https 完整web開發

Tomcat 6.0 配置

1、生成安全訪問的證書。

命令列下執行：keytool -genkey -alias tomcat -keyalg RSA -keystore c:\tomcat.keystore

然後按提示輸入一些密碼等資訊：

輸入keystore密碼：
再次輸入新密碼:
您的名字與姓氏是什麼？
   [Unknown]：  tomcat
您的組織單位名稱是什麼？
   [Unknown]：  tomcat

您的組織名稱是什麼？
   [Unknown]：  tomcat
您所在的城市或區域名稱是什麼？
   [Unknown]：  bj
您所在的州或省份名稱是什麼？
   [Unknown]：  bj
該單位的兩字母國家程式碼是什麼
   [Unknown]：  cn
CN=tomcat, OU=tomcat, O=tomcat, L=bj, ST=bj, C=cn 正確嗎？
   [否]：  y

輸入<tomcat>的主密碼
         （如果和 keystore 密碼相同，按回車）：



輸入完成後，會在C盤下生成tomcat.keystore檔案，這個檔案的位置不做要求。

注：上述命令中的藍色部分可以不輸入，這樣會預設生成一個.keystore的證書檔案。

2、配置tomcat，使其支援https連線。

開啟tomcat目錄下conf/server.xml檔案，將之前的連線部分註釋，找到以下節點：

<!-- Define a SSL HTTP/1.1 Connector on port 8443
          This connector uses the JSSE configuration, when using APR, the 
         connector should be using the OpenSSL style configuration
          described in the APR documentation -->
     <!--
     <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
                maxThreads="150" scheme="https" secure="true"
                clientAuth="false" sslProtocol="TLS" />
     -->
 

 
將<connectore節點的註釋去掉，8443修改為你要使用的埠。節點中新增兩個屬性：keystoreFile="C:/tomcat.keystore" keystorePass="123456"

其中，keystoreFile指的是你第一步生成的證書檔案位置，keystorePass是你在生成證書時所輸入的密碼。
 
通過以上兩步操作，基本上就可以使用https訪問tomcat連線了，不過我在使用tomcat6配置的時候，啟動tomcat報錯：

2011-9-8 10:11:20 org.apache.catalina.core.AprLifecycleListener init
 資訊: Loaded APR based Apache Tomcat Native library 1.1.20.
 2011-9-8 10:11:20 org.apache.catalina.core.AprLifecycleListener init
 資訊: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
 2011-9-8 10:11:20 org.apache.catalina.startup.SetAllPropertiesRule begin
 警告: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'keystoreFile' to 'C:\tomcat.keystore' did not find a matching property.
 2011-9-8 10:11:20 org.apache.catalina.startup.SetAllPropertiesRule begin
 警告: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'keystorePass' to 'mvtech' did not find a matching property.
 2011-9-8 10:11:20 org.apache.catalina.startup.SetAllPropertiesRule begin
 警告: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'clientAuth' to 'false' did not find a matching property.
 2011-9-8 10:11:20 org.apache.coyote.http11.Http11AprProtocol init
 嚴重: Error initializing endpoint
 java.lang.Exception: No Certificate file specified or invalid file format
  at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
  at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:720)
  at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107)
  at org.apache.catalina.connector.Connector.initialize(Connector.java:1014)
  at org.apache.catalina.core.StandardService.initialize(StandardService.java:680)
  at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:548)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
  at java.lang.reflect.Method.invoke(Method.java:597)
  at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
  at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
 2011-9-8 10:11:20 org.apache.catalina.startup.Catalina load
 嚴重: Catalina.start
 LifecycleException:  Protocol handler initialization failed: java.lang.Exception: No Certificate file specified or invalid file format
  at org.apache.catalina.connector.Connector.initialize(Connector.java:1016)
  at org.apache.catalina.core.StandardService.initialize(StandardService.java:680)
  at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:548)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
  at java.lang.reflect.Method.invoke(Method.java:597)
  at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
  at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
 

在網上看到有朋友的解決辦法，是找到tomcat的bin目錄下有個tcnative-1.dll檔案，然後將其刪除，重新啟動tomcat一切正常。

至此，可以通過https方式訪問你的應用了。

但是此時如果你用Http方式訪問應用，頁面會返回亂碼或者空，但是也不報錯，為了更好的使用，我們需要在客戶輸入http時能夠自動跳轉到Https方式，這就需要第三步，讓你的應用強制使用https方式訪問了。
 
