Tomcat使用SSL,AJAX代理中加入的SSL
今天公司要求把Web版客户端全部加上https，这里记录一下实现过程:
1.添加KeyPair：
在命令行模式下切换到目录%TOMCAT_HOME%，使用jdk的keytool工具，
keytool -genkey -alias tomcat -keyalg RSA -keypass password -storepass password -keystore name.keystore -validity 3600
其中-validity 3600是过期时间，单位是天，默认是90天
2.将证书导入的JDK的证书信任库中：
keytool -export -trustcacerts -alias tomcat -file server.cer -keystore server.keystore -storepass passwordkeytool -import -trustcacerts -alias tomcat -file server.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -storepass password
这里注意tomcat使用的是哪个jre
如果本来目录中的cacerts存在，会报个错，把原来的cacerts备份一下，换个名字就可以了
3.配置tomcat https端口：
<Connectorport="8443"protocol="HTTP/1.1"SSLEnabled="true"
maxThreads="150"scheme="https"
secure="true"clientAuth="false"keystoreFile="d:\elitecrm.cer"
keystorePass="letmein"sslProtocol="TLS"/>
4.如果有需要，可以再配置压缩
<Connectorport="8443"protocol="HTTP/1.1"SSLEnabled="true"
maxThreads="150"scheme="https"
secure="true"clientAuth="false"keystoreFile="d:\elite.keystore"
keystorePass="letmein"sslProtocol="TLS"compression="on"
compressionMinSize="2048"
noCompressionUserAgents="gozilla,traviata"
compressableMimeType="text/html,text/xml,text/javascript,text/css,text/plain"/>
compression设为on打开压缩
compressionMinSize为启用压缩的阀值，设置这个值要综合考虑压缩的代价和网络传输代价的平衡值。
noCompressionUserAgents设置对于何种类型的浏览器不启用压缩
compressableMimeType设置对于哪些数据类型启用压缩，对于我们的客户端，text/html和text/xml要启用。这样就可以用https协议8443端口访问之前的url，但是如果要用java.net.URL类来访问https的内容，还需要修改部分代码：
下面是一个用java.net.URL类来做ajax跨域代理的工具类，其中使用了模拟的post请求，并且配置了HttpsCertificates
其中配置SSL的信任证书这块是网上找到的，具体的作用还不是完全明白，不过这样以前的应用就又能正常使用了。
package com.elite.servlet;
import java.io.DataOutputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.io.PrintWriter;
import java.net.HttpURLConnection;
import java.net.URLEncoder;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSession;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
public class CrossDomainProxyServlet extends HttpServlet{
@Override
public void service(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
postService(request,response);
}
public void postService(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
String url = null;
PrintWriter out=response.getWriter();
Map<String, String> req_map = new HashMap<String, String>();
Enumeration<?> _enum = request.getParameterNames();
while (_enum.hasMoreElements()) {
String paramName = (String) _enum.nextElement();
String paramValue = request.getParameter(paramName);
req_map.put(paramName, paramValue);
}
if (!req_map.isEmpty()) {
url = req_map.remove("url");
System.out.println("url:"+url);
}
StringBuffer url_sbf = new StringBuffer();
String postData="";
if ((url != null) && (url.length() > 0)) {
if (!req_map.isEmpty()) {
for (Map.Entry<String, String> entry : req_map.entrySet()) {//generate parameters
String _par_key = entry.getKey();
String _par_value = entry.getValue();
System.out.println(_par_key+":"+_par_value);
_parvalue=URLEncoder.encode(_par_value,"utf-8");
if (_par_key != null && _par_key != "") {
if (url_sbf.indexOf("?") == -1)
url_sbf.append("?");
else
url_sbf.append("&");
url_sbf.append(_par_key).append("=").append(_par_value);
}
}
if(url_sbf.toString().startsWith("?"))
postData=url_sbf.substring(1);
}
try {
trustAllHttpsCertificates();
} catch (Exception e) {
e.printStackTrace();
}
HttpsURLConnection.setDefaultHostnameVerifier(hv);
java.net.URL _url = new java.net.URL(url);
HttpURLConnection urlcon =(HttpURLConnection) _url.openConnection();
urlcon.setRequestMethod("POST");
urlcon.setRequestProperty("Proxy-Connection", "Keep-Alive");
urlcon.setDoOutput(true);
OutputStream os = urlcon.getOutputStream();
DataOutputStream dos=new DataOutputStream(os);
dos.write(postData.getBytes());
dos.flush();
dos.close();
java.io.InputStream is = urlcon.getInputStream();
java.io.BufferedReader buffer = new java.io.BufferedReader(
new java.io.InputStreamReader(is));
StringBuffer bs = new StringBuffer();
String lineStr = null;
while ((lineStr = buffer.readLine()) != null) {
//String stri = java.net.URLDecoder.decode(lineStr, "UTF-8");
bs.append(lineStr).append("\n");
}
if (bs.toString().indexOf("<?xml version=") != -1) {//if XML file, for AJAX
response.setContentType("text/xml; charset=UTF-8");
response.setHeader("Cache-Control", "no-cache");
out.println(bs.toString());
} else
out.println(bs.toString());
}
}
private static void trustAllHttpsCertificates() throws Exception {
javax.net.ssl.TrustManager[] trustAllCerts = new javax.net.ssl.TrustManager[1];
javax.net.ssl.TrustManager tm = new miTM();
trustAllCerts[0] = tm;
javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, null);
javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
}
public static class miTM implements javax.net.ssl.TrustManager,
javax.net.ssl.X509TrustManager {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return null;
}
public boolean isServerTrusted(
java.security.cert.X509Certificate[] certs) {
return true;
}
public boolean isClientTrusted(
java.security.cert.X509Certificate[] certs) {
return true;
}
public void checkServerTrusted(
java.security.cert.X509Certificate[] certs, String authType) throws
java.security.cert.CertificateException {
return;
}
public void checkClientTrusted(
java.security.cert.X509Certificate[] certs, String authType) throws
java.security.cert.CertificateException {
return;
}
}
} 相关推荐
某些公司会墙特定网站，如果你有一个可访问的域名和服务器，就可以通过nginx反向代理来来解决这些问题。比如现在我们用mirror.example.com镜像www.baidu.com，以下是详细操作。