Remember the process of configuring tomcat's https self-signed certificate in Linux due to various needs:
Introduction to SSL certificate
1. Publicly trusted certification authority
such as CA, but the application is generally charged, usually several hundred to several thousand per year.
You can here Let me introduce to you that Tencent Cloud currently has a free one-year CA certificate service, which you can use.
2. Generate it yourself
. Although the security is not that high, the cost is low. I am just doing a test at the moment, so this article talks about self-generation.
Certificate configuration process
1. Environment preparation
In order to successfully configure https, you need to have the following environment:
java jdk
tomcat
2. JKS format certificate generation
1). Open your terminal or command line and enter:
keytool -genkey -v -alias testKey -keyalg RSA -validity 3650 -keystore /tomcat/tomcat/test.keystore
Command explanation:
alias: alias here I named testKey
keyalg: certificate algorithm, RSA
validity: certificate validity time, 10 years
keystore: target path and file name of certificate generation, just replace it with your own path, I defined /tomcat /tomcat/test.keystore
2) Press Enter, and you will be asked to enter some information. It is best to enter the same keystore password and secret password, and write down this password. You can fill in the rest
3. Configure https in tomcat
1). Upload the keystore certificate to your tomcat server (if your tomcat is local, you can not move it), and note the path of the certificate. 2)
. cd to the conf directory of tomcat, open the server.xml file, search for https and find the following item:
去掉注释，并将keystoreFile和keystorePass处替换成你自己的证书路径和生成证书时的口令即可.
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keystoreFile="你的keystore路径" keystorePass="生成证书时的口令" />
Only modify this one place, no need to change other places.
Start tomcat, and then you can use https and port 8443 to test access:
