Nginx+tomcat Implementing HTTPS Secure Links

Operating Environment
Operating system: centos5.5
Previous static content processing: Nginx
Back-end JSP processing: Tomcat 6

one. Nginx + HTTPS + Free SSL certificate configuration Guide

Generate certificate

$ cd/usr/local/nginx/conf
$ OpenSSL genrsa-des3-out server.key 1024
$ OpenSSL req-new-key server.key-out SERVER.CSR
$ CP Server.key server.key.org
$ OpenSSL rsa-in server.key.org-out Server.key
$ OpenSSL x509-req-days 365-in server.csr-signkey server.key-out server.crt

Edit nginx.conf

server {
server_name your_domainname_here;
Listen 443;
SSL on;
SSL_CERTIFICATE/ETC/NGINX/CONF/SERVER.CRT;
Ssl_certificate_key/etc/nginx/conf/server.key;
}

OK, it's done. However, the certificate is not trusted and must be trusted to purchase the relevant certificate (http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=8979)

Verify the configuration:

https://127.0.0.1

Two. Tomcat SSL configuration

1. Generate Server key:
To switch to directory%tomcat_home% as a command line, enter the command command line as follows (jdk1.4 with tools above):

Keytool-genkey-alias tomcat-keyalg rsa-keypass junguoguo.com-storepass junguoguo.com-keystore server.keystore-valid ity 3600

Keypass and Storepass two parameters followed by a password.
Username input domain name, such as localhost (dev or test) or hostname.domainname (user owned domain name), all others are skipped with enter, last confirmed, this will be generated under%tomcat_home% Server.keystore File.
Note: The parameter-validity refers to the certificate's validity period (days), the default validity period is very short, only 90 days.

Configure TomcatTo modify the%tomcat_home%confserver.xml, open it in a text editor and look for this line: Remove the comment from the subsequent paragraph and add the Keystorepass and Keystorefile attributes. Note that the different versions of Tomcat are configured differently:

Tomcat4.1.34 configuration:

?

1234567

<Connector className=”org.apache.coyote.tomcat4.CoyoteConnector”       port=”8443″ enableLookups=”true” scheme=”https” secure=”true”       acceptCount=”100″       useURIValidationHack=”false” disableUploadTimeout=”true”       clientAuth=”false” sslProtocol=”TLS”       keystoreFile=”server.keystore”       keystorePass=”changeit”/>

Tomcat5.5.9 configuration:

?

1234567

<strong><Connector port=”8443″ maxHttpHeaderSize=”8192″                   maxThreads=”150″ minSpareThreads=”25″ maxSpareThreads=”75″                   enableLookups=”false” disableUploadTimeout=”true”                   acceptCount=”100″ scheme=”https” secure=”true”                   clientAuth=”false” sslProtocol=”TLS”                   keystoreFile=”server.keystore”                   keystorePass=”changeit”/></strong>

Tomcat5.5.20 configuration (This configuration is also available for Tomcat6.0):

?

12345678

<Connector protocol=”org.apache.coyote.http11.Http11Protocol”                            port=”8443″ maxHttpHeaderSize=”8192″                  maxThreads=”150″ minSpareThreads=”25″ maxSpareThreads=”75″                  enableLookups=”false” disableUploadTimeout=”true”                  acceptCount=”100″ scheme=”https” secure=”true”                  clientAuth=”false” sslProtocol=”TLS”                  keystoreFile=”server.keystore”                  keystorePass=”changeit”/>

Tomcat6.0.10 configuration:

?

12345678

<Connector protocol=”org.apache.coyote.http11.Http11NioProtocol”                   port=”8443″ minSpareThreads=”5″ maxSpareThreads=”75″                   enableLookups=”true” disableUploadTimeout=”true”                   acceptCount=”100″  maxThreads=”200″                   scheme=”https” secure=”true” SSLEnabled=”true”                   clientAuth=”false” sslProtocol=”TLS”                   keystoreFile=”D:/tools/apache-tomcat-6.0.10/server.keystore”                   keystorePass=”changeit”/>

TOMCAT6 supports 3 types, please refer to the following documents:

Http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

Verify configuration: Access https://127.0.1.1:8443/

Three. Comprehensive configuration

Front-section static content processing: Nginx configuration

HTTP {include/etc/nginx/mime.types;    Default_type Application/octet-stream; Log_format Main ' $remote _addr-$remote _user [$time _local] "$request" "$status $body _bytes_sent"    $http _referer "'" $http _user_agent "" $http _x_forwarded_for ";    Access_log/var/log/nginx/access.log main;    Sendfile on;    Tcp_nopush on;    Tcp_nodelay on;    Server_tokens off;    gzip on;    Gzip_static on;    Gzip_comp_level 5;    Gzip_min_length 1024;    Keepalive_timeout 65;    Limit_zone MyZone $binary _remote_addr 10m;    # Load config files from the/etc/nginx/conf.d directory include/etc/nginx/conf.d/*.conf;server {Listen 80;        server_name localhost; Location ~.                (htm|html|gif|jpg|jpeg|png|ico|rar|css|js|zip|txt|flv|swf|doc|ppt|xls|pdf) $ {index index.jsp index.html;                Root/home/tomcat/webapps;                Access_log off; Expires 24h; } #nginx处理静态内容 location/{proxy_pass http://127.0.0.1:8080; #提交给后端的tomcat处理}}

Verify configuration: https://127.0.0.1

Nginx+tomcat Implementing HTTPS Secure Links