ssl 双向认证 java https双向认证配置

转载

mob64ca13f7ecc9 2023-10-29 23:51:57

文章标签 ssl 双向认证 java tomcat apache 配置文件 文章分类 Java 后端开发

1、生成CA自签文件

1.1 在openssl-0.9.8h-1-bin\bin进入cmd窗口

或者 cmd窗口路径到openssl-0.9.8h-1-bin\bin下

ssl 双向认证 java https双向认证配置_tomcat

1.2

ras的秘钥长度：2048

存放ca公钥证书的路径：D:/cert_test/root_ca/ca_cert.pem

证书的有效期（天）： 3650

根证书配置文件：D:/jx_cert/conf/gen_ca.conf 根据自己的需要调整配置文件的私钥证书证书存放路径，颁发者名称等

openssl req -x509 -newkey rsa:2048 -out D:/cert_test/root_ca/ca_cert.pem -outform PEM -days 3650 -config "D:/jx_cert/conf/gen_ca.conf"

执行此命令需要设置根证书密码

ssl 双向认证 java https双向认证配置_配置文件_02

本次测试设置的密码是：test

运行完成1.1和1.2会生成ca_cert.pem和ca_private_key.pem这两个文件

ssl 双向认证 java https双向认证配置_配置文件_03

2、生成tomcat.jks证书

tomcat.jsk证书存放路径：D:\cert_test\service\tomcat.jks

tomcat.jks证书密码：cert_test

颁发者名称（需要和配置名字的颁发者名称一样）：QTHD_CMBC_SMZF

命令行进入jre根目录，执行

keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -genkey -keyalg RSA -dname "CN=127.0.0.1, OU=servers, O=QTHD_CMBC_SMZF"

运行该命令后会生成tomcat.jks文件，在tomcat/bin目录service.xml配置Https需要使用到该证书

ssl 双向认证 java https双向认证配置_tomcat_04

生成的jks文件如下：

ssl 双向认证 java https双向认证配置_tomcat_05

3、根据tomcat.jks证书生成服务器请求证书

tomcat.jks证书存放路径：D:\cert_test\service\tomcat.jks

tomcat.jks证书密码：cert_test

serverreq.pem证书存放路径：D:\cert_test\service\serverreq.pem

keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -certreq -file D:\cert_test\service\serverreq.pem

运行该命令后会生成serverreq.pem文件

4、CA签署服务器证书

serverreq.pem证书存放路径：D:\cert_test\service\serverreq.pem

servercert.pem证书存放路径：D:\cert_test\service\servercert.pem

qthd_ca.conf配置文件存放路径：D:\jx_cert\qthd_ca\qthd_ca.conf 根据需要调整配置文件的信息

需在D:\cert_test目录下新建newcerts文件夹，需把index和serial放进D:\test目录下

openssl ca -in D:\cert_test\service\serverreq.pem -out D:\cert_test\service\servercert.pem -config "D:\jx_cert\conf\ca.conf"

执行此命令需要输入根证书密码，并且需要同意签署证书和同意请求认证提交

ssl 双向认证 java https双向认证配置_ssl 双向认证 java_06

5、导入CA证书到keystore

tomcat.jks证书存放路径：D:\cert_test\service\tomcat.jks

tomcat.jks证书密码：cert_test

ca公钥证书路径：D:/cert_test/root_ca/ca_cert.pem

keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias ca -import -trustcacerts -file D:/cert_test/root_ca/ca_cert.pem

执行此命令需要同意信任此证书

ssl 双向认证 java https双向认证配置_apache_07

6、导入服务器证书到keystore

tomcat.jks证书路径：D:\cert_test\service\tomcat.jks

tomcat.jks证书密码：cert_test

servercert.pem证书存放路径：D:\cert_test\service\servercert.pem

keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -import -file D:\cert_test\service\servercert.pem

