Tomcat 配置 Https 单向 生成 JKS 密钥库,并查看证书 keytool -genkey -alias "tomcat_store" -keyalg "RSA" -keysize 2048 -validity 3650 -keypass "password" -keystore "C:\tomcat_store.keystore" -storetype JKS -storepass "password" -dname "CN=localhost, OU=cn, O=cn, L=changsha, ST=hunan, C=China"
keytool -list
-v -keystore "C:\tomcat_store.keystore" -storepass "password" keytool -list
-rfc -keystore "C:\tomcat_store.keystore" -storepass "password" 或者 keytool -genkey -alias "tomcat_store" -keyalg "RSA" -keysize 2048 -validity 3650 -keypass "password" -keystore "C:\tomcat_store.keystore" -storetype PKCS12 -storepass "password" -dname "CN=localhost, OU=cn, O=cn, L=changsha, ST=hunan, C=China" keytool -list
-v -keystore "C:\tomcat_store.keystore" -storepass "password" 导入证书 keytool -importkeystore -srcalias "tomcat_store" -srckeystore C:\tomcat_store.keystore -srcstorepass "password" -srckeypass "password" -destkeystore C:\tomcat_store.keystore -deststoretype pkcs12 -destkeypass "password"
导出证书 CA keytool -export -alias "tomcat_store" -keystore "C:\tomcat_store.keystore" -storetype PKCS12 -storepass "password" -rfc -file "C:\tomcat_store.cer" keytool -printcert -file "C:\tomcat_store.cer"
删除导入的证书 keytool -delete -alias “tomcat_store” -keystore "C:\Program Files (x86)\Java\jre6\lib\security\cacerts" -storepass changeit
Nginx 配置 Https 单向
1. 在 S CentOS 服务器上安装 L OpenSSL 软件
# 安装命令
yum install openssl openssl-devel# 更新命令
yum update openssl openssl-devel 2. 配置 A CA 服务器
生成自签署证书的密钥 # 进入证书目录(安装了 OpenSSL 软件就会存在该目录)
cd /etc/pki/CA/ # 使用 rsa 加密算法生成自签署证书的密钥(此处指定密钥长度为 2048)
openssl genrsa -out private/cakey.pem 2048 # 修改权限，增加安全性
chmod 600 private/cakey.pem
利用密钥生成 CA 服务器的证书文件， 为了方便，首先在 OpenSSL 配置文件中设置一些默认值 # 编辑配置文件
vim /etc/pki/tls/openssl.cnf 修改内容如下(部分内容)：
# 找到如下部分，在签署证书时证书中会写入如下内容(大概 128 行)
[ req_distinguished_name ] countryName
= Country Name ( 2
letter code) # 配置默认国家
countryName_default
= CN countryName_min
= 2
countryName_max
= 2
stateOrProvinceName
= State or
Province Name (full name) # 默认省份名称
stateOrProvinceName_default
= SiChuan
localityName
= Locality Name (eg, city) # 默认城市名称
localityName_default
= ChengDu 0. organizationName
= Organization Name (eg, company)
# 默认公司名称 0. organizationName_default
= SkyGuard # we can do this but it is not needed normally :-)#1.organizationName
= Second Organization Name (eg, company)#1.organizationName_default
= World Wide Web Pty Ltd
organizationalUnitName
= Organizational Unit Name (eg, section) # 默认组织单位名称
organizationalUnitName_default = BigData
生成自签署证书：
#用刚刚生成的密钥文件生成一个有效期为 10 年的证书
openssl req -new -x509 -key ./private/cakey.pem -out cacert.pem -days 3650
----- #以下几项使用刚刚配置的默认值，所有直接回车
Country Name ( 2
letter code) [CN]: State or
Province Name (full name) [SiChuan]: Locality Name (eg, city) [ChengDu]: Organization Name (eg, company) [SkyGuard]: Organizational Unit Name (eg, section) [BigData]:
# 此处配置 CA 服务器名字，建议使用 DNS 上能查找到的域名(测试可随便指定)
Common Name (eg, your name or
your server "s hostname) []:nginx.xiaochunping.com # 此处设置管理员邮箱(测试可随便指定) Email Address []:xiaochunping9987@163.com
创建如下两个文件 # 创建存放颁发证书的数据库文件
touch index.txt # 当前颁发证书的序列号文件，颁发下一个证书时会自动加 1
echo "00" > serial
3. 配置 x Nginx 服务器 s Https 单向认证
编译安装 Nginx 服务器 wget http://nginx.org/download/nginx-1.11.12.tar.gz
tar -zvxf nginx-1.11.12.tar.gz
cd nginx-1.11.12
#一定要将 ssl 模块编译进去
./configure --with-http_ssl_module
make
make install # 进入到 Nginx 目录
cd /usr/local/nginx
配置 Nginx 服务器支持 ssl # 创建存放 ssl 先关的目录，并进入目录
mkdir ssl
&& cd ssl
# 生成本地密钥
openssl genrsa 2048 > httpd.key
# 修改权限，增加安全性
chmod 600 httpd.key # 生成证书申请文件，以便传入 CA 服务器申请证书
openssl req -new -key httpd.key -out httpd.crq
----- #以下几项与 CA 服务器信息保持一致
Country Name ( 2
letter code) [XX] :CN
State or
Province Name (full name) [] :SiChuan
Locality Name (eg, city) [Default City] :ChengDu
Organization Name (eg, company) [Default Company Ltd] :SkyGuard
Organizational Unit Name (eg, section) [] :BigData# Nginx 中虚拟主机名，只对该虚拟主机的请求加密
Common Name (eg, your name or
your server "s hostname) []:nginx.xiaochunping.com # 管理员邮箱 Email Address []:xiaochunping9987@163.com
Please enter the following " extra " attributes to be sent with your certificate request # 设置单独密码，忽略即可 A challenge password []: An optional company name []
登录到 CA 服务器对证书进行签署，切换到 CA 目录 openssl ca -in /tmp/httpd.crq -out /tmp/httpd.crt -days 3650
Certificate is to be certified until
Mar 23
05:25:03
2027
GMT ( 3650
days) Sign the certificate? [y/n] :y
1
out of 1
certificate requests certified, commit? [y/n]y Write out database with 1
new entries Data Base Updated
配置 Nginx vim conf/nginx.conf# 增加如下虚拟主机
server {
listen 443 ssl;
server_name nginx.skyguard.com.cn;
ssl on;
ssl_certificate ../ssl/httpd.crt;
ssl_certificate_key ../ssl/httpd.key;
ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;
ssl_ciphers ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:+SSLv2:+EXP;
ssl_prefer_server_ciphers on;
location / {
root
html;
index
index.html index.htm;
} } # 启动 Nginx 服务器
./sbin/nginx 然后用浏览器打开 https://ip
tcp.port == 80 tcp.port == 443 and ip.addr == 47.106.202.10
