Tomcat supports HTTPS

HTTP is a protocol used when surfing the web. The data transmitted by the HTTP protocol is unencrypted, which is plaintext, so it is very insecure to use the HTTP protocol to transmit private information. To ensure that these private data can be encrypted, Netscape designed the SSL (Secure Sockets Layer) protocol to encrypt the data transmitted by the HTTP protocol, which led to the birth of HTTPS. The current version of SSL is 3.0, defined by the IETF (Internet Engineering Task Force) in RFC 6101, and then the IETF is upgraded to SSL 3.0, so TLS (Transport Layer Security) 1.0, defined in RFC 2246. In fact, we now have HTTPS is the TLS protocol, but because SSL appears earlier, and is still supported by the browser now, so SSL is still synonymous with HTTPS, but whether it is TLS or SSL is the last century thing, The last version of SSL is 3.0, and TLS will inherit the good lineage of SSL and continue to encrypt the service for us. The current version of TLS is 1.2, defined in RFC 5246, and is not widely used for the time being.

1: Enter the%java_home%/bin directory, using the following command to enter the directory:

CD "C:\Program Files\java\jdk1.6.0_11\bin"

Using Keytool to generate a certificate for Tomcat, assuming the domain name of the target machine is "localhost", the KeyStore file is stored in "D:\home\tomcat.keystore" and the password is "password", which is generated using the following command:

Keytool-genkey-v-alias tomcat-keyalg rsa-keystored:\home\tomcat.keystore-validity 36500 (36500 for 100 years, default 90 days)

Fill in the necessary parameters in the command line, name. Unit, what the random input string on the line,

2: Generate Certificate for client: keytool-genkey-v-alias mykey-keyalg rsa-storetype pkcs12-keystore D:\home\mykey.p12 (MyKey is Custom). The corresponding certificate inventory is placed in "D:\HOME\MYKEY.P12", and the client's CN can be any value. Double-click the Mykey.p12 file to import the certificate into the browser (client).

3: Have the server trust the client certificate

Keytool-export-alias Mykey-keystore D:\home\mykey.p12-storetypePKCS12-storepass password-rfc-filed:\home\ Mykey.cer

(MyKey is custom-defined MyKey to the client, password is the password you set). With the above command, the client certificate is exported to the "D:\home\mykey.cer" file.

4: File import to the server's certificate store

Import the file to the server's certificate library and add the command as a trusted certificate using the following commands:

Keytool-import-v-file D:\home\mykey.cer-keystore D:\home\tomcat.keystore

With the list command to view the server's certificate library, you can see two certificates, one server certificate and one trusted client certificate:

Keytool-list-keystore D:\home\tomcat.keystore (Tomcat sets the server-side certificate name for you).

5: Let the client trust the server certificate

Keytool-keystore D:\home\tomcat.keystore-export-alias Tomcat-file D:\home\tomcat.cer (Tomcat sets the server-side certificate name for you).

With the above command, the server certificate is exported to the "D:\home\tomcat.cer" file. Double-click the Tomcat.cer file, follow the prompts to install the certificate, and fill in the certificate to Trusted root certification authorities.

6: Configure Tomcat

Open the/conf/server.xml in the Tomcat root directory and locate the connector port= "8443" configuration section, as follows:

Sslenabled= "true" maxthreads= "scheme=" "https"

Secure= "true" Clientauth= "true" sslprotocol= "TLS"

Keystorefile= "D:\\home\\tomcat.keystore" keystorepass= "123456"

Truststorefile= "D:\\home\\tomcat.keystore" truststorepass= "123456"/>

(Tomcat to match the generated server-side certificate name)

Property Description:

ClientAuth: Set whether bidirectional authentication, default = False, set to True for bidirectional authentication

Keystorefile: Server certificate file path

Keystorepass: Server certificate Password

Truststorefile: The root certificate used to authenticate the client certificate, in this case the server certificate

Truststorepass: Root certificate Password

7: Test

In the browser input: https://localhost:8443/, will pop-up select the client certificate interface, click "OK", will enter the Tomcat homepage, the address bar will have a "lock" icon, indicating that the session has been authenticated through HTTPS two-way, The information transmitted during the next session is encrypted with SSL information.

8: Description

It is worth noting that the test failed under Eclipse, MyEclipse Normal, and the direct separate Tomcat test was also successful. I don't know if it's an eclipse bug. After eclipse was imported into the integrated Tomcat configuration, not on the path where Tomcat resides, Eclipse integrated Tomcat overwrites tomcat on the disk path.

Tomcat supports HTTPS

Tomcat supports HTTPS