Quickly install Tomcat and implement HTTPS access

HTTPS, a layer of SSL is added under HTTP for secure HTTP data transfer, the HTTPS protocol must be used for data-sensitive URLs, and this article describes how to quickly install Tomcat and implement HTTPS access.

Installing Tomcat

Installing Tomcat must have a Java environment, so install the JDK first;

1. Installing the JDK

[[email protected] ~]# rpm -ivh jdk-8u161-linux-x64.rpm Preparing...                ########################################### [100%]   1:jdk1.8                 ########################################### [100%]Unpacking JAR files...        tools.jar...        plugin.jar...        javaws.jar...        deploy.jar...        rt.jar...        jsse.jar...        charsets.jar...        

2. Adding Java System environment variables

3. Load Environment variables

[[email protected] ~]# . /etc/profile.d/java.sh

4. Check if the JDK is installed successfully

5. Install Tomcat

[[email protected] ~]# tar  -zxf apache-tomcat-8.0.50.tar.gz  -C /usr/local/

6. Create a soft connection

[[email protected] ~]# ln -s /usr/local/apache-tomcat-8.0.50/ /usr/local/tomcat

7. Add Tomcat system Environment variables

[[email protected] ~]# cat /etc/profile.d/tomcat.sh export CATALINA_HOME=/usr/local/tomcatexport PATH=$CATALINA_HOME/bin:$PATH

8. Load Environment variables

[[email protected] ~]# . /etc/profile.d/tomcat.sh

9. Whether the test is effective

[[email protected] ~]# catalina.sh versionUsing CATALINA_BASE:   /usr/local/tomcatUsing CATALINA_HOME:   /usr/local/tomcatUsing CATALINA_TMPDIR: /usr/local/tomcat/tempUsing JRE_HOME:        /usr/java/latestUsing CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jarServer version: Apache Tomcat/8.0.50Server built:   Feb 7 2018 20:06:05 UTCServer number:  8.0.50.0OS Name:        LinuxOS Version:     2.6.32-642.6.2.el6.x86_64Architecture:   amd64JVM Version:    1.8.0_161-b12JVM Vendor:     

10. Start Tomcat Service

[[email protected] ~]# catalina.sh  startUsing CATALINA_BASE:   /usr/local/tomcatUsing CATALINA_HOME:   /usr/local/tomcatUsing CATALINA_TMPDIR: /usr/local/tomcat/tempUsing JRE_HOME:        /usr/java/latestUsing CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jarTomcat started.

11. Test Access

Tomcat default port is 8080, so access using ip+8080 access;

★ Here, tomcat installation is complete, but only the default environment, but also need to customize the configuration according to requirements;

Implementing HTTPS access 1, adding domain name resolution

To your domain name resolver, add a record point to your server IP;

2. Application Certificate

Use the domain name you just added to request an SSL certificate;

3. Upload Certificate

Create a new SSL directory in the Tomcat directory to upload the certificate file to this directory;

[[email protected] ~]# cd /usr/local/tomcat/[[email protected] tomcat]# mkdir ssl[[email protected] tomcat]# rz

4, modify the Server.xml

Vim open Server.xml, add SSL connector, add the following configuration under 8080 port connector:

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"    maxThreads="150" scheme="https" secure="true"    keystoreFile="/usr/local/tomcat/ssl/YourDomain.jks"    keystorePass="SSLPass"    clientAuth="false" sslProtocol="TLS" />

注意：    keystoreFile ：证书存放目录，可以写绝对路径或Tomcat相对路径；    keystorePass：证书私钥密码；

5. Modify the Host Configuration

    <engine name= "Catalina" defaulthost= "localhost" > # # The localhost specified here is the name of the default host, modified to the domain name of the certificate binding <!--for Clus Tering documentation at:/docs/cluster-howto.html, * * */docs/config/c luster.html (reference documentation)-<!--<cluster Classname= "ORG.APACHE.CATALINA.HA.TCP.SIMPLETCP Cluster "/>-<!--use the Lockoutrealm to prevent attempts to guess user passwords via a BR Ute-force Attack--<realm classname= "Org.apache.catalina.realm.LockOutRealm" > <!--this Realm us  ES the userdatabase configured in the global JNDI resources under the key "Userdatabase". Any edits that is performed against this userdatabase is immediately available for use by the Re  Alm. --<realm classname= "Org.apache.catalina.realm.UserDatabaseRealm" resourcename= "userdatabase"/ > </Realm> 

★ Here only need to change the two localhost to the certificate binding domain name, that is, the domain name with this host binding;

6. Restart the Tomcat service

[[email protected] tomcat]# catalina.sh stopUsing CATALINA_BASE:   /usr/local/tomcatUsing CATALINA_HOME:   /usr/local/tomcatUsing CATALINA_TMPDIR: /usr/local/tomcat/tempUsing JRE_HOME:        /usr/java/latestUsing CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar[[email protected] tomcat]# catalina.sh startUsing CATALINA_BASE:   /usr/local/tomcatUsing CATALINA_HOME:   /usr/local/tomcatUsing CATALINA_TMPDIR: /usr/local/tomcat/tempUsing JRE_HOME:        /usr/java/latestUsing CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jarTomcat started.

