单个Tomcat8实现域名+SSL完成https访问多个项目配置教程

xiaoxiao2021-02-28  14

1. 配置server.xml

分析:

          1.1 域名访问默认端口号是80,所以先修改端口号,然后是redirectPort443

          1.2 多个项目需要配置多个host,其中需要注意每个host下默认项目访问路径

          1.3 配置阿里云免费SSL证书

注意添加修改标红的地方

<?xml version="1.0" encoding="UTF-8"?><!--  Licensed to the Apache Software Foundation (ASF) under one or more  contributor license agreements.  See the NOTICE file distributed with  this work for additional information regarding copyright ownership.  The ASF licenses this file to You under the Apache License, Version 2.0  (the "License"); you may not use this file except in compliance with  the License.  You may obtain a copy of the License at      http://www.apache.org/licenses/LICENSE-2.0  Unless required by applicable law or agreed to in writing, software  distributed under the License is distributed on an "AS IS" BASIS,  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the License for the specific language governing permissions and  limitations under the License.--><!-- Note:  A "Server" is not itself a "Container", so you may not     define subcomponents such as "Valves" at this level.     Documentation at /docs/config/server.html --><Server port="8005" shutdown="SHUTDOWN">  <Listener className="org.apache.catalina.startup.VersionLoggerListener" />  <!-- Security listener. Documentation at /docs/config/listeners.html  <Listener className="org.apache.catalina.security.SecurityListener" />  -->  <!--APR library loader. Documentation at /docs/apr.html -->  <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />  <!-- Prevent memory leaks due to use of particular java/javax APIs-->  <Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />  <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />  <Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />  <!-- Global JNDI resources       Documentation at /docs/jndi-resources-howto.html  -->  <GlobalNamingResources>    <!-- Editable user database that can also be used by         UserDatabaseRealm to authenticate users    -->    <Resource name="UserDatabase" auth="Container"              type="org.apache.catalina.UserDatabase"              description="User database that can be updated and saved"              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"              pathname="conf/tomcat-users.xml" />  </GlobalNamingResources>  <!-- A "Service" is a collection of one or more "Connectors" that share       a single "Container" Note:  A "Service" is not itself a "Container",       so you may not define subcomponents such as "Valves" at this level.       Documentation at /docs/config/service.html   -->  <Service name="Catalina">    <!--The connectors can use a shared executor, you can define one or more named thread pools-->    <!--    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"        maxThreads="150" minSpareThreads="4"/>    -->    <!-- A "Connector" represents an endpoint by which requests are received         and responses are returned. Documentation at :         Java HTTP Connector: /docs/config/http.html         Java AJP  Connector: /docs/config/ajp.html         APR (HTTP/AJP) Connector: /docs/apr.html         Define a non-SSL/TLS HTTP/1.1 Connector on port 8080    -->    <Connector port="80" protocol="HTTP/1.1"               connectionTimeout="20000"               redirectPort="443" />    <!-- A "Connector" using the shared thread pool-->    <!--    <Connector executor="tomcatThreadPool"               port="8080" protocol="HTTP/1.1"               connectionTimeout="20000"               redirectPort="8443" />    -->    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443         This connector uses the NIO implementation with the JSSE engine. When         using the JSSE engine, the JSSE configuration attributes must be used.    -->    <!--    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"               maxThreads="150" SSLEnabled="true">        <SSLHostConfig>            <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"                         type="RSA" />        </SSLHostConfig>    </Connector>    -->    <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2         This connector uses the APR/native implementation. When using the         APR/native implementation or the OpenSSL engine with NIO or NIO2 then         the OpenSSL configuration attributes must be used.    -->    <!