nginx tomcat jetty双向ssl

jetty增加

<Set name="forwarded">true</Set>

<Call name="addConnector">
      <Arg>
          <New class="org.eclipse.jetty.server.nio.SelectChannelConnector">
            <Set name="host"><Property name="jetty.host" /></Set>
            <Set name="port"><Property name="jetty.port" default="8080"/></Set>
            <Set name="maxIdleTime">300000</Set>
            <Set name="Acceptors">2</Set>
            <Set name="statsOn">false</Set>
            <Set name="confidentialPort">8443</Set>
            <Set name="lowResourcesConnections">20000</Set>
            <Set name="lowResourcesMaxIdleTime">5000</Set>
            <Set name="forwarded">true</Set>
          </New>
      </Arg>
    </Call>

tomcat增加

<Valve className="org.apache.catalina.valves.RemoteIpValve" remoteIpHeader="X-Forwarded-For" protocolHeader="X-Forwarded-Proto" protocolHeaderHttpsValue="https"/>

nginx配置

server {


        listen       443;


        server_name  xxx


        ssl                  on;


        ssl_certificate      /ServerCA.crt;


        ssl_certificate_key  /ServerCA.key;


        ssl_client_certificate /cnscaRoot.cer;#双向认证


        ssl_verify_client on; #双向认证


        ssl_verify_depth     10;


        ssl_session_timeout  5m;


        ssl_protocols  SSLv2 SSLv3 TLSv1;


        ssl_ciphers  ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;


        ssl_prefer_server_ciphers   on;


        location / {


            proxy_pass http://10.10.11.12:8080/;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header SSL_CERT $ssl_client_cert;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header       Host $host;
            proxy_set_header X-Forwarded-Proto  $scheme;


        }