使用OpenSSL工具构建自签名根证书、服务器证书和客户证书，搭建双向认证服务...

Tomcat双向认证配置

最新推荐文章于 2024-02-03 21:24:15 发布

原创最新推荐文章于 2024-02-03 21:24:15 发布 · 349 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#java #操作系统

openssl 专栏收录该内容

0 篇文章

订阅专栏

本文介绍如何使用Linux下的shell脚本生成证书，并配置Tomcat服务器实现双向SSL认证。包括生成CA证书、服务器证书及客户端证书的过程，以及配置Tomcat server.xml文件启用SSL并设置信任存储。

Linux下的shelle脚本（注意最后一行keytool命令位于$JAVA_HOME/bin下）：

md ca
md client
md server
md jks
openssl genrsa -out ca/ca-key.pem 2048
openssl req -new -out ca/ca-req.csr -key ca/ca-key.pem
openssl x509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -days 3650
openssl pkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -out ca/ca.p12
openssl genrsa -out server/server-key.pem 2048
openssl req -new -out server/server-req.csr -key server/server-key.pem
openssl x509 -req -in server/server-req.csr -out server/server-cert.pem -signkey server/server-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
openssl pkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem -out server/server.p12
openssl genrsa -out client/client-key.pem 2048
openssl req -new -out client/client-req.csr -key client/client-key.pem
openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -signkey client/client-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial -days 3650
openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12
keytool -keystore jks/truststore.jks -keypass changeit -storepass 123456 -alias ca -import -trustcacerts -file ca/ca-cert.pem

tomcat的conf目录下server.xml片段：

<Connector
        SSLEnabled="true"
        clientAuth="true"
        maxThreads="150"
        port="443"
        protocol="HTTP/1.1"
        scheme="https"
        secure="true"
        sslProtocol="TLS"
        keystoreFile="conf/server.p12"
        keystorePass="123456"
        keystoreType="PKCS12"
        truststoreFile="conf/ca.p12"
        truststorePass="123456"
        truststoreType="PKCS12" />

参考文章：

《实现Tomcat双向认证》

2012.03.29 15:40补充：

不知道为什么，按上面所说配置的server.xml没有起作用，改成JKS方式的truststore才能成功，如下：

<Connector 
		port="8443" 
		protocol="HTTP/1.1" 
		SSLEnabled="true"
		maxThreads="150" 
		scheme="https" 
		secure="true"
		clientAuth="true" 
		sslProtocol="TLS"
		keystoreFile="/Applications/tomcat/ssl/server/server.p12"
		keystorePass="123456"
		keystoreType="PKCS12"
		truststoreFile="/Applications/tomcat/ssl/jks/truststore.jks"
		truststorePass="123456"
		truststoreType="JKS"/>