java keytool
2015-07-24 16:05
615 查看
1、tomcat 配置Https,server.xml
keystore:
tomcat 支持双向或者单向认证,单向认证是客户端认证服务器端,将服务器端的keystore导出成cer文件,再将cer文件导入到客户端keystore,将客户端信任keystore,设置到客户端jvm信任库中;操作步骤如下:
1、E:\Java\jdk1.7.0_45\bin>keytool -genkeypair -dname "CN=lsy, OU=yiyang, O=yiyang,
L=bj,S=bj, C=CN" -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -
keyalg RSA -storepass changeit -keypass changeit -validity 365 -ext ip:127.0.0.1
2、keytool -exportcert -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -file d:\SSL\key\sslserver.cer
3、 keytool -import -alias sslserver -keystore D:\SSL\key\sslclienttrust.keystore -file d:\SSL\key\sslserver.cer
4、客户端代码
System.setProperty("javax.net.ssl.trustStore", "D:/SSL/key/sslclienttrust.keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("https.protocols", "TLSv1,SSLv2Hello");
配置过程中注意的是:
1)客户端和服务器端握手的使用的协议要匹配,如果不匹配请进行配置,客户端配置如:
System.setProperty("https.protocols", "TLSv1,SSLv2Hello");
服务器端配置是:
sslEnabledProtocols="TLSv1,SSLv2Hello"
服务器和客户端只有使用的SSL通信协议一致,才能保证客户端和服务器正常
2)tomcat 只实现了 -storepass 密码和-keypass一致,否则是认证不成功的,所以再生成证书的时两者确保一致
3)生成证书时:确保使用jdk 1.7 -ext 扩展属性(jdk1.6不支持此属性),添加 san=ip:127.0.0.1,否则客户端是认证不成功
tomcat 配置webservice
配置webService 注意事项:
By default, Tomcat does not comes with any JAX-WS dependencies, So, you have to include it manually.
1. Go here http://jax-ws.java.net/.
2. Download JAX-WS RI distribution.
3. Unzip it and copy following JAX-WS dependencies to Tomcat library folder “{$TOMCAT}/lib“.
jaxb-impl.jar
jaxws-api.jar
jaxws-rt.jar
gmbal-api-only.jar
management-api.jar
stax-ex.jar
streambuffer.jar
policy.jar
java.net.ssl 重写实现,可以再使用httpsConnection 之前进行设置,如果证书ok,可以不实用,如果证书不规范,则可以使用规避一些错误:代码是
View Code
Https WebService 拨测查到的资料:
Java SSL/TLS 安全通讯协议介绍
<Connector protocol="org.apache.coyote.http11.Http11Protocol" port="8443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true" keystoreFile="D:/SSL/key/sslserverkeys.keystore" keystorePass="changeit" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,SSLv2Hello" />
keystore:
tomcat 支持双向或者单向认证,单向认证是客户端认证服务器端,将服务器端的keystore导出成cer文件,再将cer文件导入到客户端keystore,将客户端信任keystore,设置到客户端jvm信任库中;操作步骤如下:
1、E:\Java\jdk1.7.0_45\bin>keytool -genkeypair -dname "CN=lsy, OU=yiyang, O=yiyang,
L=bj,S=bj, C=CN" -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -
keyalg RSA -storepass changeit -keypass changeit -validity 365 -ext ip:127.0.0.1
2、keytool -exportcert -alias sslserver -keystore d:\SSL\key\sslserverkeys.keystore -file d:\SSL\key\sslserver.cer
3、 keytool -import -alias sslserver -keystore D:\SSL\key\sslclienttrust.keystore -file d:\SSL\key\sslserver.cer
4、客户端代码
System.setProperty("javax.net.ssl.trustStore", "D:/SSL/key/sslclienttrust.keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("https.protocols", "TLSv1,SSLv2Hello");
配置过程中注意的是:
1)客户端和服务器端握手的使用的协议要匹配,如果不匹配请进行配置,客户端配置如:
System.setProperty("https.protocols", "TLSv1,SSLv2Hello");
服务器端配置是:
sslEnabledProtocols="TLSv1,SSLv2Hello"
服务器和客户端只有使用的SSL通信协议一致,才能保证客户端和服务器正常
2)tomcat 只实现了 -storepass 密码和-keypass一致,否则是认证不成功的,所以再生成证书的时两者确保一致
3)生成证书时:确保使用jdk 1.7 -ext 扩展属性(jdk1.6不支持此属性),添加 san=ip:127.0.0.1,否则客户端是认证不成功
tomcat 配置webservice
配置webService 注意事项:
By default, Tomcat does not comes with any JAX-WS dependencies, So, you have to include it manually.
