Configure the https environment for Tomcat (Windows + Linux)

Windows configuration is mainly reference: http://blog.csdn.net/supersky07/article/details/7407523

I mainly need the configuration in linux, but the principle in windows and linux should be similar, and the explanation in windows is clear, so it is recorded for comparison.

In Windows, configure the https environment for Tomcat:

(1) Go to the bin directory under jdk.

(2) input the following command "keytool-v-genkey-alias tomcat-keyalg RSA-keystore d:/tomcat. keystore"

D:/tomcat. keystore stores the generated tomcat. keystore in the root directory of drive d. Note: If you want to store the data on the C drive, you must enter the command line as an administrator in Windows 7. Otherwise, you cannot create tomcat. keystore. In this example, put it on disk D.
How can I access the command line as an administrator? Start-> Enter cmd in the search box-> wait (note not to press Enter)-> Find "cmd.exe"-> right-click "Run as administrator.

Explanation:

Keytool-genkey: automatically uses the default algorithm to generate public and private keys.

-Alias [name]: gets an alias for the certificate

-Keyalg: Specifies the key algorithm. If you need to specify the key length, you can add the keysize parameter. The key length is 1024 bits by default. When you use the DSA algorithm, the key length must be between 512 and 1024, and is an integer multiple of 64.

-Keystore: Specifies the name of the keystore. The keystore stores drug and certificate files. Files corresponding to the keystore are automatically created if they do not exist.

-Validity: The validity period of the certificate. The default value is 90 days.

-Keypass changeit: no certificate password is added

-Storepass changeit: do not add the password for storing the certificate

Enter the relevant information and confirm the result. The server. key file is generated in the tomcat root directory.

 

(3) enter the keystore Password

The password is arbitrary. Here we use 123456 as an example. Remember this password and then use it for server. xml configuration.

(4) enter the name, organization, organization, city, province, and country information

(5) A confirmation prompt will appear after the input.

Enter y and press Enter. The keystore is created.
Go to the root directory of disk D and you will see the generated tomcat. xml.

(6) enter the tomcat master password

You can press enter directly. The default value is the same as the keystore password.
The storage is complete.

(7) enter the tomcat folder

Locate sever. xml in the conf directory and edit it.

Comment out all ctor ins starting with <Connector port = "8443.

(8) Add the code for loading the keystore in sever. xml.

Note that the keystore password in the box is the "123456" we just set ".
Close and save sever. xml after editing.

(9) start tomcat.

If the following error occurs: "Keystore was tampered with, or password was incorrect", the password set in step (8) is incorrect. Check the password and re-compile sever. xml.

 

(10) Use https: // 127.0.0.1: 8443 to access the page

If the page is successfully opened, the https configuration under tomcat is successful.

(11) automatically jump to HTTPS through HTTP

Add:

<Security-constraint>

<Web-resource-collection>

<Web-resource-name> SSL </web-resource-name>

<Url-pattern>/* </url-pattern>

</Web-resource-collection>

 

<User-data-constraint>

<Transport-guarantee> CONFIDENTIAL </transport-guarantee>

</User-data-constraint>

</Security-constraint>

(12) Precautions

1. Certificate generation time. If the time on the machine where the IE client is located is earlier than or later than the effective time of the certificate, IE will prompt "the security certificate has expired or has not yet taken effect"

2. if IE prompts "the name on the security certificate is invalid or does not match the site name", it is the domain name of the host where the server is filled in when the certificate is generated. "What is your name and last name?" /"What is your first and last name ?" Incorrect

 

HTTPS transmission is supported for specific pages and HTTP transmission is used for common pages:

Compared with HTTP, HTTPS has the biggest advantage of security, but the cost for security is the cost of performance.

We need to take control of all the pages that require https transmission and http transmission for common pages.

We adopt a filter. The logic in the filter is like this, which can be divided into four situations:

1. The current protocol is HTTPS, and the current request URL is the URL that needs to be transmitted over HTTPS, directly requesting the page

2. The current protocol is HTTPS. The requested URL does not need to be transmitted over HTTPS and is redirected to the HTTP port.

3. The current protocol is HTTP, and the current request URL is a URL that does not need to be transmitted over HTTPS, directly requesting this page

4. The current protocol is HTTP, and the current request URL is a URL that needs to be transmitted over HTTPS and redirected to the HTTPS port.

