security - 如何在 Tomcat 上更新 ssl 证书？

Question

遵循 go-daddy 文档:

https://www.godaddy.com/help/tomcat-4x5x6x-renew-a-certificate-5355

流程:

我创建了 myDomain.csr 并将其发送给 GoDaddy，得到了他们的回复，其中包含 3 个文件 ( gd_bundle-g2-g1.crt , gdig2.crt.pem ,59a41eaec32d2046.crt)

我提到过期的旧证书具有链式结构，不幸的是 Go-daddy 只给我“扁平”证书。

我试着自己做一个链:

cat 59a41eaec32d2046.crt gd_bundle-g2-g1.crt gdig2.crt.pem >> myDomain.crt

在那之后:

sudo keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file myDomain.crt  
sudo keytool -import -alias intermed -keystore tomcat.keystore -trustcacerts -file gdig2.crt
sudo keytool -import -alias root -keystore tomcat.keystore -trustcacerts -file gd_bundle-g2-g1.crt

并完全按照文档中的内容更改 server.xml

我附上我认为它应该如何出现的图片

但实际上在我的链条之后我有:

当我打开浏览器 GOT 时:

Secure Connection Failed

An error occurred during a connection to talenttribe.me. Cannot communicate securely with peer: no common encryption algorithm(s). Error code: SSL_ERROR_NO_CYPHER_OVERLAP

    The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.
    Please contact the website owners to inform them of this problem.

Learn more…

Report errors like this to help Mozilla identify and block malicious sites

不明白我错过了什么……是链创建问题还是 tomcat 问题？？

BR,

Answer 1

如果您从现有供应商处续订，则只需更换 tomcat 证书。证书名称 hexcode.crt 其他不用改。它对我有用。

keytool -import -alias tomcat -keystore tomcat.keystore -trustcacerts -file 文件路径