tomcat配置https踩坑

Posted 2022-11-01 zf04295

1生成keystore文件
alias后面填写别名，-keystore后面规定存储路径以及文件名

keytool -genkey -v -alias tomcat -keyalg RSA -keystore /mnt/apache-tomcat-8.5.66/conf/tomcat.keystore -validity 36500

2生成对应的crt文件

keystore /mnt/apache-tomcat-8.5.66/conf/tomcat.keystore -file /mnt/apache-tomcat-8.5.66/conf/tomcat.crt -keypass tomcat -storepass LWs635617

3配置tomcat的server.xml

(1)<Connector port="18081" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="18443" />
         (2)      <Connector port="18443" protocol="org.apache.coyote.http11.Http11NioProtocol" 
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
KeystoreFile="/home/apache-tomcat-7.0.69/conf/tomcat.keystore" keystorePass="LWs635617"
               clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
               ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA" />  
           

4找到jdk安装位置/usr/local/jdk1.7.0_80/jre/lib/security
在改位置下执行以下命令，对应keytool位置和crt文件位置，执行后需要输入密码：changeit，然后yes回车

/usr/local/jdk1.7.0_80/bin/keytool -import -alias tomcat -keystore cacerts -file /home/apache-tomcat-7.0.69/conf/tomcat.crt

5重启tomcat