使用版本JDK1.7，tomcat 7.0.39,openssl安裝版0.9.8

使用操作系統 win7

命令行:

1.生成CA私鑰以及自簽名根證書

①生成CA私鑰

openssl genrsa -out F:\CA\ca-key.pem 1024

②生成待簽名根證書

openssl req -new -x509 -keyout F:\CA\ca-key.pem -out F:\CA\ca-req.csr -config openssl.cnf

③用CA私鑰對根證書進行自簽名

openssl x509 -req -in F:\CA\ca-req.csr -out F:\CA\ca-cert.pem -signkey F:\CA\ca-key.pem -days 365

2.生成server端證書

①生成KeyPair，最好keyPass與storePass一樣，方便

keytool -genkey -alias ying -validity 365 -keyalg RSA -keysize 1024 -keypass yingevil -storepass yingevil -dname "cn=localhost,ou=department,o=company,l=Beijing,st=Beijing,c=CN" -keystore F:\CA\ying.jks

②生成待簽名證書

keytool -certreq -alias ying -sigalg MD5withRSA -file F:\CA\ying.csr -keypass yingevil -keystore F:\CA\ying.jks -storepass yingevil

③用CA私鑰進行簽名

openssl x509 -req -in F:\CA\ying.csr -out F:\CA\ying-cert.pem -CA F:\CA\ca-cert.pem -CAkey F:\CA\ca-key.pem -days 365 -set_serial 1

3.導入信任的CA根證書到JAVA的默認位置%JAVA_HOME%\jre\lib\security\cacerts

keytool -import -v -trustcacerts -storepass changeit -alias root_ying -file F:\CA\ca-cert.pem -keystore %JAVA_HOME%\jre\lib\security\cacerts

4.把CA簽名后的server端證書導入keystore

keytool -import -v -trustcacerts -storepass yingevil -alias ying -file F:\CA\ying-cert.pem -keystore F:\CA\ying.jks

5.查看server端的keystore，查看JDK

keytool -list -keystore "%JAVA_HOME%\jre\lib\security\cacerts"

6.Tomcat服務器端，在conf/server.xml中加入下面一段配置

<Connector port="443"
protocol="HTTP/1.1" SSLEnabled="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
SSLCertificateFile="F:\server\apache-tomcat-7.0.39\conf\ca-cert.cer"
SSLCertificateKeyFile="F:\server\apache-tomcat-7.0.39\conf\ca-key.pem"
keystoreFile="F:\server\apache-tomcat-7.0.39\conf\ying.jks"
keystorePass="yingevil"/>

最后將ying.jks，ca-cert.cer(原身是ca-cert.pem，.pem文件是ASCII編碼的，直接改文件格式為.cer就可以)，ca-key.pem三個文件拷貝到服務器conf下即可。

將java keystore file轉化為p12格式：?
keytool -importkeystore -srckeystore ying.jks -destkeystore ying.p12 -srcstoretype JKS -deststoretype PKCS12 -srcstorepass yingevil -deststorepass yingevil -srcalias ying -destalias ying -srckeypass yingevil -destkeypass yingevil -noprompt

7.服務端網絡程序中的web.xml也要配置一下(加入下面一段即可)，這樣可以自動將http協議強制轉換成https協議訪問

<login-config>
<!-- Authorization setting for SSL -->
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Client Cert Users-only Area</realm-name>
</login-config>

<security-constraint>
<!-- Authorization setting for SSL -->
<web-resource-collection >
<web-resource-name >SSL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>

<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

?

可查閱官方文檔 http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html

?新建openssl.conf可參考：http://www.openssl.org/docs/apps/req.html#EXAMPLES

參考文章

http://zhumeng8337797.blog.163.com/blog/static/100768914201241645258903/

http://yushan.iteye.com/blog/434955

http://www.albertsong.com/read-99.html

SSL安裝 tomcat jks AVR