一、準備工作：

先安裝Visual C++ 2008Redistributables (x64)，然後安裝Win64 OpenSSL v1.0.1j。這裡我安裝到D:\OpenSSL-Win64\目錄下。

解壓openssl-1.0.1j.tar.gz，找到\openssl-1.0.1j\apps目錄，拷貝demoCA目錄和openssl.cnf檔案到Openssl的安裝目錄下的bin目錄下（即D:\OpenSSL-Win64\bin\）。

3、在D:\OpenSSL-Win64\bin目錄下，建立ca、jks、server、client四個目錄。

二、開始生成證書：

開啟命令提示行（cmd.exe

並切換到Openssl安裝目錄的bin目錄下。如下圖：

依次執行下述命令。

（一）生成CA證書

1.建立私鑰：

D:\OpenSSL-Win64\bin>opensslgenrsa -out ca/ca-key.pem 1024

2.建立證書請求：

D:\OpenSSL-Win64\bin>opensslreq -new -out ca/ca-req.csr -key ca/ca-key.pem -config openssl.cnf

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:BJ

Locality Name (eg, city) []:BJ

Organization Name (eg, company) [Internet Widgits PtyLtd]:ple

Organizational Unit Name (eg, section) []:live

Common Name (eg, YOUR name) []:root

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

3.自簽署證書：

D:\OpenSSL-Win64\bin>opensslx509 -req -in ca/ca-req.csr -out ca/ca-cert.pem -signkey ca/ca-key.pem -days3650

4.將證書匯出成瀏覽器支援的.p12格式：

D:\OpenSSL-Win64\bin>opensslpkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -out ca/ca.p12

密碼：passca     

（二）生成server證書

1.建立私鑰：

D:\OpenSSL-Win64\bin>opensslgenrsa -out server/server-key.pem 1024

2.建立證書請求：

D:\OpenSSL-Win64\bin>opensslreq -new -out server/server-req.csr -key server/server-key.pem -config openssl.cnf

-----

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:BJ

Locality Name (eg, city) []:BJ

Organization Name (eg, company) [Internet Widgits PtyLtd]:ple

Organizational Unit Name (eg, section) []:live

Common Name (eg, YOUR name) []:localhost註釋：一定要寫伺服器所在的ip地址//紅色這裡是本機測試，所以我寫localhost

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

3.自簽署證書：

D:\OpenSSL-Win64\bin>opensslx509 -req -in server/server-req.csr -out server/server-cert.pem -signkeyserver/server-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial-days 3650

4.將證書匯出成瀏覽器支援的.p12格式：

D:\OpenSSL-Win64\bin>opensslpkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem-out server/server.p12

密碼：passca  

（三）生成client證書

1.建立私鑰：

D:\OpenSSL-Win64\bin>opensslgenrsa -out client/client-key.pem 1024

2.建立證書請求：

D:\OpenSSL-Win64\bin>opensslreq -new -out client/client-req.csr -key client/client-key.pem -config openssl.cnf

Country Name (2 letter code) [AU]:CN

State or Province Name (full name) [Some-State]:BJ

Locality Name (eg, city) []:BJ

Organization Name (eg, company) [Internet Widgits PtyLtd]:ple

Organizational Unit Name (eg, section) []:live

Common Name (eg, YOUR name) []:client

Email Address []:

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []:

An optional company name []:

3.自簽署證書：

D:\OpenSSL-Win64\bin>opensslx509 -req -in client/client-req.csr -out client/client-cert.pem -signkeyclient/client-key.pem -CA ca/ca-cert.pem -CAkey ca/ca-key.pem -CAcreateserial-days 3650

4.將證書匯出成瀏覽器支援的.p12格式：

D:\OpenSSL-Win64\bin>opensslpkcs12 -export -clcerts-in client/client-cert.pem -inkey client/client-key.pem -out client/client_err.p12

密碼：passca

5. 生成客戶端證書匯出成瀏覽器支援的.p12格式（用於匯入瀏覽器）：

D:\OpenSSL-Win64\bin>opensslpkcs12 -export -clcerts -in ca/ca-cert.pem -inkey ca/ca-key.pem -outclient/client.p12

密碼：passca

（四）根據ca證書生成jks檔案

D:\OpenSSL-Win64\bin>keytool -keystore D:/OpenSSL-Win64/bin/jks/truststore.jks -keypass 222222-storepass 222222 -alias ca -import -trustcacerts -file D:/OpenSSL-Win64/bin/ca/ca-cert.pem

（五）配置tomcat ssl

修改conf/server.xml。配置如下。xml 程式碼

   <Connectorport="8443" protocol="org.apache.coyote.http11.Http11Protocol"SSLEnabled="true"              maxThreads="150" scheme="https"secure="true" connectionTimeout="20000"               clientAuth="true"sslProtocol="TLS" useBodyEncodingForURI="true"enableLookups="false" acceptorThreadCount="2"socketBuffer="18000" maxHttpHeaderSize="262144"                keystoreFile="server.p12"keystorePass="passca" keystoreType="PKCS12"               truststoreFile="truststore.jks"truststorePass="222222" truststoreType="JKS"               SSLCertificateFile="../bin/server-cert.pem"       SSLCertificateKeyFile="../bin/server-key.pem" />

這裡使用到了四個檔案，各個檔案都是在前面的步驟中生成的。

藍色標識的server.p12和truststore.jks這兩個檔案需要放在tomcat的根目錄下（如C:\Venustech\TSOC\webserver）。

紅色的server-cert.pem和server-key.pem預設是放在tomcat的bin資料夾下的（如C:\Venustech\TSOC\webserver\bin）。

    ☆綠色部分為必須的，否則證書不生效。

（六）驗證ssl配置是否正確

（七）匯入證書

將ca/ca.p12，client/client.p12分別匯入到IE中去（開啟IE->;Internet選項->內容->證書）。

ca.p12匯入至受信任的根證書頒發機構，client.p12匯入至個人。

重新訪問系統。

注：1、細心的不難發現生成client.p12跟ca.p12是一樣的，我測試時發現匯入正常方式的client_err.p12不能正常訪問系統，匯入ca.p12能正常訪問，有了解的大神幫助解決下。