開啟tomcat下conf/web.xml檔案，在最下方的<welcome-file-list>節點之後新增：

<login-config>   
    <!-- Authorization setting for SSL -->   
    <auth-method>CLIENT-CERT</auth-method>   
    <realm-name>Client Cert Users-only Area</realm-name>   
    </login-config>   
    <security-constraint>   
        <!-- Authorization setting for SSL -->   
        <web-resource-collection >   
            <web-resource-name >SSL</web-resource-name>   
            <url-pattern>/*</url-pattern>   
        </web-resource-collection>   
        <user-data-constraint>   
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>   
        </user-data-constraint>   
    </security-constraint>   

配置完成。。。。。。

原始碼解析

服務端

服務端的構建比較簡單,一個action搞定

package com.httpsDemo.action;

import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class PostHttpsAction extends HttpServlet {

	/**
	 * 
	 */
	private static final long serialVersionUID = 1L;

	@Override
	protected void doPost(HttpServletRequest req, HttpServletResponse resp)
			throws ServletException, IOException {
		System.out.println("post success ...");
		InputStream in = req.getInputStream();
		BufferedReader br = new BufferedReader(new InputStreamReader(in));
		String result = br.readLine();
		System.out.println(result);
		resp.getOutputStream().write(result.getBytes("utf-8"));
		return;
	}

}

注意web.xml配置.

客戶端

工具類一個搞定

package com.saygou.weixin;
 
import java.io.ByteArrayOutputStream;
import java.io.DataOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
import java.security.KeyManagementException;
import java.security.NoSuchAlgorithmException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
 

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
 
public class HttpsUtil {
 
    private static class TrustAnyTrustManager implements X509TrustManager {
 
        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
        }
 
        public void checkServerTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
        }
 
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[] {};
        }
    }
 
    private static class TrustAnyHostnameVerifier implements HostnameVerifier {
        public boolean verify(String hostname, SSLSession session) {
            return true;
        }
    }
 
    /**
     * post方式請求伺服器(https協議)
     * 
     * @param url
     *            請求地址
     * @param content
     *            引數
     * @param charset
     *            編碼
     * @return
     * @throws NoSuchAlgorithmException
     * @throws KeyManagementException
     * @throws IOException
     */
    public static byte[] post(String url, String content, String charset)
            throws NoSuchAlgorithmException, Exception,
            IOException {
        SSLContext sc = SSLContext.getInstance("SSL","SunJSSE");
        sc.init(null, new TrustManager[] { new TrustAnyTrustManager() },
                new java.security.SecureRandom());
 
        URL console = new URL(url);
        HttpsURLConnection conn = (HttpsURLConnection) console.openConnection();
        conn.setSSLSocketFactory(sc.getSocketFactory());
        //設定預設證書--如果沒有這句將會報錯,錯誤資訊↓↓↓
        //java.io.IOException: HTTPS hostname wrong:  should be <127.0.0.1> 
        conn.setHostnameVerifier(new TrustAnyHostnameVerifier());
        conn.setDoOutput(true);
        conn.connect();
        DataOutputStream out = new DataOutputStream(conn.getOutputStream());
        out.write(content.getBytes(charset));
        // 重新整理、關閉
        out.flush();
        out.close();
        InputStream is = conn.getInputStream();
        if (is != null) {
            ByteArrayOutputStream outStream = new ByteArrayOutputStream();
            byte[] buffer = new byte[1024];
            int len = 0;
            while ((len = is.read(buffer)) != -1) {
                outStream.write(buffer, 0, len);
            }
            is.close();
            return outStream.toByteArray();
        }
        return null;
    }
    
   /**
    * 測試
    * @param args
    * @throws Exception
    */
 
    public static void main(String[] args) throws Exception {
    	try {
			byte[] b = HttpsUtil.post("https://127.0.0.1:8443/httpsDemo/hs", "{'name':'Jack'}", "utf-8");
			System.out.println(new String(b));
		} catch (KeyManagementException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (NoSuchAlgorithmException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (IOException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		}
	}
}