Debian Tomcat SSL证书怎么配置

Here’s a step-by-step guide to configuring SSL certificates for Tomcat on Debian:

1. Install Tomcat and OpenSSL

First, update your package list and install Tomcat (e.g., Tomcat 9) and OpenSSL:

sudo apt update
sudo apt install tomcat9 openssl

2. Generate an SSL Certificate

You can use OpenSSL to create a self-signed certificate (for testing) or obtain one from a trusted Certificate Authority (CA) like Let’s Encrypt (for production).

Option A: Generate a Self-Signed Certificate

Run the following command to generate a 2048-bit RSA key and self-signed certificate valid for 365 days:

sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/tomcat-selfsigned.key \
  -out /etc/ssl/certs/tomcat-selfsigned.crt

• Key prompts: Fill in details like country, state, organization, and domain name (e.g., localhost for testing).
• Files: The private key (tomcat-selfsigned.key) and certificate (tomcat-selfsigned.crt) are saved in /etc/ssl/.

Option B: Use a CA-Issued Certificate

If you have a certificate from a CA (e.g., your_domain.crt and your_domain.key), place them in a secure directory (e.g., /etc/ssl/certs/ and /etc/ssl/private/ respectively).

3. Create a Java Keystore (JKS)

Tomcat requires SSL certificates to be in a Java Keystore (JKS) or PKCS12 format. Convert your certificate and key into a JKS file:

For Self-Signed Certificates

sudo keytool -import -alias tomcat \
  -file /etc/ssl/certs/tomcat-selfsigned.crt \
  -keystore /etc/ssl/certs/tomcat-selfsigned.jks \
  -storepass your_keystore_password

• Alias: Use a memorable name (e.g., tomcat).
• Keystore Password: Set a strong password (replace your_keystore_password).

For CA-Issued Certificates

If your CA provides a .crt and .key file, first combine them into a PKCS12 file, then import into JKS:

sudo openssl pkcs12 -export \
  -in /etc/ssl/certs/your_domain.crt \
  -inkey /etc/ssl/private/your_domain.key \
  -out /etc/ssl/private/tomcat.pfx \
  -name tomcat -CAfile /etc/ssl/certs/ca-bundle.crt \
  -caname root

sudo keytool -importkeystore \
  -deststorepass your_keystore_password \
  -destkeypass your_key_password \
  -destkeystore /etc/ssl/certs/tomcat.jks \
  -srckeystore /etc/ssl/private/tomcat.pfx \
  -srcstoretype PKCS12 \
  -srcstorepass your_pfx_password \
  -alias tomcat

4. Configure Tomcat’s server.xml

Edit the Tomcat configuration file to enable HTTPS. Open /etc/tomcat9/server.xml in a text editor:

sudo nano /etc/tomcat9/server.xml

Find and Modify the Connector

Locate the commented-out HTTPS connector (near the bottom of the file) and replace it with:

<Connector 
  port="8443" 
  protocol="org.apache.coyote.http11.Http11NioProtocol"
  maxThreads="150" 
  SSLEnabled="true"
  scheme="https" 
  secure="true"
  keystoreFile="/etc/ssl/certs/tomcat-selfsigned.jks"  <!-- Path to your JKS file -->
  keystorePass="your_keystore_password"              <!-- Keystore password -->
  clientAuth="false"                                 <!-- Set to "true" for mutual SSL -->
  sslProtocol="TLS"                                  <!-- Use TLS 1.2+ -->
/>

• Port: Change 8443 to 443 (default HTTPS port) if you want to avoid specifying the port in URLs.
• Keystore File: Update the path to your JKS file.
• Keystore Password: Replace with your actual password.

Optional: Disable HTTP (Force HTTPS)

To redirect all HTTP traffic to HTTPS, add a security-constraint to your web application’s web.xml (e.g., /var/lib/tomcat9/webapps/your_app/WEB-INF/web.xml):

<security-constraint>
  <web-resource-collection>
    <web-resource-name>Protected Context</web-resource-name>
    <url-pattern>/*</url-pattern>
  </web-resource-collection>
  <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
  </user-data-constraint>
</security-constraint>

5. Restart Tomcat

Apply the changes by restarting the Tomcat service:

sudo systemctl restart tomcat9

6. Verify the SSL Configuration

Open a browser and navigate to:

• Self-Signed Certificate: https://your_server_ip:8443 (you’ll see a security warning—ignore it for testing).
• CA-Issued Certificate: https://your_domain.com (no warning if the certificate is valid).

Check for the padlock icon in the address bar, indicating a secure connection.

Optional: Firewall Configuration

If you’re using UFW (Uncomplicated Firewall), allow HTTPS traffic:

sudo ufw allow 8443/tcp  # For port 8443
# OR
sudo ufw allow 443/tcp   # For port 443 (default HTTPS)

Troubleshooting Tips

• Certificate Errors: Ensure the certificate’s domain name matches your server’s hostname (or use a wildcard certificate for subdomains).
• Port Issues: Verify that the Tomcat connector port (e.g., 8443) is open in your firewall.
• Keystore Problems: Double-check the keystore path, password, and alias in server.xml. Use keytool -list -keystore /path/to/keystore.jks to verify the keystore contents.

By following these steps, you’ll successfully configure SSL for Tomcat on Debian, enabling encrypted communication between clients and your server.