java - 在服务器上使用 SSL 配置 Tomcat

Question

我正在尝试使用服务器上的 SSL 配置 tomcat(因为我需要通过 https 发出请求)。我遵循了这些步骤-:1).生成 keystore

  $Tomcat\bin>keytool -genkey -alias mkyong -keyalg RSA -keystore    
  c:\mkyongkeystore
  Enter keystore password:
  Re-enter new password:
  What is your first and last name?
   [Unknown]:  yong mook kim
  What is the name of your organizational unit?
  //omitted to save space
  [no]:  yes

  Enter key password for <mkyong>
    (RETURN if same as keystore password):
  Re-enter new password:

   $Tomcat\bin>

2).通过在 server.xml 中添加连接器来使用 keystore 配置 tomcat

       <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS" 
       keystoreFile="/var/lib/tomcat7/webapps/key/mykeystore"
       keystorePass="password" />

然后我尝试打开 https://[host]:8443/但是还是显示This page can't be displayed

但是当我对本地主机尝试相同的方法时，它起作用了。为什么它不能在服务器上工作

Answer 1

以下是 Tomcat 文档中有关设置 HTTPS 的一些引述:

Tomcat can use two different implementations of SSL:

the JSSE implementation provided as part of the Java runtime (since 1.4)
the APR implementation, which uses the OpenSSL engine by default.
...

As configuration attributes for SSL support significantly differ between APR vs. JSSE implementations, it is recommended to avoid auto-selection of implementation. It is done by specifying a classname in the protocol attribute of the Connector.

To define a Java (JSSE) connector, regardless of whether the APR library is loaded or not, use one of the following:

<!-- Define a HTTP/1.1 Connector on port 8443, JSSE NIO implementation -->
<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
       port="8443" .../>

我的理解是，您应该尝试为协议(protocol)属性使用类名:

   <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
       SSLEnabled="true" maxThreads="150" scheme="https" secure="true"
       clientAuth="false" sslProtocol="TLS" 
   keystoreFile="/var/lib/tomcat7/webapps/key/mykeystore"
   keystorePass="password" />