Tomcat SSL https 端口问题

Question

目前我正在努力提高我的 tomcat 知识。我正在尝试使用 SSL 设置 tomcat。这个想法是我得到了不需要任何授权的/app 路径和需要基本身份验证的/admin 路径。我想这只是缺乏关于 SSL 的一般知识，我无法理解会发生什么。

当我使用 url http://localhost:8080/myapp/app/ 时，它会工作并显示我的页面。现在我将/app 更改为/admin。之后我的 url 是 https://localhost/myapp/admin 并且它不起作用，因为缺少 8443 端口。我不明白为什么它会自动更改为 https 但之后端口丢失了？我的问题是什么，我该如何解决？

非常感谢任何帮助:)

我的服务器.xml:

<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on"/>

<Listener className="org.apache.catalina.core.JasperListener"/>
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>

<Service name="Catalina">

    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
            />

    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
               keystoreFile="${catalina.home}/myapp.keystore"
               keystorePass="histackoverflow"/>

    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"/>

    <Engine name="Catalina" defaultHost="localhost">

        <Realm className="org.apache.catalina.realm.MemoryRealm" />

        <Host name="localhost" appBase="webapps"
              unpackWARs="true" autoDeploy="true">

            <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
                   prefix="localhost_access_log." suffix=".txt"
                   pattern="%h %l %u %t &quot;%r&quot; %s %b"/>

        </Host>
    </Engine>
</Service>

我的 web.xml 看起来像这样:

<servlet>
    <servlet-name>MyApp REST Service</servlet-name>
    <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
    <init-param>
        <param-name>com.sun.jersey.config.property.packages</param-name>
        <param-value>main.ch.myapp.resource.app</param-value>
    </init-param>
    <init-param>
        <param-name>com.sun.jersey.api.json.POJOMappingFeature</param-name>
        <param-value>true</param-value>
    </init-param>
    <load-on-startup>1</load-on-startup>
</servlet>
<servlet-mapping>
    <servlet-name>Myapp REST Service</servlet-name>
    <url-pattern>/app-api/*</url-pattern>
</servlet-mapping>


<servlet>
    <servlet-name>MyApp Admin REST Service</servlet-name>
    <servlet-class>com.sun.jersey.spi.container.servlet.ServletContainer</servlet-class>
    <init-param>
        <param-name>com.sun.jersey.config.property.packages</param-name>
        <param-value>main.ch.myapp.resource.admin</param-value>
    </init-param>
    <init-param>
        <param-name>com.sun.jersey.api.json.POJOMappingFeature</param-name>
        <param-value>true</param-value>
    </init-param>

    <load-on-startup>1</load-on-startup>
</servlet>

<servlet-mapping>
    <servlet-name>MyApp Admin REST Service</servlet-name>
    <url-pattern>/admin-api/*</url-pattern>
</servlet-mapping>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>MyApp Admin</web-resource-name>
        <url-pattern>/admin/*</url-pattern>
        <url-pattern>/admin-api/*</url-pattern>
    </web-resource-collection>
    <auth-constraint>
        <role-name>admin</role-name>
    </auth-constraint>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>
<login-config>
    <auth-method>BASIC</auth-method>
</login-config>

Answer 1

由于 <transport-guarantee>CONFIDENTIAL</transport-guarantee>，对 https 的更改已完成包含在 <security-constraint> 中.

看看:
The Java EE 6 Tutorial, Volume I. Specifying Security Constraints
The Java EE 6 Tutorial, Volume I. Specifying a Secure Connection

Specifying a Secure Connection

A user data constraint (TutorialUser-data-constraint in the deployment descriptor) contains the transport-guarantee element. A user data constraint can be used to require that a protected transport layer connection such as HTTPS (HTTP over SSL) be used for all constrained URL patterns and HTTP methods specified in the security constraint. The choices for transport guarantee include CONFIDENTIAL, INTEGRAL, or NONE. If you specify CONFIDENTIAL or INTEGRAL as a security constraint, it generally means that the use of SSL is required, and that type of security constraint applies to all requests that match the URL patterns in the web resource collection and not just to the login dialog box.

此外，我认为端口 8443 不可用，因为您没有将 Tomcat 配置为使用 SSL。
在以下链接中，您可以找到有关在 Tomcat 上配置 SSL 支持的很好的操作方法:

Apache Tomcat 7. SSL/TLS Configuration HOW-TO

--- 编辑(已发布 server.xml 配置)---

要重定向到端口 8443，您需要更改连接器配置，如下所示:

<Connector port="8080" protocol="HTTP/1.1"
    connectionTimeout="20000"
    redirectPort="8443" />

Apache Tomcat 7. The AJP Connector

redirectPort

If this Connector is supporting non-SSL requests, and a request is received for which a matching security-constraint requires SSL transport, Catalina will automatically redirect the request to the port number specified here.