore = KeyUtil.readKeyStore(sslProperties.getKeyStoreType(), keyStoreFile, sslProperties.getKeyStorePassword().toCharArray());

KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(keyStore, sslProperties.getKeyStorePassword().toCharArray());
System.out.println(keyManagerFactory);
KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();

List ciphers = Arrays.asList("ECC_SM4_CBC_SM3", "ECDHE_SM4_CBC_SM3", "ECC_SM4_GCM_SM3", "ECDHE_SM4_GCM_SM3");
if (sslProperties.getCiphers() != null) {
ciphers = Arrays.asList(sslProperties.getCiphers());
}

SslContext sslContext = SslContextBuilder.forServer(keyManagers[0])
.protocols(TLS_PROTOCOL_GM)
.ciphers(ciphers, IdentityCipherSuiteFilter.INSTANCE_DEFAULTING_TO_SUPPORTED_CIPHERS)
.build();

httpServer = httpServer.secure(sslContextSpec -> {
sslContextSpec.sslContext(sslContext);
});

/*AbstractProtocolSslContextSpec sslContextSpec = Http11SslContextSpec.forServer(keyManagerFactory);
sslContextSpec.configure((builder) -> {
builder.sslProvider(SslProvider.JDK)
.sslContextProvider(BGM_PROVIDER)
.keyStoreType(sslProperties.getKeyStoreType());

if (sslProperties.getEnabledProtocols() != null) {
System.out.println(sslProperties.getEnabledProtocols());
builder.protocols(sslProperties.getEnabledProtocols());
}

if (sslProperties.getCiphers() != null) {
builder.ciphers(Arrays.asList(sslProperties.getCiphers()));
}
});

httpServer = httpServer.secure((spec) -> spec.sslContext(sslContextSpec), true);*/
} catch (KeyStoreException | NoSuchAlgorithmException | UnrecoverableKeyException | SSLException e) {
throw new LoongException("Create GM SSL Context fail");
}
~~~

The service started successfully, but accessing [https://127.0.0.1:9195/](https://127.0.0.1:9195/) using a GM browser failed with the error message: ERR_SSL_VERSION_OR_CIPHER_MISMATCH.

Modify code

~~~
httpServer = HttpServer.create().secure(sslContextSpec -> {
sslContextSpec.sslContext(sslContext);
});
~~~

Access to HTTPS is successful, but the port is set randomly and needs to be specified through .port(9443).

How to support GM/T SSL (or GMSSL)？

The issue points to ShenyuNettyWebServerConfiguration and its NettyReactiveWebServerFactory/HttpServer setup; start there and trace how the SSL properties reach the server. Compare the two secure-server paths, including explicit port configuration, and determine what is required for GM/T SSL to work with the stated BGMProvider settings. Done means configured GM/T SSL starts on the requested port and can be accessed by a GM browser.

Written by the indexing model from the issue text.