Nginx+Tomcat實現https安全連結

標籤：des   http   io   ar   os   sp   for   java   strong   

作業環境
作業系統：centos5.5
前段靜態內容處理：nginx
後端JSP處理：tomcat 6

一.Nginx + https + 免費SSL認證配置指南

產生認證

$ cd /usr/local/nginx/conf 
$ openssl genrsa -des3 -out server.key 1024 
$ openssl req -new -key server.key -out server.csr 
$ cp server.key server.key.org 
$ openssl rsa -in server.key.org -out server.key 
$ openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

編輯 nginx.conf

server { 
server_name YOUR_DOMAINNAME_HERE; 
listen 443; 
ssl on; 
ssl_certificate /etc/nginx/conf/server.crt; 
ssl_certificate_key  /etc/nginx/conf/server.key; 
}

OK, 完成了。但這樣認證是不被信任的，要被信任還需要購買相關認證(http://www.godaddy.com/ssl/ssl-certificates.aspx?ci=8979)

驗證配置：

https://127.0.0.1

二.Tomcat SSL配置

1. 產生 server key ：
以命令列方式切換到目錄%TOMCAT_HOME%，在command命令列輸入如下命令（jdk1.4以上帶的工具）： 

keytool -genkey -alias tomcat -keyalg RSA -keypass junguoguo.com -storepass junguoguo.com -keystore server.keystore -validity 3600

keypass 和 storepass  兩個參數後面跟的是密碼。
使用者名稱輸入欄位名，如localhost（開發或測試用）或hostname.domainname(使用者擁有的網域名稱)，其它全部以 enter 跳過，最後確認，此時會在%TOMCAT_HOME%下產生server.keystore 檔案。
註：參數 -validity 指認證的有效期間(天)，預設有效期間很短，只有90天。

 

配置TOMCAT 修改%TOMCAT_HOME%confserver.xml，以文字編輯器開啟，尋找這一行：將之後的那段的注釋去掉，並加上 keystorePass及keystoreFile屬性。注意，tomcat不同版本配置是不同的:

Tomcat4.1.34配置：

?

1234567

<Connector className=”org.apache.coyote.tomcat4.CoyoteConnector”       port=”8443″ enableLookups=”true” scheme=”https” secure=”true”       acceptCount=”100″       useURIValidationHack=”false” disableUploadTimeout=”true”       clientAuth=”false” sslProtocol=”TLS”       keystoreFile=”server.keystore”       keystorePass=”changeit”/>

 

Tomcat5.5.9配置：

?

1234567

<strong><Connector port=”8443″ maxHttpHeaderSize=”8192″                   maxThreads=”150″ minSpareThreads=”25″ maxSpareThreads=”75″                   enableLookups=”false” disableUploadTimeout=”true”                   acceptCount=”100″ scheme=”https” secure=”true”                   clientAuth=”false” sslProtocol=”TLS”                   keystoreFile=”server.keystore”                   keystorePass=”changeit”/></strong>

 

Tomcat5.5.20配置(此配置同樣可用於Tomcat6.0)：

?

12345678

<Connector protocol=”org.apache.coyote.http11.Http11Protocol”                            port=”8443″ maxHttpHeaderSize=”8192″                  maxThreads=”150″ minSpareThreads=”25″ maxSpareThreads=”75″                  enableLookups=”false” disableUploadTimeout=”true”                  acceptCount=”100″ scheme=”https” secure=”true”                  clientAuth=”false” sslProtocol=”TLS”                  keystoreFile=”server.keystore”                  keystorePass=”changeit”/>

Tomcat6.0.10配置：

?

12345678

<Connector protocol=”org.apache.coyote.http11.Http11NioProtocol”                   port=”8443″ minSpareThreads=”5″ maxSpareThreads=”75″                   enableLookups=”true” disableUploadTimeout=”true”                   acceptCount=”100″  maxThreads=”200″                   scheme=”https” secure=”true” SSLEnabled=”true”                   clientAuth=”false” sslProtocol=”TLS”                   keystoreFile=”D:/tools/apache-tomcat-6.0.10/server.keystore”                   keystorePass=”changeit”/>

tomcat6支援3種，請參考以下文檔：

http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

驗證配置 ：訪問 https://127.0.1.1:8443/

三。綜合配置

前段靜態內容處理：nginx 配置

http {    include       /etc/nginx/mime.types;    default_type  application/octet-stream;    log_format  main  ‘$remote_addr - $remote_user [$time_local] "$request" ‘                      ‘$status $body_bytes_sent "$http_referer" ‘                      ‘"$http_user_agent" "$http_x_forwarded_for"‘;    access_log  /var/log/nginx/access.log  main;    sendfile        on;    tcp_nopush      on;    tcp_nodelay     on;    server_tokens   off;    gzip            on;    gzip_static     on;    gzip_comp_level 5;    gzip_min_length 1024;    keepalive_timeout  65;    limit_zone   myzone  $binary_remote_addr  10m;    # Load config files from the /etc/nginx/conf.d directory    include /etc/nginx/conf.d/*.conf;server {    listen       80;    server_name  localhost;        location ~ .(htm|html|gif|jpg|jpeg|png|ico|rar|css|js|zip|txt|flv|swf|doc|ppt|xls|pdf)$ {                index index.jsp index.html;                root /home/tomcat/webapps;                access_log off;                expires 24h;        }#nginx處理靜態內容         location /{                proxy_pass http://127.0.0.1:8080; #提交給後端的tomcat處理         }}

驗證配置： https://127.0.0.1

Nginx+Tomcat實現https安全連結