配置Tomcat连接密码设备实现HTTPS

硬件密码模块(HSM)可以是密码机、密码卡、USBKey，前提是它们有提供PKCS#11接口。
Tomcat(JBoss等J2EE服务器)连接加密机(加密卡,USBKey)等做SSL服务端，通信调用层次大概是HTTPS->JSSE->JCE->PKCS#11->密码介质。

下面以海泰USBKey为例，配置基本步骤：
1 写P11配置文件pkcs11.cfg，内容大概：
name = HtKeyTest
library = C:/Windows/System32/HtPkcs11.dll
slot = 0

2 配置JRE的java.security文件，增加一个提供者：
security.provider.10=sun.security.pkcs11.SunPKCS11 D:/Java/jre6/lib/security/pkcs11.cfg

3 配置Tomcat的server.xml，在SSL配置项：
<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
      maxThreads="150" scheme="https" secure="true"
      clientAuth="false" sslProtocol="TLS"
      truststoreFile="${catalina.home}/conf/https/cacerts"

      keystoreProvider="SunPKCS11-HtKeyTest"
      keystore="NONE"
      keystoreType="PKCS11"
      keystorePass="12345678"
/>

Tomcat会找到第一个容器里的证书及密钥对作为服务器端证书及密钥对。然后就可以正常访问 https://ip/ 了

 

 

一些有用的命令：

keytool命令:
keytool -keystore NONE -storetype PKCS11 -providerName SunPKCS11-HtKeyTest -list

 

Tomcat配置参数说明：

<Connector port="443"
  minSpareThreads="25"
  maxThreads="150"
  maxSpareThreads="75"
  maxHttpHeaderSize="8192"
  enableLookups="false"
  disableUploadTimeout="true"
  acceptCount="100"
  connectionTimeout="60000"

  SSLEnabled="true"
  scheme="https"
  secure="true"
  clientAuth="true"  //"true","want","false". default "false"
  protocol="TLS"  //"TLS","SSL v3". default "TLS"
  ciphers="TLS_RSA_WITH_RC4_128_SHA"

  truststoreProvider="SunJSSE"
  truststoreType="JKS"  //default "JKS"
  truststoreFile="${catalina.home}/conf/https/cacerts"
  truststorePass="12345678" //default "changeit"
  truststoreAlgorithm="PKIX" //"SunX509","PKIX"
  crlFile="netca_indv.crl"

  keystoreProvider="SunPKCS11-HtKeyTest"
  keystoreType="PKCS11"  //"JKS","PKCS12". default "JKS"
  keystore="mykey.jks"
  keyAlias="FCA584CA-D5DC-CB1B-0CDE-38B039424862" //default "server"
  keystorePass="12345678" //default "changeit"
  algorithm="SunX509"  //"SunX509","NewSunX509"
/>
javax.net.ssl.keyStoreType system property

 

REF:
Sun JSSE的配置：http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html
Sun PKCS11 JCE的配置：http://docs.oracle.com/javase/6/docs/technotes/guides/security/p11guide.html
SSL/TLS Configuration HOW-TO: https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html

Apache Tomcat Configuration Reference -> The HTTP Connector：https://tomcat.apache.org/tomcat-7.0-doc/config/http.html