Nginx+Tomcat+HTTPS

tomcat配置HTTPS

Tomcat只支持JKS, PKCS11 和 PKCS12格式的keystores。JKS是Java标准格式Java KeyStore的缩写，可以使用Java自带的keytool工具创建；PKCS12是互联网的标准，能够使用OpenSSL或Key-Manager(Microsoft)生成。

使用新的证书

对于PKCS11 和 PKCS12，可以使用阿里云或腾讯云提供的服务。为简单起见，本文主要介绍JKS

JKS

1. 创建证书

Windows

keytool -genkey -alias tomcat -keyalg RSA

Linux

keytool -genkey -alias tomcat -keyalg RSA

证书默认保存在用户根目录，可以使用-keystore选项指定证书的生成位置。

配置Tomcat

Tomcat使用两种不同方式实现SSL

1. JSSE
2. APR

需要确保 <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" SSLRandomSeed="builtin" />开启

以下以JSSE方式进行配置

JSSE

protocol使用org.apache.coyote.http11.Http11NioProtocol

示例为：

<!-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->
<Connector
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="8443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="${user.home}/.keystore" keystorePass="changeit"
           clientAuth="false" sslProtocol="TLS"/>

重点是keystoreFile，其值为.keystore；keystorePass为创建证书时的密码

结束

至此Tomcat的HTTPS已经配置完成，访问https://localhost:8443/测试。也可以使用https://localhost:8080/测试

Nginx配置HTTPS并代理Tomcat

nginx在安装时需要开启SSL，也就是添加--with-openssl选项

./configure --prefix=/data/nginx/nginx-1.12.2 --sbin-path=/data/nginx/nginx-1.12.2/bin --conf-path=/data/nginx/nginx-1.12.2/conf/nginx.conf --pid-path=/data/nginx/nginx-1.12.2/pid/nginx.pid --with-http_realip_module --with-http_sub_module --with-http_flv_module --with-http_dav_module --with-http_gzip_static_module --with-http_stub_status_module --with-http_ssl_module --with-http_addition_module --with-pcre=/data/nginx/pcre-8.39 --with-zlib=/data/nginx/zlib-1.2.11 --with-openssl=/data/nginx/openssl-1.0.2

#user  nobody;
worker_processes  1;

error_log  logs/error.log;

#pid        logs/nginx.pid;

events {
    worker_connections  1024;
}

http {
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;

    keepalive_timeout  65;
    
    # PUBLIC server
    upstream public_server {
        server localhost:8080 weight=1 max_fails=5 fail_timeout=30s;
    }

    # HTTP
    server {
    # define attribute
        listen       80;
        server_name  localhost;
        charset utf-8;

        # redirece https
        rewrite ^ https://$http_host$request_uri? permanent;

        # define error page
        error_page 500 502 503 504  /50x.html;
        location = /50x.html {
            access_log logs/nginx_error.log;
            root   html;
        } 

        location / {
            access_log logs/nginx_server.log;
            root   html;
            index  index.html index.htm;
        }
    }


    # HTTPS 
    server {
        # define attribue
        listen          443 ssl;
        server_name     localhost;
        keepalive_timeout   70;

        server_tokens off;
        fastcgi_param   HTTPS               on;
        fastcgi_param   HTTP_SCHEME         https;
        
        access_log      /usr/local/web/nginx/nginx-1.12.2/logs/wiki.xby1993.net.access.log;
        error_log       /usr/local/web/nginx/nginx-1.12.2/logs/wiki.xby1993.net.error.log;
        
        # define ssl
        ssl_certificate /usr/local/web/nginx/ssl/nginx.crt;
        ssl_certificate_key /usr/local/web/nginx/ssl/nginx.key;

        location / {
            proxy_pass http://public_server/$request_uri;
        }
    } 

}