Tomcat8容器下SSL证书布置及强制https
获取并安装服务器证书
公司是上线项目所以在CA机构申请了SSL证书,一次申请会有多个环境证书,apache,nginx,tomcat,IIS等。公司使用的是tomcat8做项目布置
导入证书
通过工具将证书上传到服务器目录, 存放目录为 /www/server/tomcat/conf
修改配置文件server.xml
- 找到以下代码将访问端口修改成80 把redirectPort修改成443
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" />
- 再找到下面代码将注释去掉把证书路径添加上去
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
type="RSA" />
</SSLHostConfig>
</Connector>
修改为
<Connector port="443"
protocol="org.apache.coyote.http11.Http11Nio2Protocol" maxThreads="150" SSLEnabled="true" defaultSSLHostConfigName="domain.net">
<SSLHostConfig hostName="domain.net">
<Certificate certificateKeystoreFile="conf/domain_net.jks"
certificateKeystorePassword="a75wRsB7T837r7R7"
type="RSA" />
</SSLHostConfig>
</Connector>
保存退出重启tomcat即可
查看日志及端口看启动情况
netstat -ntlp
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN 4060/java
tcp 0 0 127.0.0.1:8005 0.0.0.0:* LISTEN 4060/java
tcp 0 0 0.0.0.0:8009 0.0.0.0:* LISTEN 4060/java
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 4060/java
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 1246/pure-ftpd (SER
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 2080/sshd
tcp 0 0 0.0.0.0:8888 0.0.0.0:* LISTEN 1722/python
tcp6 0 0 :::33060 :::* LISTEN 1907/mysqld
tcp6 0 0 :::3306 :::* LISTEN 1907/mysqld
tcp6 0 0 :::21 :::* LISTEN 1246/pure-ftpd (SER
防火墙开放443 端口
firewall-cmd --list-all
firewall-cmd --permanent --add-port=443/tcp
firewall-cmd --reload
强制用户访问时为https,用户使用http时可以自动跳转为https
修改conf/web.xml文件,到文件最后
<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
在下面添加如下代码
<welcome-file-list>
<welcome-file>index.html</welcome-file>
<welcome-file>index.htm</welcome-file>
<welcome-file>index.jsp</welcome-file>
</welcome-file-list>
<login-config>
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Client Cert Users-only Area</realm-name>
</login-config>
<security-constraint>
<web-resource-collection >
<web-resource-name >SSL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
到此所有的配置完成,这样就可以使用证书访问并强制使用HTTPS了
本文版权归作者和博客园共有,欢迎转载。但未经作者同意必须保留此段声明,且在文章页面明显位置给出原文链接,否则保留追究法律责任的权利!
作者:刘呵呵
QQ:352887191
出处:http://www.cnblogs.com/liuyishi/
![](https://images.cnblogs.com/cnblogs_com/liuyishi/980993/o_a192ca3d70cf3bc7d1315fa4d200baa1cc112ae4.jpg)