 

Linux references: http://wenku.baidu.com/view/5f7c090016fc700abb68fc4c.html

1: Install jdk,
[Root @ localhost ~] # Ls jdk-1_5_0_19-linux-i586.bin
Jdk-1_5_0_19-linux-i586.bin
[Root @ localhost ~] # Pwd
/Root
[Root @ localhost ~] # Chmod a + x jdk-1_5_0_19-linux-i586.bin
[Root @ localhost ~] #./Jdk-1_5_0_19-linux-i586.bin
Generate the jdk1.5.0 _ 19 directory in the current directory.
I moved it to the/usr/local directory.
[Root @ localhost ~] # Mv jdk1.5.0 _ 19/usr/local/
[Root @ localhost local] # ln-s jdk1.5.0 _ 19 jdk
The configuration path is as follows:
[Root @ localhost local] # vi/etc/profile
Add at the end of the file:
Export JAVA_HOME =/usr/local/jdk
Export PATH = $ JAVA_HOME/bin: $ PATH
Export CLASSPATH =.: $ JAVA_HOME/lib/dt. jar: $ JAVA_HOME/lib/tools. jar
Then run the following command to make it take effect without restarting the machine:
[Root @ localhost local] # source/etc/profile
2: install tomcat. In fact, the above configuration path is to enable tomcat to start normally, because jdk is required during tomcat startup,

[Root @ localhost local] # tar zxvf apache-tomcat-5.5.26.tar.gz
[Root @ localhost local] # ln-s apache-tomcat-5.5.26 tomcat5.5
3: generate a certificate:
[Root @ localhost ~] # Keytool-genkey-alias. keystore-keyalg RSA
Enter keystore password: hellohello
What is your first and last name?
[Unknown]: liu # This item must be the same as your linux server machine name. This is a benefit! Run the hostname command to check the Host Name of the linux server.
What is the name of your organizational unit?
[Unknown]: bea
What is the name of your organization?
[Unknown]: bea
What is the name of your City or Locality?
[Unknown]: suzhou
What is the name of your State or Province?
[Unknown]: suzhou
What is the two-letter country code for this unit?
[Unknown]: cn
Is CN = liu, OU = bea, O = bea, L = suzhou, ST = suzhou, C = cn correct?
[No]: yes

Enter key password for <. keystore>
(RETURN if same as keystore password): hellohello
Note: The two passwords must be the same! The generated. keystore is located ~ (I use root, so under/root)
[Root @ localhost ~] # Find/-name. keystore
/Root/. keystore
Copy the file to/usr/local/tomcat5.5 (I installed tomcat in the/usr/local directory !)
Use ls-a to view the file.
4: configure server. xml,
[Root @ localhost ~] # Cd/usr/local/tomcat5.5/
[Root @ localhost tomcat5.5] # ls
Bin common conf LICENSE logs notice release-NOTES RUNNING.txt server shared temp webapps work
[Root @ localhost tomcat5.5] # pwd
/Usr/local/tomcat5.5
[Root @ localhost tomcat5.5] # ls-
... Bin common conf. keystore LICENSE logs notice release-NOTES RUNNING.txt server shared temp webapps work
[Root @ localhost tomcat5.5] # cd conf/
[Root @ localhost conf] # ls
Catalina catalina. policy catalina. properties context. xml logging. properties server-minimal.xml server. xml tomcat-users.xml web. xml
[Root @ localhost conf] # pwd
/Usr/local/tomcat5.5/conf
[Root @ localhost conf] # vi server. xml
The modifications are as follows:
Remove the following gaze first:
<Connector port = "443" maxHttpHeaderSize = "8192"
MaxThreads = "150" minSpareThreads = "25" maxSpareThreads = "75"
EnableLookups = "false" disableUploadTimeout = "true"
AcceptCount = "100" scheme = "https" secure = "true"
KeystoreFile = "/usr/local/tomcat/. keystore"
KeystorePass = "hellohello"
ClientAuth = "false" sslProtocol = "TLS"/>
Bold is the part I modified
4: start tomcat
[Root @ localhost conf] # cd/usr/local/tomcat5.5/
[Root @ localhost tomcat5.5] # ls
Bin common conf LICENSE logs notice release-NOTES RUNNING.txt server shared temp webapps work
[Root @ localhost tomcat5.5] # cd bin/
[Root @ localhost bin] # ls
Bootstrap. jar commons-logging-api-1.1.1.jar jmxaccessor-tasks.xml shutdown. bat tomcat5w.exe version. bat
Catalina. bat cpappend. bat jsvc.tar.gz shutdown. sh: tomcat-juli.jar version. sh
Catalina. sh digest. bat service. bat startup. bat tomcat-native.tar.gz
Catalina-tasks.xml digest. sh setclasspath. bat startup. sh tool-wrapper.bat
Commons-daemon.jar jkstatus-tasks.xml setclasspath. sh tomcat5.exe tool-wrapper.sh
[Root @ localhost bin] # pwd
/Usr/local/tomcat5.5/bin
[Root @ localhost bin] #./startup. sh
Using CATALINA_BASE:/usr/local/tomcat5.5
Using CATALINA_HOME:/usr/local/tomcat5.5
Using CATALINA_TMPDIR:/usr/local/tomcat5.5/temp
Using JRE_HOME:/usr/local/jdk
[Root @ localhost bin] # netstat-antl | grep 443
Tcp 0 0 0.0.0.0: 443 0.0.0.0: * LISTEN
[Root @ localhost bin] #
Tomcat has been started.
5: Test: Start the browser,