生成泛域名的tomcat 的私有证书

生成泛域名的私有证书

单向证书:clientAuth="false"

1.生成 720的 handlecode的keystore 保存在 d:\keystore 内,密码为123456,使用RSA算法

keytool -genkey -alias *.handlecode.com -keyalg RSA   -keystore d:\keystore\handlecode.keystore -dname "CN=*.handlecode.com, OU=handlecode, O=风行趋势, L=深圳, ST=广东, C=CN" -keypass 123456 -storepass 123456 -validity 720

2.导出证书

keytool -export -alias *.handlecode.com -keystore handlecode.keystore -storepass 111111 -rfc -file handlecode.cer

3.配置到服务器,拷贝到tomcat目录 

    <Connector SSLEnabled="true" URIEncoding="UTF-8" clientAuth="false" 
    keystoreFile="handlecode.keystore" keystorePass="123456" maxThreads="150" port="9443" 
    protocol="org.apache.coyote.http11.Http11NioProtocol" 
    scheme="https" secure="true" sslProtocol="TLS"/> 

4.将handlecode.cer分发给使用者 双击点击安装到根证书,参考 12306

双向证书:clientAuth="true"

需要 openssl

[@more@]

1. keytool -genkey -alias server -keysize 512 -validity 365 -keyalg RSA -dname "CN=dragonsoftbravo.com, OU=App Server, O=DragonSoft Bravo, L=SH, S=SH, C=CN" -keypass P@sS!@() -storepass P@sS!@() -keystore /opt/keystore/server.jks

2.

keytool -genkey -alias client -keysize 512 -validity 365 -keyalg RSA -dname "CN=dragonsoftbravo.com, OU=App Server, O=DragonSoft Bravo, L=SH, S=SH, C=CN" -keypass P@sS!@() -storepass P@sS!@() -keystore /opt/keystore/client.jks

keytool -delete -alias client -keystore client.jks

2.修改 Tomcat --server.xml

Connector 8443:

keystoreFile="/opt/keystore/server.jks" keystorePass="P@sS!@()"

truststoreFile="/opt/keystore/client.jks" truststorePass="P@sS!@()"

3.

$ mkdir -p ./demoCA/{private,newcerts}

$ touch ./demoCA/index.txt

$ echo 01 > ./demoCA/serial

openssl genrsa -des3 -out ./demoCA/private/cakey.pem 2048

openssl req -new -x509 -days 365 -key ./demoCA/private/cakey.pem -out ./demoCA/cacert.pem

keytool -import -trustcacerts -alias dennis -file ./demoCA/cacert.pem -keystore client.jks

openssl pkcs12 -export -in ./demoCA/cacert.pem -inkey ./demoCA/private/cakey.pem -out dennis-cert.p12