openssl+tomcat7使用简明笔记

来源：互联网发布：化学物质数据库编辑：程序博客网时间：2024/06/04 18:21

安装tomcat
省略

安装openssl
安装openssl，选择对应32或64位的版本（选择type大的）
http://slproweb.com/products/Win32OpenSSL.html

配置openssl
添加系统变量 OPENSSL_CONF:xxx\bin\cnf\openssl.cnf，路径选择openssl.cnf的路径；

建立目录
这里在openssl.exe同级目录下建立两个文件夹ca和server

使用cd命令定位到openssl.exe路径

一：生成CA证书

1.创建私钥：
openssl genrsa -out ca/ca.key 1024

2.创建证书请求：
openssl req -new -out ca/ca-req.csr -key ca/ca.key
-----

Country Name (2 letter code) [AU]:cn

State or Province Name (full name) [Some-State]:zhejiang

Locality Name (eg, city) []:hangzhou

Organization Name (eg, company) [Internet Widgits Pty Ltd]:skyvision

Organizational Unit Name (eg, section) []:test

Common Name (eg, YOUR name) []:root

Email Address []:sky

3.自签署证书：
openssl x509 -req -in ca/ca-req.csr -out ca/ca.cer -signkey ca/ca.key -days 3650

4.将证书导出成浏览器支持的.p12格式： (不需要可以省略)
openssl pkcs12 -export -clcerts -in ca/ca.cer -inkey ca/ca.key -out ca/ca.p12 -password pass:123456

二.生成server证书。

1.创建私钥：
openssl genrsa -out server/server.key 1024

2.创建证书请求：

openssl req -new -out server/server-req.csr -key server/server.key

-----

Country Name (2 letter code) [AU]:cn

State or Province Name (full name) [Some-State]:zhejiang

Locality Name (eg, city) []:hangzhou

Organization Name (eg, company) [Internet Widgits Pty Ltd]:skyvision

Organizational Unit Name (eg, section) []:test

Common Name (eg, YOUR name) []:localhost //这里跟ca部分不能相同

Email Address []:sky

3.自签署证书：
openssl x509 -req -in server/server-req.csr -out server/server.cer -signkey server/server.key -CA ca/ca.cer -CAkey ca/ca.key -CAcreateserial -days 3650

4.将证书导出成浏览器支持的.p12格式：
openssl pkcs12 -export -clcerts -in server/server.cer -inkey server/server.key -out server/server.p12 -password pass:123456

配置tomcat，这里是tomcat7
server.xml

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="g:\server.p12" 
keystorePass="123456" 
keystoreType="PKCS12" 
/>

关于jks，实际测试可以不使用
生成jks文件
keytool -keystore g:\truststore.jks -keypass 123456 -storepass 123456 -alias name -import -trustcacerts -file ca/ca.cer

使用jks文件时，配置如下：
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="g:\server.p12"
keystorePass="123456"
keystoreType="PKCS12"
truststoreFile="g:\truststore.jks"
truststorePass="123456"
truststoreType="JKS"/>

参考网址：
http://blog.csdn.net/aking21alinjuju/article/details/7654097
http://blog.csdn.net/likeyoutoo/article/details/49358809

http://szlxh002.iteye.com/blog/2277307

http://stackoverflow.com/questions/22327160/openssl-enter-export-password-to-generate-a-p12-certificate

0 0