1、生成CA自签文件
1.1 在openssl-0.9.8h-1-bin\bin进入cmd窗口
或者 cmd窗口路径到openssl-0.9.8h-1-bin\bin下
![](https://i-blog.csdnimg.cn/blog_migrate/2c1a24624c2a25eecc2a5b6f992502db.jpeg)
1.2
ras的秘钥长度:2048
存放ca公钥证书的路径:D:/cert_test/root_ca/ca_cert.pem
证书的有效期(天): 3650
根证书配置文件:D:/jx_cert/conf/gen_ca.conf 根据自己的需要调整配置文件的私钥证书证书存放路径,颁发者名称等
openssl req -x509 -newkey rsa:2048 -out D:/cert_test/root_ca/ca_cert.pem -outform PEM -days 3650 -config "D:/jx_cert/conf/gen_ca.conf"
执行此命令需要设置根证书密码
![](https://i-blog.csdnimg.cn/blog_migrate/cd01d1daa93baf40b785559d25cdd9dc.jpeg)
本次测试设置的密码是:test
运行完成1.1和1.2会生成ca_cert.pem和ca_private_key.pem这两个文件
![](https://i-blog.csdnimg.cn/blog_migrate/de0a17e95baadbe702d6044cdf83b9b1.png)
2、 生成tomcat.jks证书
tomcat.jsk证书存放路径:D:\cert_test\service\tomcat.jks
tomcat.jks证书密码:cert_test
颁发者名称(需要和配置名字的颁发者名称一样):QTHD_CMBC_SMZF
命令行进入jre根目录,执行
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -genkey -keyalg RSA -dname "CN=127.0.0.1, OU=servers, O=QTHD_CMBC_SMZF"
运行该命令后会生成tomcat.jks文件,在tomcat/bin目录service.xml配置Https需要使用到该证书
![](https://i-blog.csdnimg.cn/blog_migrate/fcc5249da6911d529113e472918d5f45.png)
生成的jks文件如下:
![](https://i-blog.csdnimg.cn/blog_migrate/e52d0dfc645d8af438dff904a40e8723.png)
3、根据tomcat.jks证书生成服务器请求证书
tomcat.jks证书存放路径:D:\cert_test\service\tomcat.jks
tomcat.jks证书密码:cert_test
serverreq.pem证书存放路径:D:\cert_test\service\serverreq.pem
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -certreq -file D:\cert_test\service\serverreq.pem
运行该命令后会生成serverreq.pem文件
4、CA签署服务器证书
serverreq.pem证书存放路径:D:\cert_test\service\serverreq.pem
servercert.pem证书存放路径:D:\cert_test\service\servercert.pem
qthd_ca.conf配置文件存放路径:D:\jx_cert\qthd_ca\qthd_ca.conf 根据需要调整配置文件的信息
需在D:\cert_test目录下新建newcerts文件夹,需把index和serial放进D:\test目录下
openssl ca -in D:\cert_test\service\serverreq.pem -out D:\cert_test\service\servercert.pem -config "D:\jx_cert\conf\ca.conf"
执行此命令需要输入根证书密码,并且需要同意签署证书和同意请求认证提交
![](https://i-blog.csdnimg.cn/blog_migrate/4231d0706b0d9046de24b8bfe5de16e8.png)
5、导入CA证书到keystore
tomcat.jks证书存放路径:D:\cert_test\service\tomcat.jks
tomcat.jks证书密码:cert_test
ca公钥证书路径:D:/cert_test/root_ca/ca_cert.pem
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias ca -import -trustcacerts -file D:/cert_test/root_ca/ca_cert.pem
执行此命令需要同意信任此证书
![](https://i-blog.csdnimg.cn/blog_migrate/bb0b55f006989b3c2392e1d00e010fbf.png)
6、导入服务器证书到keystore
tomcat.jks证书路径:D:\cert_test\service\tomcat.jks
tomcat.jks证书密码:cert_test
servercert.pem证书存放路径:D:\cert_test\service\servercert.pem
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -import -file D:\cert_test\service\servercert.pem
执行此命令可能会提示证书回复已安装在密钥库中,继续执行下一步即可
![](https://i-blog.csdnimg.cn/blog_migrate/e414527747031e44790b849e94504bb7.png)
7、查看keystore受信列表
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cmbc_smzf -storepass cert_test -list -v
![](https://i-blog.csdnimg.cn/blog_migrate/dfb0d0518cee378060ee1d9d089c506e.png)
8、将CA证书导入到受信keystore
truststore.jks证书路径:D:\cert_test\service\truststore.jks
