1 生成密匙:进入jdk的bin目录后输入:
keytool -genkeypair -alias "tomcat" -keyalg "RSA" -keystore "g:\tomcat.keystore" -validity 36500
参数简要说明:“g:\tomcat.keystore”含义是将证书文件保存在F盘,证书文件名称是tomcat.keystore ;“-validity 36500”含义是证书有效期,36500表示100年,默认值是90天
1处我输入的密码是tomcat,2处是访问的地址,3处和1处的密码一样
配置TOMCAT服务器
433是https的默认端口
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" URIEncoding="UTF-8"/>
修改成 <Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" URIEncoding="UTF-8"/>
<!--
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"/>
-->
去掉注释且修改参数=> <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="G:/ssl/tomcat.keystore"
keystorePass="tomcat" />
标识为粉红色的两个参数,分别是证书文件的位置和<tomcat>的主密码,在证书文件生成过程中做了设置
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> 修改成 <Connector port="8009" protocol="AJP/1.3" redirectPort="443" />
启动tomcat,访问地址:https://localhost/ 或 http://localhost:8080/ 成功
2.强制https访问
在tomcat\conf\web.xml中的</welcome-file-list>后面加上这样一段:
Java代码
1. <login-config>
2. <!-- Authorization setting for SSL -->
3. <auth-method>CLIENT-CERT</auth-method>
4. <realm-name>Client Cert Users-only Area</realm-name>
5. </login-config>
6. <security-constraint>
7. <!-- Authorization setting for SSL -->
8. <web-resource-collection >
9. <web-resource-name >SSL</web-resource-name>
10. <url-pattern>/*</url-pattern>
11. </web-resource-collection>
12. <user-data-constraint>
13. <transport-guarantee>CONFIDENTIAL</transport-guarantee>
14. </user-data-constraint>
15. </security-constraint>