在EC2 Tomcat服务器上安装SSL [英] Install SSL on EC2 Tomcat server
问题描述
我正在尝试在使用Ubuntu和Tomcat 7.0.52的AWS EC2实例上使用CA证书/ SSL。浏览器无法连接。以下是我执行的步骤:
I'm trying to get a CA cert/SSL working on an AWS EC2 instance with Ubuntu and Tomcat 7.0.52. Browser's fail to connect. Here are the steps I went thru:
keytool -genkey -alias mydomain -keyalg RSA -keystore mydomain.keystore -keysize 2048
<fill out information>
keytool -certreq -keyalg RSA -alias mydomain -file certreq.csr -keystore ../mydomain.keystore
将csr提交到ssls.com/Geotrust,并收到以下回馈:
bundle.crt
www.mydomain.net.crt
submit csr to ssls.com/Geotrust, and receive back: bundle.crt www.mydomain.net.crt
将证书导入密钥库:
keytool -import -trustcacerts -alias root -keystore ../mydomain.keystore -file bundle.crt
keytool -import -alias mydomain -keystore ../mydomain.keystore -file www.mydomain.net.crt
下一步,更新$ TOMCAT_HOME / config / server.xml:
next, update $TOMCAT_HOME/config/server.xml:
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" />
<Connector port="8443" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
keystoreFile="/home/ubuntu/mydomain.keystore"
keystorePass="xxxxxxx"
clientAuth="false" sslProtocol="TLS" />
并重新启动tomcat。
and restart tomcat.
EC2实例设置了安全组以允许端口80和443。
EC2 instance with security groups are set up to allow port 80 and 443.
对ipables进行了更改,以重定向80-> 8080和443-> 8443:
ipables changes made to redirect 80->8080 and 443->8443:
sudo iptables -t nat -n -L PREROUTING --line-numbers
Chain PREROUTING (policy ACCEPT)
num target prot opt source destination
1 REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:443 redir ports 8443
2 REDIRECT tcp -- 0.0.0.0/0 0.0.0.0/0 tcp dpt:80 redir ports 8080
www.mydomain.net的DNS尚不存在,所以我当前正在使用修改后的/ etc / hosts进行测试:
DNS for www.mydomain.net is not yet in place, so I'm currently testing with a modified /etc/hosts:
54.200.126.130 www.mydomain.net
54.200.126.130 mydomain.net
sslscan不返回任何有效密码。它们都列为已拒绝。
sslscan does not return any valid ciphers. They are all listed as "Rejected".
openssl测试:
openssl test:
openssl s_client -connect www.mydomain.net:443
CONNECTED(00000003)
64007:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:602:
切换到使用keytool生成的自签名证书可以正常工作(强制性浏览器警告除外)。因此,看来问题一定出在证书和/或密钥库上,但我不确定问题是什么。
switching to a self-signed cert generated with keytool works fine (other than the obligatory browser warning). So it seems the issue must be with the certs and/or keystore, but I'm not sure what the issue is.
推荐答案
Tomat假定密钥库别名为 tomcat,除非您在 Connector上指定
只需添加 keyAlias
属性。 keyAlias = mydomain
,或者使用 keytool将别名重命名为 tomcat。
Tomat assumes a keystore alias of "tomcat" unless you specify the keyAlias
attribute on the Connector.
Just add keyAlias=mydomain
, or rename your alias to "tomcat" with the keytool.
这篇关于在EC2 Tomcat服务器上安装SSL的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!