ssl配置

apache

证书文件: xx_public.key
证书链文件:xx.chain.crt
秘钥文件: xx.key

    vim httpd.conf #需安装ssl模块，yum安装为mod_ssl,源码安装需编译。 
    LoadModule ssl_module modules/mod_ssl.so   
    Include conf/extra/httpd-ssl.conf
   
    vim httpd-ssl.conf
    SSLProtocol all -SSLv2 -SSLv3    
    SSLCipherSuite HIGH:!RC4:!MD5:!aNULL:!eNULL:!NULL:!DH:!EDH:!EXP:+MEDIUM    
    SSLHonorCipherOrder on
    SSLCertificateFile xx_public.key   
    SSLCertificateKeyFile xx.key    
    SSLCertificateChainFile xx.chain.crt
    
    #检测配置信息后重启
    apache configtest
    apache -k stop
    apache -k start

nginx

证书文件：xx.pem
秘钥文件：xx.key

    vim nginx.conf
    server {
    listen 443;
    server_name xx;  
    ssl on;  
    root html;
    index index.html index.htm;
    ssl_certificate xx.pem;   
    ssl_certificate_key xx.key;  
    ssl_session_timeout 5m;
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE:ECDH:AES:HIGH:!NULL:!aNULL:!MD5:!ADH:!RC4; 
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;   
    ssl_prefer_server_ciphers on;   
    location / {
    root html;  
    index index.html index.htm;  
      }
    }
  
    nginx -t 
    nginx -s reload

tomcat

证书文件:xx.pfx
密码文件:xx.txt

    vim server.xml
    <Connector port="8443"
    protocol="HTTP/1.1"
    SSLEnabled="true"
    scheme="https"
    secure="true"
    keystoreFile="xx.pfx"   
    keystoreType="PKCS12" 
    keystorePass="证书密码"   #查看密码文件内容
    clientAuth="false"
    SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"
    ciphers="TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256"/>
  
    #HTTP 自动跳转 HTTPS 的安全配置
    vim  web.xml
    <login-config>
   <!-- Authorization setting for SSL -->
   <auth-method>CLIENT-CERT</auth-method>
   <realm-name>Client Cert Users-only Area</realm-name>
   </login-config>
   <security-constraint>
   <!-- Authorization setting for SSL -->
   <web-resource-collection>
   <web-resource-name>SSL</web-resource-name>
   <url-pattern>/*</url-pattern>
   </web-resource-collection>
   <user-data-constraint>
   <transport-guarantee>CONFIDENTIAL</transport-guarantee>
   </user-data-constraint>
   </security-constraint>

  vim server.xml
  <Connector port="8080" protocol="HTTP/1.1"
  connectionTimeout="20000"
  redirectPort="8443" />

  #重启tomcat

pfx转为jks格式证书

  keytool -importkeystore -srckeystore domain name.pfx -destkeystore domain name.jks -srcstoretype PKCS12 -deststoretype JKS

输入PFX证书密码和JKS证书密码。