linux中一台tomcat配置单个https域名和多个https域名并设置http强制跳转https

最新推荐文章于 2023-05-06 15:22:41 发布

江城This

最新推荐文章于 2023-05-06 15:22:41 发布

阅读量542

点赞数

分类专栏：环境安装文章标签： tomcat ssl

本文为【江城This】原创文章，未经允许不得转载。

本文链接：https://blog.csdn.net/jiaqu2177/article/details/108618348

版权

环境安装专栏收录该内容

4 篇文章 0 订阅

订阅专栏

系统：CentOS7.4

文件：tomcat、域名证书（pfx/jks）、证书密码

一、创建文件夹

在tomcat下创建cert文件夹、用来存放域名证书

二、配置server.xml

1、单域名配置（pfx方式）

配置Connector

<!-- https请求 -->
<Connector port="443"
    protocol="HTTP/1.1"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    keystoreFile="域名的证书路径（域名证书绝对路径）"
    keystoreType="PKCS12"
    keystorePass="证书密码"
    clientAuth="false"
    SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"
    ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>

配置Host

<Host name="绑定的域名（不加https://https://）"  appBase="webapps" unpackWARs="true" autoDeploy="true">
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t &quot;%r&quot; %s %b" />
</Host>

2、多域名配置

① pfx方式

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" defaultSSLHostConfigName="默认域名（不加https://，域名中的一个）" >
        <SSLHostConfig hostName="绑定的域名1（不加https://）">
            <Certificate certificateKeystoreFile="域名1的证书路径（域名证书绝对路径）" certificateKeystorePassword="E0px4dM3" certificateKeystoreType="PKCS12"/>
        </SSLHostConfig>

        <SSLHostConfig hostName="绑定的域名2（不加https://）">
            <Certificate certificateKeystoreFile="域名2的证书路径（域名证书绝对路径）" certificateKeystorePassword="sQCgu5Cq" certificateKeystoreType="PKCS12" />
        </SSLHostConfig>
    </Connector>

② jks方式

<Connector port="443" protocol="org.apache.coyote.http11.Http11Nio2Protocol" defaultSSLHostConfigName="默认域名（不加https://，域名中的一个）"  maxThreads="150" SSLEnabled="true" >
    <SSLHostConfig hostName="域名1（不加https://）">
        <Certificate certificateKeystoreFile="域名1的证书路径（域名证书绝对路径）" certificateKeystorePassword="证书密码" type="RSA" />
    </SSLHostConfig>
    <SSLHostConfig hostName="域名2（不加https://）">
        <Certificate certificateKeystoreFile="域名2的证书路径（域名证书绝对路径）" certificateKeystorePassword="证书密码" type="RSA" />
    </SSLHostConfig>
</Connector>

配置Host

<Host name="绑定的域名1（不加https://https://）"  appBase="webapps" unpackWARs="true" autoDeploy="true">
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t &quot;%r&quot; %s %b" />
</Host>
<Host name="绑定的域名2（不加https://https://）"  appBase="webapps" unpackWARs="true" autoDeploy="true">
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t &quot;%r&quot; %s %b" />
</Host>

至此、配置完成

二、http强制跳转https

1、配置server.xml

在上方配置的443的Connector下再添加一个80的Connector

<!-- https请求 -->
<Connector port="443"
    protocol="HTTP/1.1"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    keystoreFile="域名的证书路径（域名证书绝对路径）"
    keystoreType="PKCS12"
    keystorePass="证书密码"
    clientAuth="false"
    SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"
    ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>

<!-- http请求 -->
<Connector port="80" protocol="HTTP/1.1"
    connectionTimeout="20000"
    redirectPort="443" />

2、配置web.xml

打开conf/web.xml，并将下方内容添加至</welcome-file-list>后边

<security-constraint>
    <!-- Authorization setting for SSL -->
    <web-resource-collection >
        <web-resource-name >SSL</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

至此，强制跳转https完成，重启tomcat即可