Linux tomcat https访问设置

1
2
3
keytool -export -trustcacerts -alias tomcat -file server.cer -keystore server.keystore -storepass 900930

sudo /usr/lib/jvm/jdk7/bin/keytool -import -trustcacerts -alias tomcat -file ./server.cer -keystore /usr/lib/jvm/jdk7/jre/lib/security/cacerts -storepass 900930

1
2
[plain] view plaincopyprint?
keytool -genkey -alias tomcat -keyalg RSA -keypass changeit -storepass changeit -keystore server.keystore -validity 3600 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
<!-- Define a SSL HTTP/1.1 Connector on port 8443 
    This connector uses the JSSE configuration, when using APR, the  
    connector should be using the OpenSSL style configuration 
    described in the APR documentation --> 
<!-- 
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" 
        maxThreads="150" scheme="https" secure="true" 
        clientAuth="false" sslProtocol="TLS" /> 
-->  去掉注释,加入key文件配置
 
 
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" 
        maxThreads="150" scheme="https" secure="true" 
        clientAuth="false" sslProtocol="TLS"  
keystoreFile="server.keystore"     
keystorePass="changeit"/> 

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
<login-config> 
    <!-- Authorization setting for SSL --> 
    <auth-method>CLIENT-CERT</auth-method> 
    <realm-name>Client Cert Users-only Area</realm-name> 
</login-config> 
<security-constraint> 
    <!-- Authorization setting for SSL --> 
    <web-resource-collection > 
        <web-resource-name >SSL</web-resource-name> 
        <url-pattern>/*</url-pattern> 
    </web-resource-collection> 
    <user-data-constraint> 
        <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
    </user-data-constraint> 
</security-constraint> 

1
2
3
<Connector port="8080" protocol="HTTP/1.1"  
       connectionTimeout="20000"  
       redirectPort="<span style="color:#FF0000;">8443</span>" URIEncoding="UTF-8" />