1. Go here http://jax-ws.java.net/.
2. Download JAX-WS RI distribution.
3. Unzip it and copy following JAX-WS dependencies to Tomcat library folder “{$TOMCAT}/lib“.
jaxb-impl.jar
jaxws-api.jar
jaxws-rt.jar
gmbal-api-only.jar
management-api.jar
stax-ex.jar
streambuffer.jar
policy.jar
java.net.ssl 重写实现,可以再使用httpsConnection 之前进行设置,如果证书ok,可以不实用,如果证书不规范,则可以使用规避一些错误:代码是
package ssl.test; import javax.net.ssl.HostnameVerifier; import javax.net.ssl.HttpsURLConnection; import javax.net.ssl.SSLSession; public class MySocketFactory { public static void trustAll(){ try { trustAllHttpsCertificates(); HostnameVerifier hv = new HostnameVerifier() { public boolean verify(String urlHostName, SSLSession session) { System.out.println("Warning: URL Host: " + urlHostName + " vs. " + session.getPeerHost()); return true; } }; HttpsURLConnection.setDefaultHostnameVerifier(hv); } catch (Exception e) { // TODO Auto-generated catch block e.printStackTrace(); } } private static void trustAllHttpsCertificates() throws Exception { javax.net.ssl.TrustManager[] trustAllCerts = new javax.net.ssl.TrustManager[1]; javax.net.ssl.TrustManager tm = new miTM(); trustAllCerts[0] = tm; javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext .getInstance("SSL"); sc.init(null, trustAllCerts, null); javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc .getSocketFactory()); } static class miTM implements javax.net.ssl.TrustManager, javax.net.ssl.X509TrustManager { public java.security.cert.X509Certificate[] getAcceptedIssuers() { return new java.security.cert.X509Certificate[0]; } public boolean isServerTrusted( java.security.cert.X509Certificate[] certs) { return false; } public boolean isClientTrusted( java.security.cert.X509Certificate[] certs) { return true; } public void checkServerTrusted( java.security.cert.X509Certificate[] certs, String authType) throws java.security.cert.CertificateException { return; } public void checkClientTrusted( java.security.cert.X509Certificate[] certs, String authType) throws java.security.cert.CertificateException { return; } } }
View Code
Https WebService 拨测查到的资料:
Java SSL/TLS 安全通讯协议介绍
Deploy JAX-WS web services on Tomcat
keytool - Key and Certificate Management ToolTomcat 7 getting SSLv2Hello is disabled error when trying to make client server ssl authntication
相关文章推荐
- Java中方法的重载
- Eclipse中安装Velocity插件
- java分割面板的应用
- JAVA基础拾遗-论线程池的线程粒度划分与深浅放置
- java随机生成一个名字和对应拼音的方法
- struts2.3详细配置
- Javadoc转换chm的方法及工具
- 如何将java程序设置为服务程序
- java类的初始化和构造函数
- maven项目调试Junit类
- 【Struts2学习笔记(3)】至Action注入属性值
- 【Java】final, finally, finalize()
- java.lang.String 的 split() 方法, JDK 1.4 or later
- 运用struts2 fileUpload上传文件
- ERROR: JAVA_HOME is set to an invalid directory
- Java Synchronized与wait notify 连用-2 简化版
- java web开发工程师 对面向对象思想 的不理解
- 转: java学习路线图
- spring MVC自学第一章
- JavaCard——APDU的结构分析