java keytool

1、tomcat 配置Https，server.xml

1  <Connector
2            protocol="org.apache.coyote.http11.Http11Protocol"
3            port="8443" maxThreads="200"
4            scheme="https" secure="true" SSLEnabled="true"
5            keystoreFile="D:/SSL/key/sslserverkeys.keystore" keystorePass="changeit"
6           
7            clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,SSLv2Hello"
8            />

keystore:

tomcat 支持双向或者单向认证，单向认证是客户端认证服务器端，将服务器端的keystore导出成cer文件，再将cer文件导入到客户端keystore,将客户端信任keystore,设置到客户端jvm信任库中；操作步骤如下：
1、E:\Java\jdk1.7.0_45\bin>keytool -genkeypair -dname "CN=lsy, OU=yiyang, O=yiyang,
 L=bj,S=bj, C=CN" -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -
keyalg RSA -storepass changeit -keypass changeit -validity 365 -ext ip:127.0.0.1

2、keytool -exportcert -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -file d:\SSL\key\sslserver.cer

3、 keytool -import -alias sslserver -keystore D:\SSL\key\sslclienttrust.keystore -file d:\SSL\key\sslserver.cer

4、客户端代码

　System.setProperty("javax.net.ssl.trustStore", "D:/SSL/key/sslclienttrust.keystore");
   System.setProperty("javax.net.ssl.trustStorePassword", "changeit"); 
   System.setProperty("https.protocols", "TLSv1,SSLv2Hello");

配置过程中注意的是：

1）客户端和服务器端握手的使用的协议要匹配，如果不匹配请进行配置，客户端配置如：

System.setProperty("https.protocols", "TLSv1,SSLv2Hello");

服务器端配置是：

sslEnabledProtocols="TLSv1,SSLv2Hello"

服务器和客户端只有使用的SSL通信协议一致，才能保证客户端和服务器正常

2）tomcat 只实现了 -storepass 密码和-keypass一致，否则是认证不成功的，所以再生成证书的时两者确保一致

3）生成证书时：确保使用jdk 1.7 -ext 扩展属性(jdk1.6不支持此属性)，添加 san=ip:127.0.0.1，否则客户端是认证不成功

tomcat  配置webservice

配置webService 注意事项：

By default, Tomcat does not comes with any JAX-WS dependencies, So, you have to include it manually.

1. Go here http://jax-ws.java.net/.
2. Download JAX-WS RI distribution.
3. Unzip it and copy following JAX-WS dependencies to Tomcat library folder “{$TOMCAT}/lib“.

    • jaxb-impl.jar
    • jaxws-api.jar
    • jaxws-rt.jar
    • gmbal-api-only.jar
    • management-api.jar
    • stax-ex.jar
    • streambuffer.jar
    • policy.jar

java.net.ssl 重写实现，可以再使用httpsConnection 之前进行设置，如果证书ok,可以不实用，如果证书不规范，则可以使用规避一些错误：代码是

 1 package ssl.test;
 2 
 3 import javax.net.ssl.HostnameVerifier;
 4 import javax.net.ssl.HttpsURLConnection;
 5 import javax.net.ssl.SSLSession;
 6 
 7 public class MySocketFactory  {
 8     
 9     public static void trustAll(){
10         try {
11             trustAllHttpsCertificates();
12             HostnameVerifier hv = new HostnameVerifier() {  
13                 public boolean verify(String urlHostName, SSLSession session) {  
14                     System.out.println("Warning: URL Host: " + urlHostName + " vs. "  
15                                        + session.getPeerHost());  
16                     return true;  
17                 }  
18             };  
19             
20             HttpsURLConnection.setDefaultHostnameVerifier(hv);
21             
22         } catch (Exception e) {
23             // TODO Auto-generated catch block
24             e.printStackTrace();
25         }
26     }
27     
28       
29     private static void trustAllHttpsCertificates() throws Exception {  
30         
31         javax.net.ssl.TrustManager[] trustAllCerts = new javax.net.ssl.TrustManager[1];  
32         javax.net.ssl.TrustManager tm = new miTM();  
33         trustAllCerts[0] = tm;  
34         javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext  
35                 .getInstance("SSL");  
36         sc.init(null, trustAllCerts, null);  
37         javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc  
38                 .getSocketFactory());  
39     }  
40   
41     static class miTM implements javax.net.ssl.TrustManager,  
42             javax.net.ssl.X509TrustManager {  
43         public java.security.cert.X509Certificate[] getAcceptedIssuers() {  
44             return new java.security.cert.X509Certificate[0];
45         }  
46   
47         public boolean isServerTrusted(  
48                 java.security.cert.X509Certificate[] certs) {  
49             return false;  
50         }  
51   
52         public boolean isClientTrusted(  
53                 java.security.cert.X509Certificate[] certs) {  
54             return true;  
55         }  
56   
57         public void checkServerTrusted(  
58                 java.security.cert.X509Certificate[] certs, String authType)  
59                 throws java.security.cert.CertificateException {  
60             return; 
61         }  
62   
63         public void checkClientTrusted(  
64                 java.security.cert.X509Certificate[] certs, String authType)  
65                 throws java.security.cert.CertificateException {  
66             return;  
67         }  
68     }  
69 }
View Code

 

Https WebService 拨测查到的资料：

Java SSL/TLS 安全通讯协议介绍

Deploy JAX-WS web services on Tomcat

keytool - Key and Certificate Management Tool

Tomcat 7 getting SSLv2Hello is disabled error when trying to make client server ssl authntication

 

posted on 2015-07-24 16:05  Lishenyin  阅读(1162)  评论(0)  编辑  收藏  举报

导航