TOMCAT配置SSL双向验证

步骤:
一、建立自己的CA
1.创建私钥:
C:\OpenSSL\apps>openssl genrsa -out root/root-key.pem 1024

2.创建证书请求：
C:\OpenSSL\apps>openssl req -new -out root/root-req.csr -key root/root-key.pem -config openssl.cnf
（注意需要有openssl.cnf文件,apache的cnf/目录下有此文件)

3.生成x509证书,可以自已签名,用来做根证书;也可用其它证书来签名,生成根证书可以信任的证书.

openssl x509 -req -in root/root-req.csr -out root/root-cert.pem -signkey root/root-key.pem -days 365

4.根据root证书生成jks文件
keytool -import -v -trustcacerts -storepass password -alias root -file root/root-cert.pem -keystore root/root.jks

二.建立服务器端证书
1.创建私钥:
C:\OpenSSL\apps>openssl genrsa -out server/server-key.pem 1024

2.创建证书请求:
C:\OpenSSL\apps>openssl req -new -out server/server-req.csr -key server/server-key.pem -config openssl.cnf

3.自签署证书:
C:\OpenSSL\apps>openssl x509 -req -in server/server-req.csr -out server/server-cert.pem -signkey server/server-key.pem -CA root/root-cert.pem -CAkey root/root-key.pem -CAcreateserial -days 3650

4.将证书导出成浏览器支持的.p12格式:
C:\OpenSSL\apps>openssl pkcs12 -export -clcerts -in server/server-cert.pem -inkey server/server-key.pem -out server/server.p12

三.建立客户端证书
1.创建私钥:
C:\OpenSSL\apps>openssl genrsa -out client/client-key.pem 1024

2.创建证书请求：
C:\OpenSSL\apps>openssl req -new -out client/client-req.csr -key client/client-key.pem -config openssl.cnf

3.自签署证书:
C:\OpenSSL\apps>openssl x509 -req -in client/client-req.csr -out client/client-cert.pem -signkey client/client-key.pem -CA root/root-cert.pem -CAkey root/root-key.pem -CAcreateserial -days 3650

4.将证书导出成浏览器支持的.p12格式
C:\OpenSSL\apps>openssl pkcs12 -export -clcerts -in client/client-cert.pem -inkey client/client-key.pem -out client/client.p12  

四.tomcat配置情况:

server.xml

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="true"
               keystoreFile="c:/data/server/server.p12"
               sslProtocol="TLS"
               keystoreType="PKCS12"
               keystorePass="123456"
               truststoreFile="c:/data/root/root.jks"
               truststoreType="JKS"
               truststorePass="password"
    />

五.获取客户端的证书编号
index.jsp

<%
 java.security.cert.X509Certificate[] ca=(java.security.cert.X509Certificate[])request.getAttribute("javax.servlet.request.X509Certificate");
 if(ca==null)
 {
        System.out.println("No cert info!");
  } else
 {
          String  serial=ca[0].getSerialNumber().toString();
          System.out.println(serial);
          String DN=ca[0].getSubjectDN().toString();
          System.out.println(DN);
      }
 %>

六.效果:

则弹出可用的证书供选择。