tomcat自签证书以及http跳转https

0x1 自签证书生成

使用java的命令：

keytool -genkey -alias webgis -keyalg RSA -keypass gisplatform -storepass gisplatform -keysize 2048 -keystore webgis.keystore -validity 7300
keytool -export -alias webgis -storepass gisplatform -file webgis.cer -keystore webgis.keystore
keytool -import -trustcacerts -alias webgis -storepass gisplatform -file webgis.cer -keystore cacerts

server.xml 配置证书

keystoreFile="D:\apache-tomcat-8.5.15\bin\webgis.keystore"
keystorePass="gisplatform"
truststoreFile="D:\apache-tomcat-8.5.15\bin\cacerts"

server.xml 配置tls版本以及加密套件，其中useServerCipherSuitesOrder="true"很重要，要优先使用服务端的顺序

<Connector port="8443"  protocol="user.Http11Protocol"
    SSLEnabled="true" sslEnabledProtocols="TLSv1,TLSv1.2"
    useServerCipherSuitesOrder="true"     
    ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
        TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
        TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
        TLS_RSA_WITH_AES_128_CBC_SHA256,
        TLS_RSA_WITH_AES_128_CBC_SHA,
        TLS_RSA_WITH_AES_128_GCM_SHA256,
        TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
        TLS_DHE_RSA_WITH_AES_256_CBC_SHA"
    scheme="https" secure="true" clientAuth="false"
    connectionTimeout="20000"
    redirectPort="8443"
    URIEncoding="UTF-8"
    keystoreFile="keystore.jks"
    keystorePass="password" />

0x2 http跳转https

tomcat默认配置了https是会共存http的，所以需要修改配置，使得访问http的时候自动跳转到https页面，修改web.xml

<security-constraint>
<web-resource-collection>
<web-resource-name>SSL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>