Tomcat6配置使用SSL双向认证

原文：http://blog.163.com/quentin_wjb/blog/static/4726976120105173832480/

1.生成CA证书。目前不使用第三方权威机构的CA来认证，自己充当CA的角色。 
 1.创建私钥
  openssl genrsa -out root/root-key.pem 1024
 2.创建证书请求
  openssl req -new -out root/root-req.csr -key root/root-key.pem -config openssl.cnf
 3.自签署证书
  openssl x509 -req -in root/root-req.csr -out root/root-cert.pem -signkey root/root-key.pem -days 3650
 4.将证书导出成浏览器支持的.p12格式
  openssl pkcs12 -export -clcerts -in root/root-cert.pem -inkey root/root-key.pem -out root/root.p12

2.生成server证书。 
 1.创建私钥
  openssl genrsa -out server/server-key.pem 1024
 2.创建证书请求
  openssl req -new -out server/server-req.csr -key server/server-key.pem -config openssl.cnf
 3.自签署证书
  openssl x509 -req -in server/server-req.csr -out server/server-cert.pem -signkey server/server-key.pem -CA root/root-cert.pem -CAkey root/root-key.pem -CAcreateserial -days 3650 
 4.将证书导出成浏览器支持的.p12格式
  openssl pkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem -out server/server.p12

3.生成client证书。 
 1.创建私钥
  openssl genrsa -out client/client-key.pem 1024 
 2.创建证书请求
  openssl req -new -out client/client-req.csr -key client/client-key.pem -config openssl.cnf
 3.自签署证书
  openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -signkey client/client-key.pem -CA root/root-cert.pem -CAkey root/root-key.pem -CAcreateserial -days 3650
 4.将证书导出成浏览器支持的.p12格式
  openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12

4.根据root证书生成jks文件
 keytool -import -v -trustcacerts -storepass password -alias root -file root/root-cert.pem -keystore root/root.jks 
 keytool -import -v -trustcacerts -storepass pay-bjebc-com -alias root -file root/root-cert.pem -keystore root/bjebc.keystore

5.配置tomcat ssl，修改conf/server.xml。tomcat6中多了SSLEnabled="true"属性。 keystorefile, truststorefile设置为你正确的相关路径 
 xml 代码
        <connector port="443" protocol="HTTP/1.1" URIEncoding="UTF-8"
            maxthreads="150" maxhttpheadersize="8192" minsparethreads="25" maxsparethreads="75"
            connectionTimeout="20000" acceptcount="100" enablelookups="false" disableuploadtimeout="true"
            sslenabled="true" secure="true" scheme="https" clientauth="true" sslprotocol="TLS"
            keystoretype="PKCS12" keystorefile="conf/key/server.p12" keystorepass="123456" 
            truststoretype="JKS" truststorefile="conf/key/root.jks" truststorepass="123456"
        />

6.将root.p12，client.p12分别导入到IE中去（打开IE->;Internet选项->内容->证书）。 
 root.p12导入至受信任的根证书颁发机构，client.p12导入至个人

7.访问你的应用http://ip:8443，如果配置正确的话会出现请求你数字证书的对话框。

8.在jsp中取得符合x.509格式的证书
    <%       
        //获得certificate chain      
        X509Certificate[] ca = (X509Certificate[])request.getAttribute("javax.servlet.request.X509Certificate");      
        if(ca==null) {
            out.println("No cert info!");
        } else {
            String serial = ca[0].getSerialNumber().toString();
            String DN = ca[0].getSubjectDN().toString();
        }
    %>