亲测有效 tomcat配置https自签名证书（keytool生成）

tomcat配置https自签名证书（keytool生成）

生成keystore

keytool -genkeypair -alias "server" -keyalg "" -validity "365" -keystore "/app/webapp/tomcat/https/server.keystore"

[root@localhost ~]# mv app / [root@localhost ~]# cd / app bin boot dev etc home lib lib64 media mnt opt proc root run sbin srv sys tmp usr var [root@localhost /]# cd app/webapp/tomcat/https/ [root@localhost https]# pwd /app/webapp/tomcat/https [root@localhost https]# keytool -genkeypair -alias "server" -keyalg "RSA" -validity "365" -keystore "/app/webapp/tomcat/https/server.keystore" Enter keystore password: Re-enter new password: What is your first and last name? [Unknown]: 10.13.22.102 What is the name of your organizational unit? [Unknown]: ai What is the name of your organization? [Unknown]: ai What is the name of your City or Locality? [Unknown]: gz What is the name of your State or Province? [Unknown]: gd What is the two-letter country code for this unit? [Unknown]: cn Is CN=10.13.22.102, OU=ai, O=ai, L=gz, ST=gd, C=cn correct? [no]: yes Enter key password for <server> (RETURN if same as keystore password): Re-enter new password: Warning: The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /app/webapp/tomcat/https/server.keystore -destkeystore /app/webapp/tomcat/https/server.keystore -deststoretype pkcs12". [root@localhost https]# cd /home/apache-tomcat-7.0.85/

修改配置server.xml

[root@localhost https]# pwd /home/apache-tomcat-7.0.85/conf [root@localhost https]# vi server.xml

<!--
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />
    -->

改为：

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" 
               keystoreFile="/app/webapp/tomcat/https/server.keystore" keystorePass="111111"/>

修改tomcat的web.xml，强制http跳转到https

[root@localhost https]# pwd /home/apache-tomcat-7.0.85/conf [root@localhost https]# vi web.xml

</welcome-file-list>后面加上这样一段：

<login-config> <!-- Authorization setting for SSL --> <auth-method>CLIENT-CERT</auth-method> <realm-name>Client Cert Users-only Area</realm-name> </login-config> <security-constraint> <!-- Authorization setting for SSL --> <web-resource-collection > <web-resource-name >SSL</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <user-data-constraint> <transport-guarantee>CONFIDENTIAL</transport-guarantee> </user-data-constraint> </security-constraint>

重启tomcat

[root@localhost apache-tomcat-7.0.85]# ls bak bin conf d: lib LICENSE logs NOTICE RELEASE-NOTES RUNNING.txt temp webapps work [root@localhost apache-tomcat-7.0.85]# cd bin [root@localhost bin]# jps -ml 11139 org.apache.catalina.startup.Bootstrap start 15246 sun.tools.jps.Jps -ml [root@localhost bin]# kill -9 11139 [root@localhost bin]# jps -ml 15282 sun.tools.jps.Jps -ml [root@localhost bin]# jps -ml 15311 sun.tools.jps.Jps -ml [root@localhost bin]# sh startup.sh

访问原先的地址后自动调转到新的https的地址

自动跳转：