7, the query port is listening

[[email protected] tomcat]# ss-ntlstate recv-q send-q Local Ad                                                           Dress:port Peer address:port LISTEN 0 1 127.0.0.1:8005 *:* L                                                               Isten 0 100 *:8009                                                                 *:* LISTEN 0 100                                                                 *:8080 *:* LISTEN 0 128     *:22 *:*                                                        LISTEN 0 100 127.0.0.1:25         *:* LISTEN 0 100 *:443  *:* [[email protected] tomcat]#

8. Test Access

Use https://YourDomain/to access;

★ Show small green lock with browser access, F12 view, hint: This is secure (valid HTTPS), stating that the certificate has been configured successfully;

Configure HTTP to automatically jump to HTTPS

Above we implemented HTTPS access, but the customer use HTTP access, or will go HTTP protocol, is still unsafe, did not meet our needs, the following configuration HTTP automatically jump to HTTPS;

1. Modify Web. xml

After </welcome-file-list>, which is the penultimate line, add the following configuration:

<login-config>    <!-- Authorization setting for SSL -->    <auth-method>CLIENT-CERT</auth-method>    <realm-name>Client Cert Users-only Area</realm-name>    </login-config>    <security-constraint>    <!-- Authorization setting for SSL -->    <web-resource-collection>    <web-resource-name>SSL</web-resource-name>    <url-pattern>/*</url-pattern>    </web-resource-collection>    <user-data-constraint>    <transport-guarantee>CONFIDENTIAL</transport-guarantee>    </user-data-constraint>    </security-constraint>

2, modify the Sever.xml

To modify a non-SSL connector request to jump to the SSL connector, modify the following configuration:

原来为：    <Connector port="8080" protocol="HTTP/1.1"               connectionTimeout="20000"               redirectPort="8443" />修改为：    <Connector port="80" protocol="HTTP/1.1"               connectionTimeout="20000"               redirectPort="443" />

★ The default 8080 port is modified to 80 port, when access does not need to add 8080 ports, because the HTTP protocol is the default to go 80 port;
★ Change 8443 port to 443 port, meaning that requests from port 80 jump to 443 port;

3. Restart Service

[[email protected] conf]# catalina.sh  stopUsing CATALINA_BASE:   /usr/local/tomcatUsing CATALINA_HOME:   /usr/local/tomcatUsing CATALINA_TMPDIR: /usr/local/tomcat/tempUsing JRE_HOME:        /usr/java/latestUsing CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar[[email protected] conf]# catalina.sh  startUsing CATALINA_BASE:   /usr/local/tomcatUsing CATALINA_HOME:   /usr/local/tomcatUsing CATALINA_TMPDIR: /usr/local/tomcat/tempUsing JRE_HOME:        /usr/java/latestUsing CLASSPATH:       /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jarTomcat started.

4. Detection Port

Check the port, found that the original listening port 8080 is not in, but listening to our above modified 80 port;

[[email protected] conf]# ss-nltstate recv-q send-q Local Addr                                                                 Ess:port Peer address:port LISTEN 0 100 *:8009 *:* LIS                                                                 TEN 3 100 *:80                                                                 *:* LISTEN 0 128                                                         *:22 *:* LISTEN 0 100 127.0.0.1:25 *:* LI                                                         STEN 0 100 *:443       *:* [[email protected] conf]#  

5. Test access

Here we use the Linux under the Curl Command test, can be more intuitive to see the jump effect;

[[email protected] ~]# curl  http://YourDomain/  -I HTTP/1.1 302 FoundServer: Apache-Coyote/1.1Cache-Control: privateExpires: Thu, 01 Jan 1970 08:00:00 CSTLocation: https://YourDomain/Transfer-Encoding: chunkedDate: Fri, 13 Apr 2018 16:06:04 GMT

★ Here, tomcat configuration HTTP automatic jump HTTPS has been completed ~

Quickly install Tomcat and implement HTTPS access