最近遇到几个小问题总结

一、Tomcat配置SSL证书实现局域网下 https 访问

申请好的证书。

1.修改 conf/server.xml

修改 tomcat 访问端口，将 8080 改为 80，在浏览器访问时不需要添加端口。将 redirectPort="8443"的端口改为 443，因为 https 的端口为 443。最终修改内容如下：

    <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned. Documentation at :
         Java HTTP Connector: /docs/config/http.html
         Java AJP  Connector: /docs/config/ajp.html
         APR (HTTP/AJP) Connector: /docs/apr.html
         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
    -->
    <Connector port="80" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="443" />

添加 ssl证书和密码，将 port 值改为 443，keystoreFile 的值为之前生成的 *.pfx文件,keystorePass的值为生成.pfx文件时输入的密码，keystoreType 的值为 pfx-password.txt 的内容，最终修改内容如下：

<!-- Define an SSL/TLS HTTP/1.1 Connector on port 8443
         This connector uses the NIO implementation. The default
         SSLImplementation will depend on the presence of the APR/native
         library and the useOpenSSL attribute of the
         AprLifecycleListener.
         Either JSSE or OpenSSL style configuration may be used regardless of
         the SSLImplementation selected. JSSE style configuration is used below.
-->
<Connector port="443"
    protocol="org.apache.coyote.http11.Http11Protocol"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    keystoreFile="D:\mkcert\mycert.pfx"
    keystoreType="PKCS12"
    keystorePass="123123"
    clientAuth="false"
    SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"
    ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>

2.修改 conf/web.xml

在 conf/web.xml的最底部，welcome-file-list 下面添加如下内容，可从 http 跳转到 https

<login-config>
	<!-- Authorization setting for SSL -->
	<auth-method>CLIENT-CERT</auth-method>
	<realm-name>Client Cert Users-only Area</realm-name>
</login-config>
<security-constraint>
	<!-- Authorization setting for SSL -->
	<web-resource-collection >
		<web-resource-name >SSL</web-resource-name>
		<url-pattern>/*</url-pattern>
	</web-resource-collection>
	<user-data-constraint>
		<transport-guarantee>CONFIDENTIAL</transport-guarantee>
	</user-data-constraint>
</security-constraint>