About configuring HTTPS protocol in Tomcat (using axis container)

1. Configure the server under the Tomcat directory % tomcat_home %/CONF.Add the following XML content to the XML file:

<Connector Port = "8443" protocol = "HTTP/1.1" sslenabled = "true"

Maxthreads = "150" Scheme = "HTTPS" secure = "true" clientauth = "true" sslprotocol = "TLS" keystorefile = "/CONF/server.Keystore"Keystorepass =" changeit "truststorefile ="/CONF/server.Truststore"Truststorepass =" changeit"

/>

Some attribute statements are described as follows:

I. clientauth = "true" indicates whether to verify the clientIdentity (that is, when the client accesses the service, it must provide the keystore FileXxx.Keystore), True indicates yes, false indicates no,If you selectFalse, the statement truststorefile = "/CONF/server must be removed.Truststore"Truststorepass =" changeit"

Ii. keystorefile = "/CONF/Server. keystore"Indicates that the server keystore file is

% Tomcat_home %/conf directory file serveR. keystoreProvided to the client to verify the server identity keyStorepass= "Changeit" indicatesThe password isChangeit

Iii. truststorefile = "/CONF/server.Truststore"Indicates that the trusted library file on the server is the file" Serve "under the" % tomcat_home %/conf "directory.R. truststore,Used to represent the client trusted by the server, truststorepass="Changeit indicates that the password of the trusted database is changeit.

If the attribute in the added content is set to clientauth = "false"After the configuration is complete, enterHttps ://Localhost: 8443/axisThe browser will prompt that the certificate is not trusted. Click continue to view the information deployed on axis.Service

If clientauth = "true" is selected as the property in the added content ",You cannot directly accessHttps: // localhost:8443/axisView the deployed service (because the browser does not provide the keystore File)

2. Compile a client program to access the deployed service. Pay attention to the parameter format during runtime.Provide the keystore files and trusted library files to the client program,Assume that the client program is

Sslclient. Java access is deployed on aixs

Https: // localhost: 8443/axis/Services/echohello? WSDLService, running

Sslclient. Java should be run in the following form

Java -djavax.net. SSL. keystore =Somepath/client. keystore

-Djavax.net. SSL.Keystorepassword = youpassword

-Djavax.net. SSL. truststore = somepath/client. truststore

Sslclient

3. About how to use the built-in JDK tool keytool (located in % Java_ Home%/JDK/bin directory)Generate the above keystore and trusted library files

(1) Open the command line and go to the directory where keytool is located. Enter the command:

Keytool-genkey-alias tomcat-keystore server. keystore-keyalg RSA

Enter personal information as prompted. After the command is executed,The name will be obtained in the current directoryServer. keystore.

(2) generate the trust database of the client. First, output the RSA certificate:

Keytool-export-alias tomcat-file test_axis.cer-storepass changeit-keystore server. keystore

Then input the RSA certificate to a new trusted library file,This trust library is used by the client to verify the identity of the server.

Keytool-import-file test_axis.cer-storepass changeit-keystore client. truststore-alias serverkey-noprompt

(3) create a client keystore, Repeat steps (1)

Use the following command to generate the trust database of the client:

Keytool-export-file test_axis.cer-storepass changeit-keystore client. keystore

Run the following command to generate a server-side trust database:

Keytool-import-file test_axis.cer-storepass changeit-keystore server. truststore-alias clientkey-noprompt

Note: This configuration method is successfully configured on jdk1.6 + Apache-Tomcat-6.0.16.

When modifying server. XML,If you directly copy the content shown in this document

The server. xml file requires line breaks and space characters at the end of each line.