tomcat配置https踩坑

Posted 2022-06-11 zf04295

1生成keystore文件

keytool -genkey -alias 别名 -keyalg RSA -keysize 1024 -dname "CN=域名或者IP, OU=自定义, O=自定义, L=自定义, ST=自定义, C=CN" -validity 365 -keypass tomcat -keystore 文件位置 -storepass 密码

2生成对应的crt文件

keytool -exportcert -alias 别名 -keystore keystore文件路径 -file /home/apache-tomcat-7.0.69/conf/tomcat.crt -keypass tomcat -storepass 密码

3配置tomcat的server.xml

(1)<Connector port="18081" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="18443" />
         (2)      <Connector port="18443" protocol="org.apache.coyote.http11.Http11NioProtocol" 
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
KeystoreFile="/home/apache-tomcat-7.0.69/conf/tomcat.keystore" keystorePass="LWs635617"
               clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
               ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA" />  
           (3)    <Connector port="8009" protocol="AJP/1.3" redirectPort="18443" />

4找到jdk安装位置/usr/local/jdk1.7.0_80/jre/lib/security
在改位置下执行以下命令，对应keytool位置和crt文件位置，执行后需要输入密码：changeit，然后yes回车

/usr/local/jdk1.7.0_80/bin/keytool -import -alias tomcat -keystore cacerts -file /home/apache-tomcat-7.0.69/conf/tomcat.crt

5重启tomcat