HTTPS secure access within a LAN

Enable HTTPS secure access to prepare raw materials within a LAN

Server resin (can be tomcat, of course, resin for example)

Installing the JDK

Domain name (just write a line, because it is intranet use, will not be verified)

Generate certificate

• First step: Generate a certificate for the server

keytool -genkey -alias resin -keypass 123456 -keyalg RSA -keysize 1024 -validity 365 -keystore D:/keys/resin.keystore -storepass 123456

• Step two: Generate a certificate for the client

keytool -genkey -alias client1 -keypass 123456 -keyalg RSA -keysize 1024 -validity 365 -storetype PKCS12 -keystore D:/keys/client1.p12 -storepass 123456

• Step three: Have the server trust the client certificate

keytool -export -alias client1 -keystore D:/keys/client1.p12 -storetype PKCS12 -keypass 123456 -file D:/keys/client1.cer

keytool -import -v -file D:/keys/client1.cer -keystore D:/keys/resin.keystore -storepass 123456

• Fourth step: Let the client trust the server certificate

keytool -list -v -keystore D:/keys/resin.keystore

keytool -keystore D:/keys/resin.keystore -export -alias resin -file D:/keys/server.cer

Note: When prompted: What is your first and last name? Please enter the domain name you prepared for example: www.aclululu.com

The others follow the prompts to enter, and finally get four files as follows:

To generate a client installation certificate

• Double-click the server.cer file to install it by default until the installation is successful

• Open IE browser to find the certificate

• Select Export, and the exported certificate can be used by other customers for installation. This is named Aclululu_client.

Configuring server-side resin

Early version, because there is no latest, so please forgive me!
Where the resin.conf file needs to be modified specifically

• Configuring HTTPS Certificates

<http address="*" port="443">

  <jsse-ssl>  <key-store-type>jks</key-store-type> <key-store-file>keys/resin.keystore</key-store-file> <password>123456</password> </jsse-ssl> </http>

• Configuration Updates

< Session-config>    

  <session-timeout>-1</session-timeout>  <enable-url-rewriting>false</enable-url-rewriting> <reuse-session-id>false</reuse-session-id> <cookie-secure >true</cookie-secure> </session-config>

• Configuring HttpOnly Requests

<cookie-http-only>true</cookie-http-only>

• Configure the Secure property

<secure>true</secure>

Client install certificate, modify host file (Note client)

Open IE browser, import certificate

Follow the default import of the Aclululu_client certificate that you just saved. Until the import succeeds.

Modify the Host File

If the IP of the server is: 172.16.1.123
Method One:
Modify batch file: Aclululu_host.bat

@echo off
Color 0F
@attrib-R "%windir%\system32\drivers\etc\hosts"
@echo = >> "%windir%\system32\drivers\etc\hosts"
@echo = >> "%windir%\system32\drivers\etc\hosts"
@echo #Fssoft Start >> "%windir%\system32\drivers\etc\hosts"
@echo 172.16.1.123 www.aclululu.com>> "%windir%\system32\drivers\etc\hosts"
@echo #Fssoft End >> "%windir%\system32\drivers\etc\hosts"
@echo = >> "%windir%\system32\drivers\etc\hosts"
@echo = >> "%windir%\system32\drivers\etc\hosts"
@attrib +r "%windir%\system32\drivers\etc\hosts"

Then double-click Execute bat to

Method Two:
Go directly
Manual modification under C:\WINDOWS\SYSTEM32\DRIVERS\ETC

Access

Https
To secure access to the Web page on the 172.16.1.123 host computer.

Original link: https://www.jianshu.com/p/631719c9f0c6

HTTPS secure access within a LAN