Tomcat Configuration bidirectional SSL

Root certificate
1. Establish the CA working directory

mkdir CA

CD CA

2. Generate the CA private key

OpenSSL genrsa-out Ca-key.pem 1024

3. Generate a certificate to be signed

OpenSSL req-new-out Ca-req.csr-key Ca-key.pem
Ca-cert.pem is the CA root certificate, which can be issued to the client and imported as the root certificate. Private key Changeit

4. Self-signed with CA private key
OpenSSL x509-req-in ca-req.csr-out ca-cert.pem-signkey ca-key.pem-days 365

5. Export PK12
OpenSSL pkcs12-export-clcerts-in Ca-cert.pem-inkey ca-key.pem-out ca-cert.p12

View certificates
OpenSSL x509-in Ca-cert.pem-noout-text-modulus

If a CA certificate is generated on request, the request file Certreq.txt is generated by the certificate requester. CA-Side Execute signature, generate certificate file 1.cer
OpenSSL x509-req-in c:\certreq.txt-out C:\1.cer-CA ca\ca-cert.pem-cakey ca\ca-key.pem-days 365-cacreateserial


Generate server Certificate
1. Create a private key
OpenSSL genrsa-out Server-key.pem 1024

2. Create a certificate request
OpenSSL req-new-out Server-req.csr-key Server-key.pem

3. Self-signed certificate
OpenSSL x509-req-in server-req.csr-out server-cert.pem-signkey server-key.pem-ca. /ca/ca-cert.pem-cakey. /ca/ca-key.pem-cacreateserial-days 365

4. Export the certificate to a browser-supported. P12 format, password Changeit
OpenSSL pkcs12-export-clcerts-in Server-cert.pem-inkey server-key.pem-out server.p12

Keytool-keystore serverstore.jks-keypass 123456-storepass 123456-alias ca-import-trustcacerts-file ~/ca/ca-cert.pem
Keytool-keystore serverstore.jks-keypass 123456-storepass 123456-alias server-import-trustcacerts-file ~/server/ser Ver-cert.pem



Generate a client certificate
1. Create the private key:
OpenSSL genrsa-out Client-key.pem 1024

2. Create a certificate request:
OpenSSL req-new-out Client-req.csr-key Client-key.pem

3. Self-Signed certificate:
OpenSSL x509-req-in client-req.csr-out client-cert.pem-signkey client-key.pem-ca. /ca/ca-cert.pem-cakey. /ca/ca-key.pem-cacreateserial-days 36

OpenSSL x509-in Client-cert.pem-noout-text-modulus

4. Export the certificate to a browser-supported. P12 Format:
OpenSSL pkcs12-export-clcerts-in Client-cert.pem-inkey client-key.pem-out client.p12
Password: Changeit


To generate a JKs file from a CA certificate
Keytool-keystore truststore.jks-keypass 123456-storepass 123456-alias ca-import-trustcacerts-file ~/ca/ca-cert.pem


Import Certificate
Import Ca-cert.p12 as a trusted root certificate in the client browser, CLIENT.P12 as a personal certificate


Tomcat Configuration
Server.xml
Jsse mode
<connector port= "8443" protocol= "Org.apache.coyote.http11.Http11NioProtocol"
Sslenabled= "true"
maxthreads= "Scheme=" "https" secure= "true"
Clientauth= "true" sslprotocol= "TLS"
Keystorefile= ". /conf/ssl/server.p12 "keystorepass=" Changeit "keystoretype=" PKCS12 "
Truststorefile= ". /conf/ssl/truststore.jks "truststorepass=" 123456 "truststoretype=" JKs "/>


Apr mode
<connector port= "8443" protocol= "Org.apache.coyote.http11.Http11AprProtocol"
Maxthreads= "150"
Enablelookups= "false" disableuploadtimeout= "true"
Acceptcount= "Scheme=" "https" secure= "true"
Clientauth= "true"
Sslenabled= "true"
Sslprotocol= "All"
Sslciphersuite= "All"
Sslcertificatefile= ". /conf/ssl/server-cert.pem "
Sslcertificatekeyfile= ". /conf/ssl/server-key.pem "
Sslcacertificatefile= ". /conf/ssl/ca-cert.pem "
Sslcacertificatepath= ". /conf/ssl "
Sslverifydepth= "15"
sslverifyclient= "Require"/>

Precautions
IE8 supports SSLV3,TLS, does not support SSLV2