利用keytools为tomcat 7配置ssl双向认证的方法

下面是详细的“利用keytools为tomcat 7配置ssl双向认证的方法”的攻略：

一、生成证书文件

首先，我们需要生成证书文件，可以使用Java自带的keytool工具来完成此步骤。以下是生成证书文件的命令：

keytool -genkeypair -alias client -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -validity 365 -keystore client.keystore -storetype JKS

其中，certfile.crt是生成的证书文件，将其复制到服务器的指定目录下。

二、修改Tomcat配置

1. 打开Tomcat的配置文件，在连接器中添加以下配置，启用SSL：

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"/>

1. 启用“ClientAuth”配置项，开启SSL双向认证：

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           clientAuth="true" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"/>

三、导入证书至keytool

1. 将之前生成的证书文件导入到keytool中：

keytool -import -trustcacerts -alias client -file certfile.crt -keystore truststore_client.jks -storetype JKS

四、配置双向认证

1. 在Tomcat的配置文件中，启用SSL双向认证：

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           clientAuth="true" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"
           keystoreFile="../conf/mykey.keystore" keystorePass="changeit"
           truststoreFile="../conf/mytruststore.keystore" truststorePass="changeit"/>

1. 将之前生成的客户端证书复制到客户端的指定目录下；

2. 编写Java代码进行双向认证测试，示例代码如下：

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URL;
import java.security.Principal;

import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLPeerUnverifiedException;

public class HttpsClient {

    public static void main(String[] args) {
        new HttpsClient().testIt();
    }

    private void testIt() {

        String https_url = "https://localhost:8443/";
        URL url;
        try {

            url = new URL(https_url);
            HttpsURLConnection con = (HttpsURLConnection) url.openConnection();

            //dumpl all cert info
            print_https_cert(con);

            //dump all the content
            print_content(con);

        } catch (Exception e) {
            e.printStackTrace();
        }

    }

    private void print_https_cert(HttpsURLConnection con) {

        if (con != null) {

            try {

                System.out.println("Response Code : " + con.getResponseCode());
                System.out.println("Cipher Suite : " + con.getCipherSuite());
                System.out.println("\n");

                java.security.cert.Certificate[] certs = con.getServerCertificates();
                for (java.security.cert.Certificate cert : certs) {
                    System.out.println("Cert Type : " + cert.getType());
                    System.out.println("Cert Hash Code : " + cert.hashCode());
                    System.out.println("Cert Public Key Algorithm : " + cert.getPublicKey().getAlgorithm());
                    System.out.println("Cert Public Key Format : " + cert.getPublicKey().getFormat());
                    System.out.println("\n");
                }

            } catch (SSLPeerUnverifiedException e) {
                e.printStackTrace();
            } catch (Exception e) {
                e.printStackTrace();
            }

        }

    }

    private void print_content(HttpsURLConnection con) {
        if (con != null) {

            try {

                System.out.println("****** Content of the URL ********");
                BufferedReader br = new BufferedReader(new InputStreamReader(con.getInputStream()));

                String input;

                while ((input = br.readLine()) != null) {
                    System.out.println(input);
                }
                br.close();

            } catch (Exception e) {
                e.printStackTrace();
            }

        }

    }
}

示例

以下是两个例子：

示例一

生成证书文件：

keytool -genkeypair -alias client -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -validity 365 -keystore client.keystore -storetype JKS

启用SSL：

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"/>

导入证书至keytool：

keytool -import -trustcacerts -alias client -file certfile.crt -keystore truststore_client.jks -storetype JKS

配置双向认证：

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           clientAuth="true" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"
           keystoreFile="../conf/mykey.keystore" keystorePass="changeit"
           truststoreFile="../conf/mytruststore.keystore" truststorePass="changeit"/>

示例二

生成证书文件：

keytool -genkeypair -alias client -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -validity 365 -keystore client.keystore -storetype JKS

启用SSL：

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"/>

导入证书至keytool：

keytool -import -trustcacerts -alias client -file certfile.crt -keystore truststore_client.jks -storetype JKS

配置双向认证：

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true"
           clientAuth="true" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2,TLSv1.1,TLSv1"
           keystoreFile="../conf/mykey.keystore" keystorePass="changeit"
           truststoreFile="../conf/mytruststore.keystore" truststorePass="changeit"/>

以上就是利用keytools为tomcat 7配置SSL双向认证的方法的完整攻略。