tomcat 6.0 SSL配置

cd 到tomcat的bin目录下，执行以下命令：
keytool -genkey -alias tomcat -keyalg RSA -keypass changeit -storepass changeit -keystore server.keystore -validity 3600 
//此时会在bin下生成 server.keystore 文件。 密码是changeit
keytool -export -trustcacerts -alias tomcat -file server.cer -keystore  server.keystore -storepass changeit
//此时会在bin下生成 server.cer文件。 
keytool -import -trustcacerts -alias tomcat -file server.cer -keystore "E:\Program Files\Java\jdk1.5.0_14\jre\lib\security\cacerts" -storepass changeit
//导入到证书信任库

//修改server.xml 注意protocol="HTTP/1.1"需要更改
 <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
 SSLEnabled="true" maxThreads="150" scheme="https" secure="true"
keystoreFile="E:\Program Files\apache-tomcat-6.0.28\bin\server.keystore" 
keystorePass="changeit" clientAuth="false" sslProtocol="TLS" />

如果要在应用中加入SSL验证,则在web.xml中如下配置：

	<security-constraint>
		<web-resource-collection>
			<web-resource-name>Protected Area</web-resource-name>
			<url-pattern>/*</url-pattern>
		</web-resource-collection>
		<user-data-constraint>
			<description>
				Constrain the user data transport for the whole
				application
			</description>
			<transport-guarantee>CONFIDENTIAL</transport-guarantee>
		</user-data-constraint>
	</security-constraint>

参考资料：http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html