https 證書生產及服務器配置

# 單向認證


## server端


step1：爲服務端生成祕鑰庫


```
sudo keytool -genkeypair -alias server_key_pair_1 -validity 365 -keyalg RSA -keystore /usr/local/crm_keystore/server/carfinance.crm.server.keystore


"Enter keystore password"，輸入要設置的keystore的password，例如輸入"carCrm747"


"Re-enter new password:"，重複輸入"carCrm747"


"What is your first and last name?"，注意要輸入的是服務的域名或者機器名等，例如輸入"localhost"


"What is the name of your organizational unit?"，輸入無特殊要求，例如輸入"carfinance"


"What is the name of your organization?"，輸入無特殊要求，例如輸入"mljr"


"What is the name of your City or Locality?"，輸入無特殊要求，例如輸入"beijing"


"What is the name of your State or Province?"，輸入無特殊要求，例如輸入"beijing"


"What is the two-letter country code for this unit?"，輸入無特殊要求，例如輸入"cn"


"Enter key password for <server_key_pair_1> (RETURN if same as keystore password):"，注意server_key_pair_1這個祕鑰的password必須和keystore保持一致，所以此處直接回車即可
```


step2：tomcat配置


修改tomcat的server.xml，將下面這段


```
<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
     This connector uses the NIO implementation that requires the JSSE
     style configuration. When using the APR/native implementation, the
     OpenSSL style configuration is required as described in the APR/native
     documentation -->
<!--
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
    maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"/>
-->
```


改爲


```
<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
     This connector uses the NIO implementation that requires the JSSE
     style configuration. When using the APR/native implementation, the
     OpenSSL style configuration is required as described in the APR/native
     documentation -->
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
    maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS" 
    keystoreFile="/usr/local/crm_keystore/server/carfinance.crm.server.keystore" keystorePass="carCrm747"/>
```


注意clientAuth="false"表示是單向認證，keystoreFile的值設爲服務端keystore的路徑，keystorePass是服務端keyStore的密碼


## cleint端


無特殊配置


## 驗證


step1：用修改過配置後的tomcat啓動carfinance-crm-httpsdemo-server模塊


step2：使用客戶端調用服務端接口


運行carfinance-crm-httpsdemo-client模塊的src/test/java目錄下的UnilateralHttpsClientTest的testGet()和testPost()方法分別測試https的GET請求和https的POST請求


# 雙向認證


## server端


step1：爲服務端生成祕鑰庫，注意事項和單向認證的step1相同


```
sudo keytool -genkeypair -alias server_key_pair_1 -validity 365 -keyalg RSA -keystore /usr/local/crm_keystore/server/carfinance.crm.server.keystore
```


keystore的password設置爲"carCrm747"


step2：導出服務端證書


```
sudo keytool -export -alias server_key_pair_1 -validity 365 -file /usr/local/crm_keystore/server/server_key_1.crt -keystore /usr/local/crm_keystore/server/carfinance.crm.server.keystore
```


需要輸入keystore密碼，輸入"carCrm747"


step3：用客戶端證書生產服務端信任證書庫（客戶端證書的生成參考後面的client端部分，這個步驟要在客戶端生成證書完成之後進行）


```
sudo keytool -import -alias client_crt -validity 365 -file /usr/local/crm_keystore/client/client_key_1.crt -keystore /usr/local/crm_keystore/server/carfinance.crm.server.truststore
```


注意這個步驟要爲truststore設置密碼，例如設爲"890890"


step4：tomcat配置
      
修改tomcat的server.xml，將下面這段
      
```
<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
    This connector uses the NIO implementation that requires the JSSE
    style configuration. When using the APR/native implementation, the
    OpenSSL style configuration is required as described in the APR/native
    documentation -->
<!--
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
    maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"/>
-->
```
      
