How to use SSL in Spring-boot and LetsEncrypt Easily

When developing Geonotes, I ran into the issue of Chrome not allowing non-HTTPS access to geolocation. The geonotes backend is Java, which generally implies that its robust, but needs to be tweaked a great deal for every use case -- read, not something I enjoy doing. After a brief look at available workarounds and trying a few out, I wanted to pull my hair out, but found there wasn't much left to pull. In the back of my mind somewhere, I recalled there was a way to set up an HTTPS-to-HTTP proxy, thus avoiding the need to mess with keytool and the rest of it, stunnel. Just needed to add a cronjob for certbot to renew certificates and Openssl commands to convert the issued certificate to one that the J2ee middleware likes. Without further ado, then.

Stunnel creates an proxy server on the localhost and handles the SSL to plaintext conversion. Indeed, the configuration is cake:

pid = /home/ec2-user/postgisweb/stunnel.pid
cert = /home/ec2-user/postgisweb/ssl.pem

[geonotes]
accept = 0.0.0.0:8443
connect = 127.0.0.1:8080

8080 is my HTTP port, and I want to run SSL on 8443. The wildcard IP is necessary because we want stunnel to listen on all IP addresses on the server, but want HTTP allowed only on localhost (else there's no point in SSL in the first place). The other interesting part is that ssl.pem is constructed using cat /usr/local/etc/letsencrypt/live/hasan.d8u.us/privkey.pem /usr/local/etc/letsencrypt/live/hasan.d8u.us/fullchain.pem | tee append ~ec2-user/postgisweb/ssl.pem. Stick the command in a cron job and have it run often -- I have mine set to every 3 hours.

We verify our work, by pointing our browser to port 8443 and checking if there are SSL issues. There are not. And we're set.