Tomcat使用SSL,AJAX代理中加入的SSL

今天公司要求把Web版客户端全部加上https，这里记录一下实现过程:

 

1.添加KeyPair：

在命令行模式下切换到目录%TOMCAT_HOME%，使用jdk的keytool工具，

keytool -genkey -alias tomcat -keyalg RSA -keypass password -storepass password -keystore name.keystore -validity 3600

其中-validity 3600是过期时间，单位是天，默认是90天

 

2.将证书导入的JDK的证书信任库中：

keytool -export -trustcacerts -alias tomcat -file server.cer -keystore server.keystore -storepass password
keytool -import -trustcacerts -alias tomcat -file server.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -storepass password

这里注意tomcat使用的是哪个jre

如果本来目录中的cacerts存在，会报个错，把原来的cacerts备份一下，换个名字就可以了

 

3.配置tomcat https端口：
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"  
        maxThreads="150" scheme="https"
        secure="true" clientAuth="false" keystoreFile="d:\elitecrm.cer"
        keystorePass="letmein" sslProtocol="TLS" />

4.如果有需要，可以再配置压缩
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"  
        maxThreads="150" scheme="https"
        secure="true" clientAuth="false" keystoreFile="d:\elite.keystore"
        keystorePass="letmein" sslProtocol="TLS" compression="on"
        compressionMinSize="2048"
        noCompressionUserAgents="gozilla, traviata"
        compressableMimeType="text/html,text/xml,text/javascript,text/css,text/plain"/>

compression设为on打开压缩
compressionMinSize为启用压缩的阀值，设置这个值要综合考虑压缩的代价和网络传输代价的平衡值。
noCompressionUserAgents设置对于何种类型的浏览器不启用压缩
compressableMimeType设置对于哪些数据类型启用压缩，对于我们的客户端，text/html和text/xml要启用。

 

这样就可以用https协议8443端口访问之前的url，但是如果要用java.net.URL类来访问https的内容，还需要修改部分代码：

下面是一个用java.net.URL类来做ajax跨域代理的工具类，其中使用了模拟的post请求，并且配置了HttpsCertificates

其中配置SSL的信任证书这块是网上找到的，具体的作用还不是完全明白，不过这样以前的应用就又能正常使用了。

 

package com.elite.servlet;

import java.io.DataOutputStream;
import java.io.IOException;
import java.io.OutputStream;
import java.io.PrintWriter;
import java.net.HttpURLConnection;
import java.net.URLEncoder;
import java.util.Enumeration;
import java.util.HashMap;
import java.util.Map;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSession;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


public class CrossDomainProxyServlet extends HttpServlet{

	@Override
	public void service(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		postService(request,response);
	}
	
	public void postService(HttpServletRequest request, HttpServletResponse response)
		throws ServletException, IOException {
		String url = null; 
		PrintWriter out=response.getWriter();   
		   Map<String, String> req_map = new HashMap<String, String>();  
		   Enumeration<?> _enum = request.getParameterNames();  
		   while (_enum.hasMoreElements()) {  
		       String paramName = (String) _enum.nextElement();  
		       String paramValue = request.getParameter(paramName);  
		       req_map.put(paramName, paramValue);  
		   }  
		   if (!req_map.isEmpty()) {
		       url = req_map.remove("url");
		       System.out.println("url:"+url);
		   }
		   StringBuffer url_sbf = new StringBuffer();
		   String postData="";
		   if ((url != null) && (url.length() > 0)) { 
		       if (!req_map.isEmpty()) {  
		           for (Map.Entry<String, String> entry : req_map.entrySet()) {//generate parameters  
		               String _par_key = entry.getKey();  
		               String _par_value = entry.getValue();
		               System.out.println(_par_key+":"+_par_value);
		               _parvalue=URLEncoder.encode(_par_value,"utf-8");
		               if (_par_key != null && _par_key != "") {  
		                   if (url_sbf.indexOf("?") == -1)  
		                       url_sbf.append("?");  
		                   else  
		                       url_sbf.append("&");  
		                   url_sbf.append(_par_key).append("=").append(_par_value);  
		               }  
		           }
		           if(url_sbf.toString().startsWith("?"))
		        	   postData=url_sbf.substring(1);
		       }
		       
		       try {
		    	   trustAllHttpsCertificates();
				} catch (Exception e) {
					e.printStackTrace();
				}
	           HttpsURLConnection.setDefaultHostnameVerifier(hv);
	           
		       java.net.URL _url = new java.net.URL(url);  
		       HttpURLConnection  urlcon =(HttpURLConnection) _url.openConnection();  
		       urlcon.setRequestMethod("POST");
		       urlcon.setRequestProperty("Proxy-Connection", "Keep-Alive");
		       urlcon.setDoOutput(true);
		       OutputStream os = urlcon.getOutputStream();
		       DataOutputStream dos=new DataOutputStream(os);
		       dos.write(postData.getBytes());
		       dos.flush();
		       dos.close();
		       
		       java.io.InputStream is = urlcon.getInputStream();  
		       java.io.BufferedReader buffer = new java.io.BufferedReader(  
		               new java.io.InputStreamReader(is));  
		       StringBuffer bs = new StringBuffer();  
		       String lineStr = null;  
		       while ((lineStr = buffer.readLine()) != null) {  
		           //String stri = java.net.URLDecoder.decode(lineStr, "UTF-8");  
		           bs.append(lineStr).append("\n");  
		       }  
		       if (bs.toString().indexOf("<?xml version=") != -1) {//if XML file, for AJAX  
		           response.setContentType("text/xml; charset=UTF-8");  
		           response.setHeader("Cache-Control", "no-cache");  
		           out.println(bs.toString());  
		       } else  
		           out.println(bs.toString());  
		   }	
	}

    private static void trustAllHttpsCertificates() throws Exception {
        javax.net.ssl.TrustManager[] trustAllCerts = new javax.net.ssl.TrustManager[1];
        javax.net.ssl.TrustManager tm = new miTM();
        trustAllCerts[0] = tm;
        javax.net.ssl.SSLContext sc =  javax.net.ssl.SSLContext.getInstance("SSL");
        sc.init(null, trustAllCerts, null);
        javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

    }
    public static class miTM implements javax.net.ssl.TrustManager,
	    javax.net.ssl.X509TrustManager {
		public java.security.cert.X509Certificate[] getAcceptedIssuers() {
		    return null;
		}
		public boolean isServerTrusted(
		        java.security.cert.X509Certificate[] certs) {
		    return true;
		}
		public boolean isClientTrusted(
		        java.security.cert.X509Certificate[] certs) {
		    return true;
		}
		public void checkServerTrusted(
		        java.security.cert.X509Certificate[] certs, String authType) throws
		        java.security.cert.CertificateException {
		    return;
		}
		public void checkClientTrusted(
		        java.security.cert.X509Certificate[] certs, String authType) throws
		        java.security.cert.CertificateException {
		    return;
		}
	}
}