--    <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"               maxThreads="150" SSLEnabled="true" keystoreFile="cert/www.zao-space.com.pfx"    keystoreType="PKCS12"    keystorePass="214454674010259" >        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />        <SSLHostConfig>            <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"                         certificateFile="conf/localhost-rsa-cert.pem"                         certificateChainFile="conf/localhost-rsa-chain.pem"                         type="RSA" />        </SSLHostConfig>    </Connector>    -->    <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"               maxThreads="150" SSLEnabled="true" URIEncoding="UTF-8" defaultSSLHostConfigName="www.zao-space.com">        <SSLHostConfig hostName="www.zao-space.com" caCertificateFile="cert/www.zao-space.com.pem">            <Certificate certificateKeystoreFile="cert/www.zao-space.com.pfx"                         certificateKeystoreType="PKCS12" certificateKeystorePassword="214454674010259" />        </SSLHostConfig>        <SSLHostConfig hostName="she.zao-space.com" caCertificateFile="cert/she.zao-space.com.pem">            <Certificate certificateKeystoreFile="cert/she.zao-space.com.pfx"                         certificateKeystoreType="PKCS12" certificateKeystorePassword="214454674020259" />        </SSLHostConfig>    </Connector>    <!-- Define an AJP 1.3 Connector on port 8009 -->    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />    <!-- An Engine represents the entry point (within Catalina) that processes         every request.  The Engine implementation for Tomcat stand alone         analyzes the HTTP headers included with the request, and passes them         on to the appropriate Host (virtual host).         Documentation at /docs/config/engine.html -->    <!-- You should set jvmRoute to support load-balancing via AJP ie :    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">    -->    <Engine name="Catalina" defaultHost="www.zao-space.com">      <!--For clustering, please take a look at documentation at:          /docs/cluster-howto.html  (simple how to)          /docs/config/cluster.html (reference documentation) -->      <!--      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>      -->      <!-- Use the LockOutRealm to prevent attempts to guess user passwords           via a brute-force attack -->      <Realm className="org.apache.catalina.realm.LockOutRealm">        <!-- This Realm uses the UserDatabase configured in the global JNDI             resources under the key "UserDatabase".  Any edits             that are performed against this UserDatabase are immediately             available for use by the Realm.  -->        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"               resourceName="UserDatabase"/>      </Realm>      <Host name="www.zao-space.com"  appBase="webapps"            unpackWARs="true" autoDeploy="true">        <Context path="" docBase="/home/tomcat/apache-tomcat-8.5.8/webapps/zao" reloadable="true" />        <!-- SingleSignOn valve, share authentication between web applications             Documentation at: /docs/config/valve.html -->        <!--        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />        -->        <!-- Access log processes all example.             Documentation at: /docs/config/valve.html             Note: The pattern used is equivalent to using pattern="common" -->        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"               prefix="localhost_access_log" suffix=".txt"               pattern="%h %l %u %t "%r" %s %b" />      </Host>   <Realm className="org.apache.catalina.realm.LockOutRealm">        <!-- This Realm uses the UserDatabase configured in the global JNDI             resources under the key "UserDatabase".  Any edits             that are performed against this UserDatabase are immediately             available for use by the Realm.  -->        <Realm className="org.apache.catalina.realm.UserDatabaseRealm"               resourceName="UserDatabase"/>      </Realm>      <Host name="she.zao-space.com"  appBase="myapps"            unpackWARs="true" autoDeploy="true">        <Context path="" docBase="/home/tomcat/apache-tomcat-8.5.8/myapps/navigator" reloadable="true" />        <!-- SingleSignOn valve, share authentication between web applications             Documentation at: /docs/config/valve.html -->        <!--        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />        -->        <!-- Access log processes all example.             Documentation at: /docs/config/valve.html             Note: The pattern used is equivalent to using pattern="common" -->        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"               prefix="localhost_access_log" suffix=".txt"               pattern="%h %l %u %t "%r" %s %b" />      </Host>    </Engine>  </Service>

</Server>

2. 配置web.xml

在tomcat 的conf目录下的web.xml中添加如下配置信息,过滤所有http请求为https请求

<security-constraint>        <web-resource-collection >              <web-resource-name >SSL</web-resource-name>              <url-pattern>/*</url-pattern>       </web-resource-collection>                                    <user-data-constraint>       <transport-guarantee>CONFIDENTIAL</transport-guarantee>       </user-data-constraint></security-constraint>

3. 启动Tomcat服务

转载请注明原文地址: https://www.6miu.com/read-2800192.html

最新回复(0)