执行此命令可能会提示证书回复已安装在密钥库中，继续执行下一步即可

ssl 双向认证 java https双向认证配置_配置文件_08

7、查看keystore受信列表

keytool -keystore D:\cert_test\service\tomcat.jks -keypass cmbc_smzf -storepass cert_test -list -v

ssl 双向认证 java https双向认证配置_tomcat_09

8、将CA证书导入到受信keystore

truststore.jks证书路径：D:\cert_test\service\truststore.jks

truststore.jks证书密码：cert_test

ca公钥证书路径：D:\cert_test\root_ca\ca_cert.pem

keytool -keystore D:\cert_test\service\truststore.jks -keypass cert_test -storepass cert_test -alias ca -import -trustcacerts -file D:\cert_test\root_ca\ca_cert.pem

执行此命令时需要同意信任此证书，并且会生成truststore.jks证书

ssl 双向认证 java https双向认证配置_配置文件_10

9、tomcat配置https

需要在tomcat/conf目录下调整service.xml文件

A、注释掉<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

B、在两个Connector中间添加

<Connector SSLEnabled="true" acceptCount="100" className="org.apache.coyote.http11.Http11Protocol" 
     clientAuth="true" connectionTimeout="30000" disableUploadTimeout="true" enableLookups="true" 
     keepAliveTimeout="30000" keystoreFile="D:\https\apache-tomcat-7.0.78\conf\ssl\tomcat.jks" 
     keystorePass="cert_test" maxIdleTime="60000" maxSpareThreads="100" maxThreads="350" 
     minSpareThreads="30" port="8443" scheme="https" secure="true" sslProtocol="TLS" 
     truststoreFile="D:\https\apache-tomcat-7.0.78\conf\ssl\truststore.jks" truststorePass="cert_test"/>

本文中路径如下，按自己实际路径填写：

tomcat.jks路径：D:\https\apache-tomcat-7.0.78\conf\ssl\tomcat.jks

tomcat.jks密码：cert_test

truststore.jks路径：D:\https\apache-tomcat-7.0.78\conf\ssl\truststore.jks

truststore.jks密码：cert_test

配置完成启动tomcat，并且访问服务：https://localhost:8443/。访问时如果提示此网站无法提供安全连接，说明tomcat配置https完成，请完成以下步骤，生成p12证书再次访问。

10、创建客户端秘钥

客户端key.pem路径：D:\cert_test\certs\lzq_testKey.pem

客户端req.pem路径：D:\cert_test\certs\lzq_testreq.pem

颁发者名称：ZAOMZ_CA

openssl req -newkey rsa:2048 -keyout D:\cert_test\certs\testKey.pem -keyform PEM -out D:\cert_test\certs\testreq.pem -outform PEM -subj "/O=ZAOMZ_CA/OU=ZAOMZ_CA/CN=qthd_test" -config "D:\jx_cert\openssl-0.9.8h-1-bin\share\openssl.cnf"

ssl 双向认证 java https双向认证配置_tomcat_11

执行此命令会生成lzq_testKey.pem和lzq_testreq.pem

ssl 双向认证 java https双向认证配置_tomcat_12

11、签发个人证书

客户端req.pem路径：D:\cert_test\certs\lzq_testreq.pem

客户端cert.pem路径：D:\cert_test\certs\lzq_testreqcert.pem

ca配置文件路径：D:\jx_cert\conf\ca.conf

openssl ca -in D:\cert_test\certs\testreq.pem -out D:\cert_test\certs\testreqcert.pem -config "D:\jx_cert\conf\ca.conf"

执行此命令时需要输入根证书密码：test

并且同意两个条件

ssl 双向认证 java https双向认证配置_ssl 双向认证 java_13

12、制作个人p12证书

cert.pem文件路径：D:\cert_test\certs\lzq_testreqcert.pem

key.pem文件路径：D:\cert_test\certs\lzq_testKey.pem

p12证书路径：D:\cert_test\p12\lzq_test.p12

openssl pkcs12 -export -in D:\cert_test\certs\lzq_testreqcert.pem -inkey D:\cert_test\certs\lzq_testKey.pem -out D:\cert_test\p12\lzq_test.p12 -name lzq_test -chain -CAfile "D:\cert_test\root_ca\ca_cert.pem"

执行此命令需要输入三次密码。

ssl 双向认证 java https双向认证配置_apache_14