springboot程序 ssl 加密通信

比眉伴天荒 2022-11-21 14:47 215阅读 0赞

### 文章目录 ###

*  1, 生成keystore
 *  2, Tomcat 启用 HTTPS：配置server.xml
 *   *  a, 直接生成jks
     *  b, 把crt证书转jks
 *  3, Jar包 启用 HTTPS
 *   *  方式1, 修改配置文件application.properties
     *  方式2, java 启动参数添加https
     *   *  拓展：java -D参数的使用 （动态修改运行时参数值）

# 1, 生成keystore #

#Country Name (2 letter code) [XX]:CN
    #State or Province Name (full name) []:beijing
    #Locality Name (eg, city) [Default City]:beijing
    #Organization Name (eg, company) [Default Company Ltd]:my.com
    #Organizational Unit Name (eg, section) []:devops
    #Common Name (eg, your name or your server's hostname) []:ca.my.com
    #免交互：
    keytool -genkeypair -v -alias testKey -keyalg RSA -validity 365000 -keystore test.keystore \
    -storepass 123456789 -keypass 123456789 \
    -dname "cn=my.com.web, ou=devops, o=my.com, c=CN, l=bj , st=bj "
     		   
    [wang@c7-iris2 sh]# keytool -genkeypair -v -alias testKey -keyalg RSA -validity 365000 -keystore test.keystore
     Enter keystore password:
    Keystore password is too short - must be at least 6 characters
    Enter keystore password:
    Re-enter new password:
    What is your first and last name?
      [Unknown]:  my.com
    What is the name of your organizational unit?
      [Unknown]:  devops
    What is the name of your organization?
      [Unknown]:  my.com
    What is the name of your City or Locality?
      [Unknown]:  bj
    What is the name of your State or Province?
      [Unknown]:  bj
    What is the two-letter country code for this unit?
      [Unknown]:  CN
    Is CN=my.com, OU=devops, O=my.com, L=bj, ST=bj, C=CN correct?
      [no]:  yes
    
    Generating 2,048 bit RSA key pair and self-signed certificate (SHA256withRSA) with a validity of 3,650 days
            for: CN=my.com, OU=devops, O=my.com, L=bj, ST=bj, C=CN
    Enter key password for <testKey>
            (RETURN if same as keystore password):
    Re-enter new password:
    [Storing test.keystore]
    
    Warning:
    The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore test.keystore -destkeystore test.keystore -deststoretype pkcs12".
    
    
    [root@cdh-c6-master aaa]# ls
    test.keystore
    [wang@c7-iris2 ~]# mkdir /usr/share/ssl
    [wang@c7-iris2 ~]# cp test.keystore /usr/share/ssl/tomcat.keystore

# 2, Tomcat 启用 HTTPS：配置server.xml #

[https://tomcat.apache.org/tomcat-8.5-doc/ssl-howto.html\#Introduction\_to\_SSL][https_tomcat.apache.org_tomcat-8.5-doc_ssl-howto.html_Introduction_to_SSL]  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70]

## a, 直接生成jks ##

[wang@c7-iris2 ~]# vi apache-tomcat-8.5.54/conf/server.xml
     <Connector port="8080" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" keystoreFile="/usr/share/ssl/tomcat.keystore" keystorePass="123456789" clientAuth="false" />

## b, 把crt证书转jks ##

#把用户证书转换成P12格式
    [root@test-c6 http-ssl]# ls
    httpd.crt  httpd.key
    [root@test-c6 http-ssl]# openssl pkcs12 -export -in httpd.crt \
       -inkey httpd.key -out keystore.p12 -passout pass:abc@123456
     
    [root@test-c6 http-ssl]# ls
    httpd.crt  httpd.key  keystore.p12
    
    
    #把p12格式文件加入到JKS格式
    [root@test-c6 http-ssl]# keytool -importkeystore -srckeystore keystore.p12 \
      -srcstoretype PKCS12 -destkeystore keystore.jks \
      -srcstorepass abc@123456 -deststorepass abc@123456
    
    Importing keystore keystore.p12 to keystore.jks...
    Entry for alias 1 successfully imported.....
    
    [root@test-c6 http-ssl]# ls
    httpd.crt  httpd.key  keystore.jks  keystore.p12

# 3, Jar包 启用 HTTPS #

## 方式1, 修改配置文件application.properties ##

[wang@c7-iris2 ~]# cat application.properties
    server.port=8088
    server.ssl.key-store=C:/tomcat.keystore
    server.ssl.keyStoreType=JKS
    server.ssl.key-store-password=123456

打完Jar 包后, 启动jar包：  
![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center]

## 方式2, java 启动参数添加https ##

java -Dserver.ssl.key-store=C:\tomcat-httpd-pwd8888.keystore \
    	 -Dserver.sl.keyStoreType=JKS \
    	 -Dserver.ssl.key-store-password=pwd8888 \
    	 -Djava.security.egd=file:/dev/./urandom -Djava.net.preferIPv4Stack=true  \
    	 -jar com.example.demo-0.0.1-SNAPSHOT.jar
    
    或
    java -D...同上\
    	 -cp com.example.demo-0.0.1-SNAPSHOT.jar \
    	 org.springframework.boot.loader.JarLauncher

![在这里插入图片描述][watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70 1]

