快速安裝Tomcat 並實現HTTPS訪問
阿新 • • 發佈：2018-04-14
SSL Tomcat HTTPS HTTPS，在HTTP下加了一層SSL，用於安全的HTTP數據傳輸，對於數據敏感的網址必須要使用HTTPS協議，本文將介紹如何快速安裝Tomcat，並實現HTTPS訪問。
安裝Tomcat
安裝tomcat必須得有java環境，所以先安裝JDK；
1、安裝JDK
[root@node1 ~]# rpm -ivh jdk-8u161-linux-x64.rpm Preparing... ########################################### [100%] 1:jdk1.8 ########################################### [100%] Unpacking JAR files... tools.jar... plugin.jar... javaws.jar... deploy.jar... rt.jar... jsse.jar... charsets.jar... localedata.jar... [root@node1 ~]#
2、添加Java系統環境變量
[root@node1 ~]# cat /etc/profile.d/java.sh
export JAVA_HOME=/usr/java/latest
export PATH=$JAVE_HOME/bin:$PATH
[root@node1 ~]# 3、加載環境變量
[root@node1 ~]# . /etc/profile.d/java.sh4、查看JDK是否安裝成功
[root@node1 ~]# java -version java version "1.8.0_161" Java(TM) SE Runtime Environment (build 1.8.0_161-b12) Java HotSpot(TM) 64-Bit Server VM (build 25.161-b12, mixed mode) [root@node1 ~]#
5、安裝Tomcat
[root@node1 ~]# tar -zxf apache-tomcat-8.0.50.tar.gz -C /usr/local/6、創建軟連接
[root@node1 ~]# ln -s /usr/local/apache-tomcat-8.0.50/ /usr/local/tomcat7、添加Tomcat系統環境變量
[root@node1 ~]# cat /etc/profile.d/tomcat.sh
export CATALINA_HOME=/usr/local/tomcat
export PATH=$CATALINA_HOME/bin:$PATH8、加載環境變量
[root@node1 ~]# . /etc/profile.d/tomcat.sh
9、測試是否生效
[root@node1 ~]# catalina.sh version
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr/java/latest
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
Server version: Apache Tomcat/8.0.50
Server built: Feb 7 2018 20:06:05 UTC
Server number: 8.0.50.0
OS Name: Linux
OS Version: 2.6.32-642.6.2.el6.x86_64
Architecture: amd64
JVM Version: 1.8.0_161-b12
JVM Vendor: Oracle Corporation
[root@node1 ~]# 10、啟動Tomcat服務
[root@node1 ~]# catalina.sh start
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr/java/latest
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
Tomcat started.11、測試訪問
Tomcat默認端口為8080，所以訪問時使用IP+8080訪問即可；
★ 到這裏，Tomcat就安裝完成了，但是只是默認環境，還需要根據需求自定義配置；
實現HTTPS訪問
1、添加域名解析
到自己的域名解析商處，添加一條A記錄指向你的服務器IP即可；
2、申請證書
使用剛才添加的域名申請一個SSL證書；
3、上傳證書
在tomcat目錄新建一個ssl目錄，將證書文件上傳到這個目錄；
[root@node1 ~]# cd /usr/local/tomcat/
[root@node1 tomcat]# mkdir ssl
[root@node1 tomcat]# rz4、修改server.xml
VIM打開server.xml，添加ssl連接器，在8080端口連接器下面添加如下配置：
<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
keystoreFile="/usr/local/tomcat/ssl/YourDomain.jks"
keystorePass="SSLPass"
clientAuth="false" sslProtocol="TLS" />註意：
keystoreFile ：證書存放目錄，可以寫絕對路徑或Tomcat相對路徑；
keystorePass：證書私鑰密碼；5、修改HOST配置
<Engine name="Catalina" defaultHost="localhost">
## 這裏指定的localhost是默認HOST的名稱，修改為證書綁定的域名即可
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- Use the LockOutRealm to prevent attempts to guess user passwords
via a brute-force attack -->
<Realm className="org.apache.catalina.realm.LockOutRealm">
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
</Realm>
<Host name="localhost" appBase="webapps"
