tomcat配置HTTPS
Tomcat只支持JKS, PKCS11 和 PKCS12格式的keystores。JKS是Java标准格式Java KeyStore的缩写，可以使用Java自带的keytool工具创建；PKCS12是互联网的标准，能够使用OpenSSL或Key-Manager(Microsoft)生成。
使用新的证书
对于PKCS11 和 PKCS12，可以使用阿里云或腾讯云提供的服务。为简单起见，本文主要介绍JKS
JKS
- 创建证书
Windows
keytool -genkey -alias tomcat -keyalg RSA
Linux
keytool -genkey -alias tomcat -keyalg RSA
证书默认保存在用户根目录，可以使用
-keystore选项指定证书的生成位置。
配置Tomcat
Tomcat使用两种不同方式实现SSL
- JSSE
- APR
需要确保 <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" SSLRandomSeed="builtin" />开启
以下以JSSE方式进行配置
JSSE
protocol使用org.apache.coyote.http11.Http11NioProtocol
示例为：
<!-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->
<Connector
protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="${user.home}/.keystore" keystorePass="changeit"
clientAuth="false" sslProtocol="TLS"/>
重点是
keystoreFile，其值为.keystore；keystorePass为创建证书时的密码
结束
至此Tomcat的HTTPS已经配置完成，访问https://localhost:8443/测试。也可以使用https://localhost:8080/测试
Nginx配置HTTPS并代理Tomcat
nginx在安装时需要开启SSL，也就是添加
--with-openssl选项
./configure --prefix=/data/nginx/nginx-1.12.2 --sbin-path=/data/nginx/nginx-1.12.2/bin --conf-path=/data/nginx/nginx-1.12.2/conf/nginx.conf --pid-path=/data/nginx/nginx-1.12.2/pid/nginx.pid --with-http_realip_module --with-http_sub_module --with-http_flv_module --with-http_dav_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_ssl_module --with-http_addition_module --with-pcre=/data/nginx/pcre-8.39 --with-zlib=/data/nginx/zlib-1.2.11 --with-openssl=/data/nginx/openssl-1.0.2
#user nobody;
worker_processes 1;
error_log logs/error.log;
#pid logs/nginx.pid;
events {
worker_connections 1024;
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
# PUBLIC server
upstream public_server {
server localhost:8080 weight=1 max_fails=5 fail_timeout=30s;
}
# HTTP
server {
# define attribute
listen 80;
server_name localhost;
charset utf-8;
# redirece https
rewrite ^ https://$http_host$request_uri? permanent;
# define error page
error_page 500 502 503 504 /50x.html;
location = /50x.html {
access_log logs/nginx_error.log;
root html;
}
location / {
access_log logs/nginx_server.log;
root html;
index index.html index.htm;
}
}
# HTTPS
server {
# define attribue
listen 443 ssl;
server_name localhost;
keepalive_timeout 70;
server_tokens off;
fastcgi_param HTTPS on;
fastcgi_param HTTP_SCHEME https;
access_log /usr/local/web/nginx/nginx-1.12.2/logs/wiki.xby1993.net.access.log;
error_log /usr/local/web/nginx/nginx-1.12.2/logs/wiki.xby1993.net.error.log;
# define ssl
ssl_certificate /usr/local/web/nginx/ssl/nginx.crt;
ssl_certificate_key /usr/local/web/nginx/ssl/nginx.key;
location / {
proxy_pass http://public_server/$request_uri;
}
}
}
