Tomcat configuration HTTPS

The

SSL protocol uses asymmetric encryption technology to deliver secure information between the parties. It can realize the confidentiality and integrity of information transmission, and the two sides can identify each other.
When establishing an HTTPS connection to a Web site, a handshake is performed between the browser and the Web server to complete the authentication and key exchange, establishing a secure connection. The process is:
1, the user's browser to its SSL version number, encryption settings parameters, session-related data and some other necessary information to the server
2, the server will its SSL version number, encryption settings parameters, The session-related data and other necessary information are sent to the browser, and the server's certificate is also sent to the browser. If you configure the server's SSL to authenticate the user, also issue a request to the browser to provide a user certificate.
3, the client checks the server certificate, if the check fails, the prompt cannot establish an SSL connection, if successful, then continue
4, the client browser generates PRE-MASTER secret for this session, and encrypts it with the server public key and sends it to the server.
5, if the server requires authentication of the client, the client also signs some additional data and sends it to the server along with the client certificate.
6. If the server requires authentication of the customer, check that the CA that signed the client certificate is trustworthy. If you are not in the trust list, end this session. If the check passes, the server decrypts the received pre-master secret with its own private key and uses it to generate the master secret for this session through certain algorithms.
7, both the client and the server use this master secret to generate the session key (symmetric key) for this session. This session key is used when passing any message after the end of both SSL handshake. The main reason for this is that symmetric encryption is more than an order of magnitude lower than asymmetric encryption and can significantly increase the computational speed of both sessions.
8, the client notifies the server that the message sent thereafter is encrypted with this session key. and notifies the server that the client has completed this SSL handshake.
9, the server notifies the client that the message sent thereafter is encrypted with this session key. and notifies the client server that the SSL handshake has been completed.
10, the handshake process is complete, the session has been established. Both parties use the same session key to add and decrypt the information sent and received separately.

1. Generate server-side certificate files
You can use a Windows system or a Linux system
(1) Windows environment
Condition: JDK already installed
Steps:
L Enter the%java_home%/bin directory
L EXECUTE Command
Keytool-genkey-alias tomcat-keyalg Rsa-keystore F:\tomcat.keystore-validity 36500

Parameter brief description: "F:\tomcat.keystore" means to save the certificate file in the F-drive, the certificate file name is Tomcat.keystore; "-validity 36500" means the certificate validity period, 36500 means 100 years, the default value is 90 days
L fill in the necessary parameters at the command line:
Section Description:
A, enter the KeyStore password: Here you need to enter a string greater than 6 characters

B, "What is your first and last name?" "This is required and must be the domain name of the Tomcat deployment host or ip[such as: Gbcom.com or 10.1.25.251], which is the access address you will enter in the browser

C, "What is your organizational unit name?" "," What is your organization name? "," What is your city or region name? "," What is the name of your state or province? "," What is the two-letter country code for this unit? "Can be filled in as needed or can not fill in the direct return, the system asked" correct? , enter the letter "Y" with the keyboard if required, otherwise enter "n" to re-fill the information

D, enter <tomcat> master password, this is more important, will be used in the Tomcat configuration file, the recommended input and KeyStore password consistent, set other password can also

After completing the above input, the direct carriage return will find the generated file in the location you defined in the second step

(2) Linux environment

Condition: The JDK is installed

Steps:

L Enter the $java_home/bin directory

L EXECUTE Command

./keytool-genkey-alias Tomcat-keyalg rsa-keystore/usr/local/ac/web/tomcat.keystore-validity 36500

Brief description of the parameter: "/etc/tomcat.keystore" means to save the certificate file under Path/usr/local/ac/web/, the certificate file name is Tomcat.keystore; "-validity 36500" means the certificate validity period, 36500 means 100 years, default is 90 days

L fill in the necessary parameters at the command line:
As follows:
Section Description:
A, enter KeyStore password: A string greater than 6 characters is required here
B, "What's your first and last name?" This is required and must be the domain name of the Tomcat deployment host or ip[such as: Gbcom.com or 10.1.25.251], which is the access address you will enter in the browser

C, "What is the name of your organizational unit?", "What is the name of your organization?", "What's the name of the Your city Or Locality?, "What's the name of your state or province?", "What's the Two-letter country code for this unit?" Can fill in as required or can not fill in the direct return, the system asked "correct?" , enter the letter "Y" with the keyboard if required, otherwise enter "n" to re-fill the information above.
D, enter key password for &LT;TOMCAT&GT, this is more important, will be used in the Tomcat configuration file, it is recommended to enter the same password as the KeyStore, the other password can be set
After completing the above input, the direct carriage return will find the generated file in the location you defined in the second step
2. Configuring the Tomcat Server
(1) If you are generating a certificate file in a Windows environment, you will need to copy the generated certificate Tomcat.keystore to the location Tomcat will reference, assuming that the path to the Tomcat's app certificate is "/etc/tomcat.keystore", You need to copy the certificate file to "etc/", and if the certificate file is generated in the Linux environment following the steps described above, the certificate file is already under "etc/".
(2) Configure Tomcat, open $catalina_home/conf/server.xml, modify the following,
<connector port= "8080" protocol= "http/1.1"
connectiontimeout= "20000"
redirectport= "8443"/>
Modify Parameters = =
<connector port= "protocol=" http/1.1 "
connectiontimeout= "20000"
redirectport= "443"/>
<!--
<connector port= "8443" protocol= "http/1.1" sslenabled= "true"
maxthreads= "Scheme=" "https" secure= "true"
Clientauth= "false" sslprotocol= "TLS"/>
-
Remove comments and modify parameters = =
<connector port= "443" protocol= "http/1.1" sslenabled= "true"
maxthreads= "Scheme=" "https" secure= "true"
Clientauth= "false" sslprotocol= "TLS" keystorefile= "/etc/tomcat.keystore" keystorepass= "www.gbcom.com.cn"/>
Note: Two parameters, identified as light blue, are the location of the certificate file and the master password of <tomcat>, which was set during the certificate file generation process.
<!--
<connector port= "8009" enablelookups= "false" protocol= "ajp/1.3" redirectport= "8443"/>
-
Modify Parameters = =
<connector port= "8009" enablelookups= "false" protocol= "ajp/1.3" redirectport= "443"/>
(3) Open $catalina_home/conf/web.xml, add at the end of the file:
<security-constraint>
<web-resource-collection >
<web-resource-name >SSL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
3. After the above configuration is complete, you can use SSL after restarting Tomcat. The IE Address bar can be entered directly into the address do not have to enter "http://" or "https://", or "/http" can be entered as "https://" to log in
4. Precautions:
(1) When the certificate is generated, IE will prompt "The security certificate has expired or has not been in effect" if the IE client is on a machine that is older than the certificate effective time or later than the valid time.
(2) If IE prompts "the name on the security certificate is invalid or does not match the site name", it is the domain name of the host on which the server was filled when the certificate was generated "what is your first and last name?" "/" What's your first and last name? " caused by an incorrect
5, Legacy issues:
(1) If the AC host cannot be searched by the domain name, IP must be used, but this IP can only be determined after configuration, so that the certificate must be in the AC to determine the IP address to generate
(2) certificate file can only bind one IP address, fake with 10.1.25.250 and 192.168.1.250 two IP address, when the certificate generation file, such as using 10.1.25.250, through IE can only use 10.1.25.250来 Access Ac-web, 192.168.1.250 is unable to access Ac-web.

Resources:
Http://tianli.blog.51cto.com/190322/90101
http://qixiaopeng.javaeye.com/blog/466298

Follow the public number to get a mass learning video

Tomcat configuration HTTPS