RSA 证书生成(含 tomcat配置)

tomcar

1、为服务端生成证书
keytool -genkey -v -alias tomcat -keyalg RSA -keystore /home/tomcat/key/https/tomcat.keystore -validity 36500

   
localhost 或者ip或者域名
2、为客户端生成证书
keytool -genkey -v -alias mykey -keyalg RSA -storetype PKCS12 -keystore /home/tomcat/key/https/mykey.p12
3、让服务器信任客户端证书
keytool -export -alias mykey -keystore /home/tomcat/key/https/mykey.p12 -storetype PKCS12 -stroepass 123456 -rfc -file /home/tomcat/key/https/mykey.cer
4、将该文件导入到服务器的证书库，添加为一个信任的证书
keytool -import -v -file /home/tomcat/key/https/mykey.cer -keystore /home/tomcat/key/https/tomcat.keystore
可查看证书
keytool -list -keystore /home/tomcat/key/https/tomcat.keystore
5、让客户端信任服务器证书
keytool -keystore /home/tomcat/key/https/tomcat.keystore -export -alias tomcat -file /home/tomcat/key/https/tomcat.cer
6、配置Tomcat服务器  tomcat根目录下 /conf/server.xml
<connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
SSLEnabled="true" maxThreads="150" scheme="https"
secure="true" clientAuth="true" sslProtocol="TLS"
keystoreFile="/home/tomcat/key/https/tomcat.keystore" keystorePass="123456"
truststoreFile="/home/tomcat/key/https/tomcat.keystore" truststorePass="123456" />
--说明：clientAuth 设置是否双向验证，默认为false，设置为true代表双向验证

cyfwapj

方法值得论证，支持！

bennyt

过来学习一下。

longbbyl

方法值得论证