I'm planning to develop a web application that would run on-premise at the customer. I'm quite unsure about the whole process of setting up the site in a user-friendly way, but mostly disturbed by the SSL configuration. Which formats are a must to support? Should I require the admin to run my Java application with a lot of arguments (e.g.: database access and SSL can't be modified runtime I believe without restart), or try to push whatever I can towards the UI?
Some things will have to be set up on a machine by machine basis. The unfortunate truth is that TLS (the current version of SSL) is just tricky to get right.
If you have a number of servers to get set up, you can use Spring Cloud Configuration Server, which will help you centralize the configuration. It works well when you need to spin up another instance of your web site quickly, or want to manage installs per environment. One configuration server can manage the configurations for Integration, QA, Pre-Prod, and Production environments.
As to TLS support, you'll have to read up on what the current standards are. At the time of this answer you'll want:
- TLS 1.2+
- Limit your cypher suites to strong encryption
- A good recommendation is to follow HTTP/2 requirements for TLS support
Combining the two, you'll need to push the trust store and key store to your server and configure Spring to look at those files you've placed. That should let you pay the pain of setting up the TLS handshake once and easily replicate it out to other servers/services.
When it comes down to SSL configuration (or to be more correct HTTPS configuration) i would recommend you test your setup at https://www.ssllabs.com/ssltest/index.html and adjust to get an A grade or A+. Then you apply this config at your customers. HTTPS isn't such a dynamic topic that it changes every month. If your grade drops with the time do B it's still quite good and no need to change something.
Then i would test your setup every 3 months and if the need arises update your setup at your customers. From my experience an adjustment will be needed every 2,3 years (remove unsecure cipher suites) or an popular attack will be discovered. As the setup for HTTPS isn't that big i would not invest my time into developing an UI for HTTPS configuration. Just update manually configuration files/certificates.