Tomcat HTTPS 证书制作

Read

[root@Test1 123]# openssl rsa -in pri.key -out personal.key
writing RSA key
[root@Tomcat ~]# openssl pkcs12 -export -out note.t4x.org.pfx -inkey personal.key -in note.t4x.org.cer # 导出pfx,两次密码
[root@Tomcat ~]# keytool -importkeystore -srckeystore note.t4x.org.pfx -destkeystore note.t4x.org.jks -srcstoretype PKCS12 -deststoretype JKS

[root@Test1 123]# openssl rsa -in pri.key -out personal.key

writing RSA key

[root@Tomcat ~]# openssl pkcs12 -export -out note.t4x.org.pfx -inkey personal.key -in note.t4x.org.cer # 导出pfx,两次密码

[root@Tomcat ~]# keytool -importkeystore -srckeystore note.t4x.org.pfx -destkeystore note.t4x.org.jks -srcstoretype PKCS12 -deststoretype JKS

[root@Tomcat ~]# vim /usr/local/tomcat/conf/server.xml
 <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystoreFile="/usr/local/tomcat/conf/note.t4x.org.jks" keystorePass="123456" />
[root@Tomcat ~]# tail /usr/local/tomcat/conf/web.xml
    <login-config>
        <auth-method>CLIENT-CERT</auth-method>
        <realm-name>Client Cert Users-only Area</realm-name>
    </login-config>
    <security-constraint>
        <web-resource-collection >
            <web-resource-name >SSL</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
</web-app>

[root@Tomcat ~]# vim /usr/local/tomcat/conf/server.xml

<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"

maxThreads="150" scheme="https" secure="true"

clientAuth="false" sslProtocol="TLS" keystoreFile="/usr/local/tomcat/conf/note.t4x.org.jks" keystorePass="123456" />

[root@Tomcat ~]# tail /usr/local/tomcat/conf/web.xml

<login-config>

<auth-method>CLIENT-CERT</auth-method>

<realm-name>Client Cert Users-only Area</realm-name>

</login-config>

<security-constraint>

<web-resource-collection >

<web-resource-name >SSL</web-resource-name>

<url-pattern>/*</url-pattern>

</web-resource-collection>

<user-data-constraint>

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

</user-data-constraint>

</security-constraint>

</web-app>

    <Connector port="8181" protocol="org.apache.coyote.http11.Http11AprProtocol"
               connectionTimeout="20000"
               redirectPort="8443"
               compression="on"   
               compressionMinSize="8192"   
               noCompressionUserAgents="gozilla, traviata"   
               compressableMimeType="text/html,text/xml,text/javascript,text/css,text/plain"  />