Document directory
Because the CAS single-point login system is configured, Tomcat SSL needs to be configured first. During the SSL configuration of Tomcat, the version I configured is atat5.5.20. I have referenced a lot of information, but I found that it has never worked, later, I changed to 5.5.9, and the result was very smooth. I changed a total of four major versions and found that the SSL configuration is really different. Now I will record these configurations for your reference next time.
Reference keytool User Guide: http://java.sun.com/j2se/1.4.2/docs/tooldocs/windows/keytool.html tomcat-SSL Configuration Guide: http://atat.apache.org/tomcat-5.5-doc/ssl-howto.htmlconfiguration Process
1. generate server key: switch to the directory % tomcat_home % through the command line, and enter the following command on the command line (jdk1.4 or a tool above ): keytool-genkey-alias tomcat-keyalg RSA-keypass changeit-storepass changeit-keystore server. keystore-validity 3600 User name: Enter the domain name, such as localhost (for development or testing) or hostname. domainname (the domain name owned by the user), all others are skipped with enter, and finally confirm, the server will be generated under % tomcat_home %. keystore file. Note: The parameter-validity indicates the validity period of the certificate (days). The default validity period is short and only 90 days. 2. Import the certificate to the trusted JDK certificate library: This step is not required for Tomcat SSL configuration, but required for cas sso; otherwise, the following error will occur:
Edu. Yale. Its. Tp. Cas. Client. casauthenticationexception: Unable to validate proxyticketvalidator...The import process is divided into two steps. The first step is to export the certificate, and the second step is to import it to the certificate trust database. The command is as follows: keytool-export-trustcacerts-alias tomcat-file server. cer-keystore server. keystore-storepass changeitkeytool-import-trustcacerts-alias tomcat-file server. cer-keystore % java_home %/JRE/lib/security/cacerts-storepass changeit if prompted, enter y. Other useful keytool commands (list all existing certificates in the trust certificate library, delete a certificate in the library): keytool-list-v-keystore D: /sdks/jdk1.5.0 _ 11/JRE/lib/security/cacertskeytool-delete-trustcacerts-alias tomcat-keystore D: /sdks/jdk1.5.0 _ 11/JRE/lib/security/cacerts-storepass changeit3. configure Tomcat: Modify % atat_home %/CONF/server. open it in a text editor and search for this line:
XML Code
-
Remove the comments from the subsequent sections and add the keystorepass and keystorefile attributes. Note that different Tomcat versions have different configurations: Tomcat 4.1.34 Configuration:
XML Code
-
- <Connector classname = "org. Apache. Coyote. tomcat4.coyoteconnector"
- Port = "8443" enablelookups = "true" Scheme = "HTTPS" secure = "true"
- Acceptcount = "100"
- Useurivalidationhack = "false" disableuploadtimeout = "true"
- Clientauth = "false" sslprotocol = "TLS"
- Keystorefile = "server. keystore"
- Keystorepass = "changeit"/>
Tomcat5.5.9 Configuration:
<Connector Port = "8443" maxhttpheadersize = "8192"
Maxthreads = "150" minsparethreads = "25" maxsparethreads = "75"
Enablelookups = "false" disableuploadtimeout = "true"
Acceptcount = "100" Scheme = "HTTPS" secure = "true"
Clientauth = "false" sslprotocol = "TLS"
Keystorefile = "server. keystore"
Keystorepass = "changeit"/>
Tomcat5.5.20 configuration (this configuration can also be used for tomcat6.0 ):
<Connector protocol = "org. Apache. Coyote. http11.http11protocol"
Port = "8443" maxhttpheadersize = "8192"
Maxthreads = "150" minsparethreads = "25" maxsparethreads = "75"
Enablelookups = "false" disableuploadtimeout = "true"
Acceptcount = "100" Scheme = "HTTPS" secure = "true"
Clientauth = "false" sslprotocol = "TLS"
Keystorefile = "server. keystore"
Keystorepass = "changeit"/> tomcat6.0.10 Configuration:
<Connector protocol = "org. Apache. Coyote. http11.http11nioprotocol"
Port = "8443" minsparethreads = "5" maxsparethreads = "75"
Enablelookups = "true" disableuploadtimeout = "true"
Acceptcount = "100" maxthreads = "200"
Scheme = "HTTPS" secure = "true" sslenabled = "true"
Clientauth = "false" sslprotocol = "TLS"
Keystorefile = "D:/tools/Apache-Tomcat-6.0.10/server. keystore"
Keystorepass = "changeit"/> tomcat6 supports 3 types, see the following documents: http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html authentication configuration access https: // localhost: 8443/
