1、tomcat 配置Https，server.xml
<Connector
protocol="org.apache.coyote.http11.Http11Protocol"
port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
keystoreFile="D:/SSL/key/sslserverkeys.keystore" keystorePass="changeit" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,SSLv2Hello"
/>
keystore:
tomcat 支持双向或者单向认证，单向认证是客户端认证服务器端，将服务器端的keystore导出成cer文件，再将cer文件导入到客户端keystore,将客户端信任keystore,设置到客户端jvm信任库中；操作步骤如下：
1、E:\Java\jdk1.7.0_45\bin>keytool -genkeypair -dname "CN=lsy, OU=yiyang, O=yiyang,
L=bj,S=bj, C=CN" -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -
keyalg RSA -storepass changeit -keypass changeit -validity 365 -ext ip:127.0.0.1
2、keytool -exportcert -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -file d:\SSL\key\sslserver.cer
3、 keytool -import -alias sslserver -keystore D:\SSL\key\sslclienttrust.keystore -file d:\SSL\key\sslserver.cer
4、客户端代码
System.setProperty("javax.net.ssl.trustStore", "D:/SSL/key/sslclienttrust.keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("https.protocols", "TLSv1,SSLv2Hello");
配置过程中注意的是：
1）客户端和服务器端握手的使用的协议要匹配，如果不匹配请进行配置，客户端配置如：
System.setProperty("https.protocols", "TLSv1,SSLv2Hello");
服务器端配置是：
sslEnabledProtocols="TLSv1,SSLv2Hello"
服务器和客户端只有使用的SSL通信协议一致，才能保证客户端和服务器正常
2）tomcat 只实现了 -storepass 密码和-keypass一致，否则是认证不成功的，所以再生成证书的时两者确保一致
3）生成证书时：确保使用jdk 1.7 -ext 扩展属性(jdk1.6不支持此属性)，添加 san=ip:127.0.0.1，否则客户端是认证不成功
tomcat 配置webservice
配置webService 注意事项：
By default, Tomcat does not comes with any JAX-WS dependencies, So, you have to include it manually.
1. Go here http://jax-ws.java.net/.
2. Download JAX-WS RI distribution.
3. Unzip it and copy following JAX-WS dependencies to Tomcat library folder “{$TOMCAT}/lib“.
- jaxb-impl.jar
- jaxws-api.jar
- jaxws-rt.jar
- gmbal-api-only.jar
- management-api.jar
- stax-ex.jar
- streambuffer.jar
- policy.jar
java.net.ssl 重写实现，可以再使用httpsConnection 之前进行设置，如果证书ok,可以不实用，如果证书不规范，则可以使用规避一些错误：代码是
package ssl.test; import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSession; public class MySocketFactory { public static void trustAll(){
try {
trustAllHttpsCertificates();
HostnameVerifier hv = new HostnameVerifier() {
public boolean verify(String urlHostName, SSLSession session) {
System.out.println("Warning: URL Host: " + urlHostName + " vs. "
+ session.getPeerHost());
return true;
}
}; HttpsURLConnection.setDefaultHostnameVerifier(hv); } catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
} private static void trustAllHttpsCertificates() throws Exception { javax.net.ssl.TrustManager[] trustAllCerts = new javax.net.ssl.TrustManager[1];
javax.net.ssl.TrustManager tm = new miTM();
trustAllCerts[0] = tm;
javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext
.getInstance("SSL");
sc.init(null, trustAllCerts, null);
javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc
.getSocketFactory());
} static class miTM implements javax.net.ssl.TrustManager,
javax.net.ssl.X509TrustManager {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return new java.security.cert.X509Certificate[0];
} public boolean isServerTrusted(
java.security.cert.X509Certificate[] certs) {
return false;
} public boolean isClientTrusted(
java.security.cert.X509Certificate[] certs) {
return true;
} public void checkServerTrusted(
java.security.cert.X509Certificate[] certs, String authType)
throws java.security.cert.CertificateException {
return;
} public void checkClientTrusted(
java.security.cert.X509Certificate[] certs, String authType)
throws java.security.cert.CertificateException {
return;
}
}
}
Https WebService 拨测查到的资料：
Deploy JAX-WS web services on Tomcat
keytool - Key and Certificate Management Tool