java 如何在 RHEL 上的 Tomcat 7 上启用 SSL/HTTPS
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/15337123/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
How to Enable SSL/HTTPS on Tomcat 7 on RHEL
提问by code_fish
I have a Java application which I am running on RHEL server. I want to enable SSL on tomcat 7 on RHEL. I am following this tutorial.
我有一个在 RHEL 服务器上运行的 Java 应用程序。我想在 RHEL 上的 tomcat 7 上启用 SSL。我正在关注本教程。
I used this command to to create a self-signed certificate.
我使用这个命令来创建一个自签名证书。
keytool -genkey -alias mkyong -keyalg RSA -keystore c:\mkyongkeystore
But on running https://localhost:8443/I am not getting anything and I am enable to configure Tomcat to support SSL Or https.
但是在运行时https://localhost:8443/我什么也没得到，我可以配置 Tomcat 以支持 SSL 或 https。
回答by lzap
A) Create a keystore file to store the server's private key and self-signed certificate by executing the following command:
A) 通过执行以下命令创建一个密钥库文件来存储服务器的私钥和自签名证书：
keytool -genkey -alias tomcat -keyalg RSA -keystore /etc/tomcat6/keystore
keytool -genkey -alias tomcat -keyalg RSA -keystore /etc/tomcat6/keystore
B) Uncomment the "SSL HTTP/1.1 Connector" entry in /etc/tomcat6/server.xml and modify as described in the Configuration section below (this is only an example, edit your own configuration and just uncomment it and provide the correct password).
B) 取消注释 /etc/tomcat6/server.xml 中的“SSL HTTP/1.1 Connector”条目并按照下面的配置部分所述进行修改（这只是一个示例，编辑您自己的配置并取消注释并提供正确的密码）。
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="want" SSLProtocol="TLS"
keystoreFile="conf/keystore"
truststoreFile="conf/keystore"
keystorePass="XXXXXX"
keystoreType="PKCS12"
ciphers="SSL_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA,
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA,
TLS_ECDH_anon_WITH_AES_128_CBC_SHA,
TLS_ECDH_anon_WITH_AES_256_CBC_SHA"
truststorePass="XXXXXXXXXXXXXXX" />
C) If you are using selinux, you may need to relabel newly created keystore file context. Use RHEL SELinux guide how to do that.
C) 如果您使用 selinux，您可能需要重新标记新创建的密钥库文件上下文。使用 RHEL SELinux 指南如何做到这一点。