### 拓展：java -D参数的使用 （动态修改运行时参数值） ###

#1， tomcat =======设置java -D参数值
    [root@test-c6 bin]# ll ~/apache-tomcat-8.5.54/bin/setenv.sh
    -rw-r--r-- 1 root root 55 Mar 11 14:58 /root/apache-tomcat-8.5.54/bin/setenv.sh
    
    [root@test-c6 bin]# cat ~/apache-tomcat-8.5.54/bin/setenv.sh
    JAVA_OPTS="$JAVA_OPTS -Dserver.name=aaa -Xmx2g -Xms1g" 
    # -Djava.security.egd=file:/dev/./urandom -Djava.net.preferIPv4Stack=true 
    
    
    [root@test-c6 bin]# ps -ef |grep apache-tomcat-8.5.54
    root     14975     1  0 Mar11 ?        00:00:39 /usr/bin/java -Djava.util.logging.config.file=/root/apache-tomcat-8.5.54/conf/logging.properties \
    			-Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager \
    			-Dserver.name=aaa -Xmx2g -Xms1g -Djdk.tls.ephemeralDHKeySize=2048 \
    			-Djava.protocol.handler.pkgs=org.apache.catalina.webresources \
    			-Dorg.apache.catalina.security.SecurityListener.UMASK=0027 \
    			-Dignore.endorsed.dirs= \
    			-classpath /root/apache-tomcat-8.5.54/bin/bootstrap.jar:/root/apache-tomcat-8.5.54/bin/tomcat-juli.jar \
    			-Dcatalina.base=/root/apache-tomcat-8.5.54 \
    			-Dcatalina.home=/root/apache-tomcat-8.5.54 \
    			-Djava.io.tmpdir=/root/apache-tomcat-8.5.54/temp \
    			org.apache.catalina.startup.Bootstrap start
    
    
    [root@test-c6 ~]# cd apache-tomcat-8.5.54/bin/
    [root@test-c6 bin]# ./shutdown.sh
    Using CATALINA_BASE:   /root/apache-tomcat-8.5.54
    Using CATALINA_HOME:   /root/apache-tomcat-8.5.54
    Using CATALINA_TMPDIR: /root/apache-tomcat-8.5.54/temp
    Using JRE_HOME:        /usr
    Using CLASSPATH:       /root/apache-tomcat-8.5.54/bin/bootstrap.jar:/root/apache-tomcat-8.5.54/bin/tomcat-juli.jar
    
    [root@test-c6 bin]# java -cp ./bootstrap.jar:./tomcat-juli.jar org.apache.catalina.startup.Bootstrap start
    Mar 12, 2021 9:30:07 AM org.apache.catalina.startup.VersionLoggerListener log
    INFO: Server version name:   Apache Tomcat/8.5.54
    Mar 12, 2021 9:30:07 AM org.apache.catalina.startup.VersionLoggerListener log
    INFO: Server built:          Apr 3 2020 14:06:10 UTC
    Mar 12, 2021 9:30:07 AM org.apache.catalina.startup.VersionLoggerListener log
    ...
    Mar 12, 2021 9:30:09 AM org.apache.catalina.startup.HostConfig deployDirectory
    INFO: Deployment of web application directory [/root/apache-tomcat-8.5.54/webapps/examples] has finished in [381] ms
    Mar 12, 2021 9:30:09 AM org.apache.coyote.AbstractProtocol start
    INFO: Starting ProtocolHandler ["https-jsse-nio-8080"]
    Mar 12, 2021 9:30:09 AM org.apache.catalina.startup.Catalina start
    INFO: Server startup in 1028 ms
    
    
    #2， 自定义程序=======获取java -D参数值
    package com.example.demo;
    
    import java.util.Properties;
    public class Test { 
        public static void main(String[] args) { 
            Properties props=System.getProperties(); //系统属性
    
            System.out.println("Java的运行环境版本："+props.getProperty("java.version"));
            System.out.println("Java的安装路径："+props.getProperty("java.home"));
    
            System.out.println("ttttttttt："+System.getProperty("server.name"));
            System.out.println("ttttttttt："+props.getProperty("server.name"));
        }
    }
    #=======cmd运行java程序，加入-D参数和值 
    D:\data\test-dubbo\demo\target                                             
    λ java -Dserver.name=testname -cp .\classes\ com.example.demo.Test         
    Java的运行环境版本：1.8.0_31                                                       
    Java的安装路径：D:\software\jdk1.8.0_3\jre                                       
    ttttttttt：testname                                                         
    ttttttttt：testname

[https_tomcat.apache.org_tomcat-8.5-doc_ssl-howto.html_Introduction_to_SSL]: https://tomcat.apache.org/tomcat-8.5-doc/ssl-howto.html#Introduction_to_SSL
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70]: /images/20221120/c174a928a5a2456d8878c88e07aef657.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70_pic_center]: /images/20221120/31e0219f147749579aca1f359a8b49c5.png
[watermark_type_ZmFuZ3poZW5naGVpdGk_shadow_10_text_aHR0cHM6Ly9ibG9nLmNzZG4ubmV0L2V5ZW9mZWFnbGU_size_16_color_FFFFFF_t_70 1]: /images/20221120/d0d61cc710fc48a3a5074201b1e58746.png