改爲


```
<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
    This connector uses the NIO implementation that requires the JSSE
    style configuration. When using the APR/native implementation, the
    OpenSSL style configuration is required as described in the APR/native
    documentation -->
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
    maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
    clientAuth="true" sslProtocol="TLS"
    keystoreFile="/usr/local/crm_keystore/server/carfinance.crm.server.keystore" keystorePass="carCrm747"
    truststoreFile="/usr/local/crm_keystore/server/carfinance.crm.server.truststore" truststorePass="890890"/>
```


注意clientAuth="true"表示是雙向認證，keystoreFile的值設爲服務端keystore的路徑，keystorePass是服務端keyStore的密碼，truststoreFile是服務端truststore的路徑，truststorePass是服務端truststore的密碼


## cleint端


step1：爲客戶端生成祕鑰庫


```
sudo keytool -genkeypair -alias client_key_pair_1 -validity 365 -keyalg RSA -keystore /usr/local/crm_keystore/client/carfinance.crm.client.keystore


"Enter keystore password"，輸入要設置的keystore的password，例如輸入"123456"


"Re-enter new password:"，重複輸入"123456"


"What is your first and last name?"，輸入無特殊要求，例如輸入"httpsdemo-client"


"What is the name of your organizational unit?"，輸入無特殊要求，例如輸入"carfinance"


"What is the name of your organization?"，輸入無特殊要求，例如輸入"mljr"


"What is the name of your City or Locality?"，輸入無特殊要求，例如輸入"beijing"


"What is the name of your State or Province?"，輸入無特殊要求，例如輸入"beijing"


"What is the two-letter country code for this unit?"，輸入無特殊要求，例如輸入"cn"


"Enter key password for <client_key_pair_1> (RETURN if same as keystore password):"，輸入無特殊要求，例如直接回車使用和keystore相同的祕鑰
```


step2：導出客戶端證書


```
sudo keytool -export -alias client_key_pair_1 -validity 365 -file /usr/local/crm_keystore/client/client_key_1.crt -keystore /usr/local/crm_keystore/client/carfinance.crm.client.keystore
```


需要輸入keystore密碼，輸入"123456"


step3：用服務端證書生成客戶端信任證書庫（服務端證書的生成參考前面的server端部分，這個步驟要在服務端生成證書完成之後進行）


```
sudo keytool -import -alias server_crt -validity 365 -file /usr/local/crm_keystore/server/server_key_1.crt -keystore /usr/local/crm_keystore/client/carfinance.crm.client.truststore
```


注意這個步驟要爲truststore設置密碼，例如設爲"654321"


## 驗證


step1：用修改過配置後的tomcat啓動carfinance-crm-httpsdemo-server模塊


step2：使用客戶端調用服務端接口


運行carfinance-crm-httpsdemo-client模塊的src/test/java目錄下的UnilateralHttpsClientTest的testGet()和testPost()方法分別測試https的GET請求和https的POST請求，請求失敗，因爲沒有提供服務端信任的客戶端證書給服務端


運行carfinance-crm-httpsdemo-client模塊的src/test/java目錄下的MutualHttpsClientTest的testGet()和testPost()方法分別測試https的GET請求和https的POST請求，請求成功


# 參考


[http client官網](http://hc.apache.org/)


[troubleshoot: httpclient向HTTPS發送數據建立SSL連接時的異常](http://zhuyuehua.iteye.com/blog/1102347)


[troubleshoot: 單向認證中信任自簽名證書](http://stackoverflow.com/questions/1828775/how-to-handle-invalid-ssl-certificates-with-apache-httpclient)


[java tomcat 搭建SSL雙向認證以及httpclient代碼](http://ian.wang/118.htm)


[java tomcat 搭建SSL雙向認證以及httpclient代碼](http://yuur369.iteye.com/blog/1728058)


[HttpClient如何訪問需要提交客戶端證書的SSL服務](http://blog.csdn.net/wanglha/article/details/49272551)


[keystore type的使用](http://stackoverflow.com/questions/11536848/keystore-type-which-one-to-use)