### 將這裏的localhost修改Wie剛才添加解析的域名即可，且必須與證書的通用名稱保持一致
unpackWARs="true" autoDeploy="true">
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html
Note: The pattern used is equivalent to using pattern="common" -->
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log" suffix=".txt"
pattern="%h %l %u %t "%r" %s %b" />
</Host>★這裏只需要將裏兩個localhost修改為證書綁定域名即可，也就是是將該域名與此HOST綁定；
6、重啟Tomcat服務
[root@node1 tomcat]# catalina.sh stop
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr/java/latest
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
[root@node1 tomcat]# catalina.sh start
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr/java/latest
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
Tomcat started.7、查詢端口是否監聽
[root@node1 tomcat]# ss -ntl
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 1 127.0.0.1:8005 *:*
LISTEN 0 100 *:8009 *:*
LISTEN 0 100 *:8080 *:*
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 100 *:443 *:*
[root@node1 tomcat]# 8、測試訪問
使用https://YourDomain/ 來訪問；
★用瀏覽器訪問顯示小綠鎖，F12查看，提示：This is secure (valid HTTPS)，說明證書已經配置成功；
配置HTTP自動跳轉到HTTPS
上面我們實現了HTTPS訪問，但是客戶使用http訪問，還是會走http協議，依然是不安全的，沒有達到我們的需求，下面配置HTTP自動跳轉到HTTPS；
1、修改web.xml
在</welcome-file-list>後面，也就是倒數第二行裏，加上如下配置：
<login-config>
<!-- Authorization setting for SSL -->
<auth-method>CLIENT-CERT</auth-method>
<realm-name>Client Cert Users-only Area</realm-name>
</login-config>
<security-constraint>
<!-- Authorization setting for SSL -->
<web-resource-collection>
<web-resource-name>SSL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>2、修改sever.xml
修改非SSL連接器的請求跳轉到SSL連接器上，修改如下配置：
原來為：
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
修改為：
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="443" />★將默認8080端口修改為80端口，訪問時就不需要加8080端口了，因為HTTP協議默認走的是80端口；
★將8443端口修改為443端口，意思是來自80端口的請求都跳轉至443端口；
3、重啟服務
[root@node1 conf]# catalina.sh stop
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr/java/latest
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
[root@node1 conf]# catalina.sh start
Using CATALINA_BASE: /usr/local/tomcat
Using CATALINA_HOME: /usr/local/tomcat
Using CATALINA_TMPDIR: /usr/local/tomcat/temp
Using JRE_HOME: /usr/java/latest
Using CLASSPATH: /usr/local/tomcat/bin/bootstrap.jar:/usr/local/tomcat/bin/tomcat-juli.jar
Tomcat started.4、檢測端口
查看端口，發現原來監聽的8080端口已經沒在了，而是監聽的我們上面修改的80端口；
[root@node1 conf]# ss -nlt
State Recv-Q Send-Q Local Address:Port Peer Address:Port
LISTEN 0 100 *:8009 *:*
LISTEN 3 100 *:80 *:*
LISTEN 0 128 *:22 *:*
LISTEN 0 100 127.0.0.1:25 *:*
LISTEN 0 100 *:443 *:*
[root@node1 conf]# 5、測試訪問
這裏我們使用linux下的curl命令測試，能更直觀的看到跳轉效果；
[root@node1 ~]# curl http://YourDomain/ -I
HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Cache-Control: private
Expires: Thu, 01 Jan 1970 08:00:00 CST
Location: https://YourDomain/
Transfer-Encoding: chunked
Date: Fri, 13 Apr 2018 16:06:04 GMT
★ 到這裏，Tomcat配置HTTP自動跳轉HTTPS就已經完成了~
快速安裝Tomcat 並實現HTTPS訪問