Configuring HTTPS access in a NGINX+TOMCAT server environment

One. Nginx + HTTPS + Free SSL certificate configuration Guide

Generate certificate

$ cd/usr/local/nginx/conf
$ OpenSSL genrsa-des3-out server.key 1024
$ OpenSSL req-new-key server.key-out SERVER.CSR
$ CP Server.key server.key.org
$ OpenSSL rsa-in server.key.org-out Server.key
$ OpenSSL x509-req-days 365-in Server.csr-signkey Server.key
-out SERVER.CRT

Edit nginx.conf

server {
server_name your_domainname_here;
Listen 443;
SSL on;
SSL_CERTIFICATE/ETC/NGINX/CONF/SERVER.CRT;
Ssl_certificate_key/etc/nginx/conf/server.key;
}

OK, it's done. However, the certificate is not trusted and must be trusted to purchase the relevant certificate (http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=8979)

Verify the configuration:

https://127.0.0.1

Two. Tomcat SSL configuration

1. Generate Server key:
To switch to directory%tomcat_home% as a command line, enter the command command line as follows (jdk1.4 with tools above):

Keytool-genkey-alias Tomcat-keyalg Rsa-keypass
Junguoguo.com-storepass Junguoguo.com-keystore Server.keystore
-validity 3600

Keypass and Storepass two parameters followed by a password.
Username input domain name, such as localhost (dev or test) or hostname.domainname (user owned domain name), all others are skipped with enter, last confirmed, this will be generated under%tomcat_home% Server.keystore File.
Note: The parameter-validity refers to the certificate's validity period (days), the default validity period is very short, only 90 days.

Configure Tomcat

To modify the%tomcat_home%confserver.xml, open it in a text editor to find this line:

Remove the comment from the following paragraph and add the Keystorepass and Keystorefile attributes.

Note that the different versions of Tomcat are configured differently:

Tomcat4.1.34 configuration:

"5" ><connector classname= "Org.apache.coyote.tomcat4.CoyoteConnector"
Port= "8443″enablelookups=" true "scheme=" https "secure=" true "
Acceptcount= "100″
Useurivalidationhack= "false" disableuploadtimeout= "true"
Clientauth= "false" sslprotocol= "TLS"
Keystorefile= "Server.keystore"
keystorepass= "Changeit"/>

Tomcat5.5.9 configuration:

<connector port= "8443″maxhttpheadersize=" 8192″
maxthreads= "150″minsparethreads=" 25″maxsparethreads= "75″
Enablelookups= "false" disableuploadtimeout= "true"
acceptcount= "100″scheme=" https "secure=" true "
Clientauth= "false" sslprotocol= "TLS"
Keystorefile= "Server.keystore"
keystorepass= "Changeit"/>

Tomcat5.5.20 configuration (This configuration is also available for Tomcat6.0):

<connector protocol= "Org.apache.coyote.http11.Http11Protocol"
Port= "8443″maxhttpheadersize=" 8192″
maxthreads= "150″minsparethreads=" 25″maxsparethreads= "75″
Enablelookups= "false" disableuploadtimeout= "true"
acceptcount= "100″scheme=" https "secure=" true "
Clientauth= "false" sslprotocol= "TLS"
Keystorefile= "Server.keystore"
keystorepass= "Changeit"/>

Tomcat6.0.10 configuration:

<connector protocol= "Org.apache.coyote.http11.Http11NioProtocol"
Port= "8443″minsparethreads=" 5″maxsparethreads= "75″
Enablelookups= "true" disableuploadtimeout= "true"
Acceptcount= "100″maxthreads=" 200″
Scheme= "https" secure= "true" sslenabled= "true"
Clientauth= "false" sslprotocol= "TLS"
Keystorefile= "D:/tools/apache-tomcat-6.0.10/server.keystore"
keystorepass= "Changeit"/>

TOMCAT6 supports 3 types, please refer to the following documents:

Http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

Verify configuration: Access https://127.0.1.1:8443/

Three. Comprehensive configuration

Front-section static content processing: Nginx configuration

HTTP {
Include/etc/nginx/mime.types;
Default_type Application/octet-stream;
Log_format Main ' $remote _addr-$remote _user [$time _local] "$request" '
' $status $body _bytes_sent ' $http _referer '
' "$http _user_agent" "$http _x_forwarded_for";
Access_log/var/log/nginx/access.log main;
Sendfile on;
Tcp_nopush on;
Tcp_nodelay on;
Server_tokens off;
gzip on;
Gzip_static on;
Gzip_comp_level 5;
Gzip_min_length 1024;
Keepalive_timeout 65;
Limit_zone MyZone $binary _remote_addr 10m;
# Load config files from the/etc/nginx/conf.d directory
include/etc/nginx/conf.d/*.conf;
server {
Listen 80;
server_name localhost;
Location ~. (htm|html|gif|jpg|jpeg|png|ico|rar|css|js|zip|txt|flv|swf|doc|ppt|xls|pdf) $ {
Index index.jsp index.html;
Root/home/tomcat/webapps;
Access_log off;
Expires 24h;
} #nginx处理静态内容 Location/{
Proxy_pass http://127.0.0.1:8080; #提交给后端的tomcat处理}
}

Verify configuration: https://127.0.0.1

Configuring HTTPS access in a NGINX+TOMCAT server environment