truststore.jks证书密码:cert_test
ca公钥证书路径:D:\cert_test\root_ca\ca_cert.pem
keytool -keystore D:\cert_test\service\truststore.jks -keypass cert_test -storepass cert_test -alias ca -import -trustcacerts -file D:\cert_test\root_ca\ca_cert.pem
执行此命令时需要同意信任此证书,并且会生成truststore.jks证书
![](https://i-blog.csdnimg.cn/blog_migrate/38ef1a43afe502617b226151086db500.png)
9、tomcat配置https
需要在tomcat/conf目录下调整service.xml文件
A、注释掉<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
B、在两个Connector中间添加
<Connector SSLEnabled="true" acceptCount="100" className="org.apache.coyote.http11.Http11Protocol" clientAuth="true" connectionTimeout="30000" disableUploadTimeout="true" enableLookups="true" keepAliveTimeout="30000" keystoreFile="D:\https\apache-tomcat-7.0.78\conf\ssl\tomcat.jks" keystorePass="cert_test" maxIdleTime="60000" maxSpareThreads="100" maxThreads="350" minSpareThreads="30" port="8443" scheme="https" secure="true" sslProtocol="TLS" truststoreFile="D:\https\apache-tomcat-7.0.78\conf\ssl\truststore.jks" truststorePass="cert_test"/>
本文中路径如下,按自己实际路径填写 :
tomcat.jks路径:D:\https\apache-tomcat-7.0.78\conf\ssl\tomcat.jks
tomcat.jks密码:cert_test
truststore.jks路径:D:\https\apache-tomcat-7.0.78\conf\ssl\truststore.jks
truststore.jks密码:cert_test
配置完成启动tomcat,并且访问服务:
https://localhost:8443/。访问时如果提示此网站无法提供安全连接,说明tomcat配置https完成,请完成以下步骤,生成p12证书再次访问。
10、创建客户端秘钥
客户端key.pem路径:D:\cert_test\certs\lzq_testKey.pem
客户端req.pem路径:D:\cert_test\certs\lzq_testreq.pem
颁发者名称:ZAOMZ_CA
openssl req -newkey rsa:2048 -keyout D:\cert_test\certs\testKey.pem -keyform PEM -out D:\cert_test\certs\testreq.pem -outform PEM -subj "/O=ZAOMZ_CA/OU=ZAOMZ_CA/CN=qthd_test" -config "D:\jx_cert\openssl-0.9.8h-1-bin\share\openssl.cnf"
![](https://i-blog.csdnimg.cn/blog_migrate/da7db5d3e860894f256edbf0e3dd4ba2.png)
执行此命令会生成lzq_testKey.pem和lzq_testreq.pem
![](https://i-blog.csdnimg.cn/blog_migrate/9f83b2137523fd3facd15b9433902b52.png)
11、签发个人证书
客户端req.pem路径:D:\cert_test\certs\lzq_testreq.pem
客户端cert.pem路径:D:\cert_test\certs\lzq_testreqcert.pem
ca配置文件路径:D:\jx_cert\conf\ca.conf
openssl ca -in D:\cert_test\certs\testreq.pem -out D:\cert_test\certs\testreqcert.pem -config "D:\jx_cert\conf\ca.conf"
执行此命令时需要输入根证书密码:test
并且同意两个条件
![](https://i-blog.csdnimg.cn/blog_migrate/5250e853ab29e34860703f9f179b9d85.png)
12、制作个人p12证书
cert.pem文件路径:D:\cert_test\certs\lzq_testreqcert.pem
key.pem文件路径:D:\cert_test\certs\lzq_testKey.pem
p12证书路径:D:\cert_test\p12\lzq_test.p12
openssl pkcs12 -export -in D:\cert_test\certs\lzq_testreqcert.pem -inkey D:\cert_test\certs\lzq_testKey.pem -out D:\cert_test\p12\lzq_test.p12 -name lzq_test -chain -CAfile "D:\cert_test\root_ca\ca_cert.pem"
执行此命令需要输入三次密码。
![](https://i-blog.csdnimg.cn/blog_migrate/68703f5309c90c76fd03598ab8ffa764.png)
到这里p12证书已经生成完成了,双击p12证书进行安装,安装时候需要输入证书密码:lzqtest,再次访问
https://localhost:8443/,选择已经按照的p12证书即可
![](https://i-blog.csdnimg.cn/blog_migrate/59a58864ddad124081d82eaf6932f62a.png)
注:
如果只需要生成p12证书,请一直重复第10、11、12步骤