安装tomcat
省略
安装openssl
安装openssl,选择对应32或64位的版本(选择type大的)
http://slproweb.com/products/Win32OpenSSL.html
配置openssl
添加系统变量 OPENSSL_CONF:xxx\bin\cnf\openssl.cnf,路径选择openssl.cnf的路径;
建立目录
这里在openssl.exe同级目录下建立两个文件夹ca和server
使用cd命令定位到openssl.exe路径
一:生成CA证书
1.创建私钥 :
openssl genrsa -out ca/ca.key 1024
2.创建证书请求 :
openssl req -new -out ca/ca-req.csr -key ca/ca.key
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:zhejiang
Locality Name (eg, city) []:hangzhou
Organization Name (eg, company) [Internet Widgits Pty Ltd]:skyvision
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:root
Email Address []:sky
3.自签署证书 :
openssl x509 -req -in ca/ca-req.csr -out ca/ca.cer -signkey ca/ca.key -days 3650
4.将证书导出成浏览器支持的.p12格式 : (不需要可以省略)
openssl pkcs12 -export -clcerts -in ca/ca.cer -inkey ca/ca.key -out ca/ca.p12 -password pass:123456
二.生成server证书。
1.创建私钥 :
openssl genrsa -out server/server.key 1024
2.创建证书请求 :
openssl req -new -out server/server-req.csr -key server/server.key
-----
Country Name (2 letter code) [AU]:cn
State or Province Name (full name) [Some-State]:zhejiang
Locality Name (eg, city) []:hangzhou
Organization Name (eg, company) [Internet Widgits Pty Ltd]:skyvision
Organizational Unit Name (eg, section) []:test
Common Name (eg, YOUR name) []:localhost //这里跟ca部分不能相同
Email Address []:sky
3.自签署证书 :
openssl x509 -req -in server/server-req.csr -out server/server.cer -signkey server/server.key -CA ca/ca.cer -CAkey ca/ca.key -CAcreateserial -days 3650
4.将证书导出成浏览器支持的.p12格式 :
openssl pkcs12 -export -clcerts -in server/server.cer -inkey server/server.key -out server/server.p12 -password pass:123456
配置tomcat,这里是tomcat7
server.xml
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="g:\server.p12" <!-- 存放p12文件的路径 -->
keystorePass="123456" <!-- 生成server.p12 使用的password -->
keystoreType="PKCS12" <!-- 大写-->
/>
关于jks,实际测试可以不使用
生成jks文件
keytool -keystore g:\truststore.jks -keypass 123456 -storepass 123456 -alias name -import -trustcacerts -file ca/ca.cer
使用jks文件时,配置如下:
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="g:\server.p12"
keystorePass="123456"
keystoreType="PKCS12"
truststoreFile="g:\truststore.jks"
truststorePass="123456"
truststoreType="JKS"/>
参考网址:
http://blog.csdn.net/aking21alinjuju/article/details/7654097
http://blog.csdn.net/likeyoutoo/article/details/49358809