java - tomcat server.xml文件中的keyAlias ="aaaa"是什么

Question

我购买了 SSL 证书并将其安装到 tomcat 中。我创建了 tomcat.keystore 文件，我将其包含在 server.xml 文件中，还放置了密码，但无法理解 keyAlias="aaa"。如果我输入 keyAlias="localhost"然后我得到下面给出的异常。如果我从连接器标记中删除 keyAlias 本身，那么我会得到另一个异常，它在下一个 localhost 异常下面给出。

java.io.IOException: Alias name localhost does not identify a key entry
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:588)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:526)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:471)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:218)
    at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:400)
    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:649)

这是从 Connector 标签中删除 keyAlias 本身后的异常。

Aug 08, 2015 2:39:18 PM org.apache.catalina.core.StandardService initInternal
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-443]]
org.apache.catalina.LifecycleException: Failed to initialize component [Connector[HTTP/1.1-443]]
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)
    at org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:821)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:638)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:663)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:606)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:280)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:454)
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:980)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    ... 12 more
Caused by: java.net.BindException: Address already in use <null>:443
    at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:413)
    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:649)
    at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:434)
    at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:978)
    ... 13 more
Caused by: java.net.BindException: Address already in use
    at java.net.PlainSocketImpl.socketBind(Native Method)
    at java.net.AbstractPlainSocketImpl.bind(AbstractPlainSocketImpl.java:376)
    at java.net.ServerSocket.bind(ServerSocket.java:376)
    at java.net.ServerSocket.<init>(ServerSocket.java:237)
    at java.net.ServerSocket.<init>(ServerSocket.java:181)
    at javax.net.ssl.SSLServerSocket.<init>(SSLServerSocket.java:136)
    at sun.security.ssl.SSLServerSocketImpl.<init>(SSLServerSocketImpl.java:107)
    at sun.security.ssl.SSLServerSocketFactoryImpl.createServerSocket(SSLServerSocketFactoryImpl.java:84)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:219)
    at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:400)
    ... 17 more

server.xml文件内容如下。

<Connector port="443" SSLEnabled="true" protocol="org.apache.coyote.http11.Http11Protocol"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           keystoreFile="tomcat.keystore"
           keystorePass="test" keyAlias="aaa"/>

keyAlias 是什么？为什么删除它后会出现异常，即绑定(bind)异常？

Answer 1

基亚利亚斯:

https://www.digicert.com/ssl-certificate-installation-tomcat.htm `

1. 当您将证书导入 keystore 时，您通常会提供一个“别名”:

   keytool -import -trustcacerts -alias server -file your_site_name.p7b -keystore your_site_name.jks

2. 然后在您的 server.xml 中声明相同“别名”:

   <Connector port="443" maxHttpHeaderSize="8192" maxThreads="150"
minSpareThreads="25" maxSpareThreads="75" enableLookups="false"
disableUploadTimeout="true" acceptCount="100" scheme="https"
secure="true" SSLEnabled="true" clientAuth="false" sslProtocol="TLS"
keyAlias="server" keystoreFile="/home/user_name/your_site_name.jks"
keystorePass="your_keystore_password" />

3. 以下是一些可能有帮助的其他链接:

https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html

https://www.mulesoft.com/tcat/tomcat-ssl

https://wolfpaulus.com/jounal/mac/tomcat-ssl/

第二个问题，“无法绑定(bind)”:

就“正在使用的地址”而言，我只是尝试重新启动服务器并查看 Tomcat 是否正确启动。

如果再次遇到错误，

1. 查看您的 Tomcat 设置以了解您尝试使用哪个端口(例如 443)

2. 检查您的系统，看看还有谁在使用该端口(lsof、nmap 等):

http://www.howtogeek.com/howto/28609/how-can-i-tell-what-is-listening-on-a-tcpip-port-in-windows/

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/3/html/Security_Guide/s1-server-ports.html