配置tomcat6.0的HTTPS(单向)

Bertha 。 2024-02-17 14:07 15阅读 0赞

利用JDK自带的产生证书的工具 生成证书

建立一个脚本文件，内容如下：

set SERVER\_DN="CN=Server, OU=share, O=share, L=sz, S=gd, C=CN"  
set CLIENT\_DN="CN=Client, OU=share, O=share, L=sz, S=gd, C=CN"  
set KS\_PASS=-storepass changeit  
set KEYINFO=-keyalg RSA

keytool -genkey -alias Server -dname %SERVER\_DN% %KS\_PASS% -keystore server.keystore %KEYINFO% -keypass changeit  
keytool -export -alias Server -file test.cer %KS\_PASS% -keystore server.keystore  
keytool -import -file test.cer %KS\_PASS% -keystore client.truststore -alias serverkey -noprompt

keytool -genkey -alias Client -dname %CLIENT\_DN% %KS\_PASS% -keystore client.keystore %KEYINFO% -keypass changeit  
keytool -export -alias Client -file test.cer %KS\_PASS% -keystore client.keystore  
keytool -import -file test.cer %KS\_PASS% -keystore server.truststore -alias clientkey -noprompt  
pause

运行后生成下面的文件

server.keystore

server.truststore

client.truststore

client.keystore

test.cer

然后配置tomcat

打开server.xml

添加

<Connector port="8443" className="org.apache.coyote.http11.Http11Protocol"  
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"  
enableLookups="true" disableUploadTimeout="true"  
acceptCount="100" scheme="https" secure="true"  
SSLEnabled="true" clientAuth="false"  
keystoreFile="c:/server.keystore" keystorePass="changeit"  
truststoreFile="c:/server.truststore" truststorePass="changeit"

sslProtocol="TLS" />

这样就可以通过 [https://localhost:8443/][https_localhost_8443] 访问了

如果想让应用程序HTTP自动跳转到HTTPS，在应用程序的web.xml中加入：

<login-config>  
  
<auth-method>CLIENT-CERT</auth-method>  
<realm-name>Client Cert Users-only Area</realm-name>  
</login-config>  
<security-constraint>  
  
<web-resource-collection>  
<web-resource-name>SSL</web-resource-name>  
<url-pattern>/\*</url-pattern>  
</web-resource-collection>  
<user-data-constraint>  
<transport-guarantee>CONFIDENTIAL</transport-guarantee>  
</user-data-constraint>  
</security-constraint>

如果要通过程序代码访问https的WebService 那么需要添加JVM参数

\-Djavax.net.ssl.keyStore=C:/client/client.keystore  
\-Djavax.net.ssl.keyStorePassword=changeit  
\-Djavax.net.ssl.trustStore=C:/client/client.truststore

转载自：[http://blog.csdn.net/zhjb1025/article/details/3279512][http_blog.csdn.net_zhjb1025_article_details_3279512]

[https_localhost_8443]: https://localhost:8443/
[http_blog.csdn.net_zhjb1025_article_details_3279512]: http://blog.csdn.net/zhjb1025/article/details/3279512