我正在尝试在我的Tomcat中启用SSL。 但是，当我启动Tomcat，并转到https：// localhost：8443我明白了
An error occurred during a connection to localhost:8443. SSL received a record that exceeded the maximum permissible length. (Error code: ssl_error_rx_record_too_long) 为此，我使用CA.sh生成私钥并签名证书，如下所示：
progerlaptop:/usr/share/ssl/misc # ./CA.sh -newca CA certificate filename (or enter to create) Making CA certificate ... Generating a 1024 bit RSA private key ................................++++++ .............................................++++++ writing new private key to './demoCA/private/./cakey.pem' Enter PEM pass phrase: pass Verifying - Enter PEM pass phrase: pass ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:UK State or Province Name (full name) [Some-State]:Chernihiv Locality Name (eg, city) []:Chernihiv Organization Name (eg, company) [Internet Widgits Pty Ltd]:University Organizational Unit Name (eg, section) []:student Common Name (eg, YOUR name) []:localhost Email Address []:proger@localhost Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Using configuration from /etc/ssl/openssl.cnf Enter pass phrase for ./demoCA/private/./cakey.pem: Check that the request matches the signature Signature ok Certificate Details: Serial Number: c6:55:7e:58:1b:4d:9c:7e Validity Not Before: Nov 25 13:17:31 2010 GMT Not After : Nov 24 13:17:31 2013 GMT Subject: countryName = UK stateOrProvinceName = Chernihiv organizationName = University organizationalUnitName = student commonName = localhost emailAddress = proger@localhost X509v3 extensions: X509v3 Subject Key Identifier: C7:98:1E:68:A7:3A:C4:B2:46:C8:88:99:C8:D5:CA:66:D3:94:23:66 X509v3 Authority Key Identifier: keyid:C7:98:1E:68:A7:3A:C4:B2:46:C8:88:99:C8:D5:CA:66:D3:94:23:66 X509v3 Basic Constraints: CA:TRUE Certificate is to be certified until Nov 24 13:17:31 2013 GMT (1095 days) Write out database with 1 new entries Data Base Updated progerlaptop:/usr/share/ssl/misc # ./CA.sh -newreq Generating a 1024 bit RSA private key ............++++++ .........................++++++ writing new private key to 'newkey.pem' Enter PEM pass phrase: pass Verifying - Enter PEM pass phrase: pass ----- You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:UK State or Province Name (full name) [Some-State]:Chernihiv Locality Name (eg, city) []:Chernihiv Organization Name (eg, company) [Internet Widgits Pty Ltd]:University Organizational Unit Name (eg, section) []:student Common Name (eg, YOUR name) []:localhost Email Address []:proger@localhost Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: An optional company name []: Request is in newreq.pem, private key is in newkey.pem progerlaptop:/usr/share/ssl/misc # CA.sh -sign Using configuration from /etc/ssl/openssl.cnf Enter pass phrase for ./demoCA/private/cakey.pem: pass ... Sign the certificate? [y/n]:y ... Signed certificate is in newcert.pem
复制密钥并将证书复制到我的Tomcat目录中。
cp newcert.pem newkey.pem /path/to/tomcat-6.0.29/ssl/
添加连接到我的server.xml：
<Connector port="8443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEngine="on". SSLCertificateFile="${catalina.base}/ssl/newcert.pem" SSLCertificateKeyFile="${catalina.base}/ssl/newkey.pem". SSLPassword="pass"/>
然后我开始catalina.sh运行。 而当我去https：// localhost：8443 /我看到这个讨厌的错误。 当我做我做错了？
先谢谢你
Tomcat 6及以上？ 您需要设置SSLEnabled =“true”，这已经在这里或这里回答了 。
看起来你使用APR / OpenSSL for https，在这种情况下，SSLEngine =“on”是正确的。
你安装了libtcnative吗？
假设tomcat 6： http : //tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
快速步骤：
tar zxf tomcat-native-1.1.20-src.tar.gz cd tomcat-native-1.1.20-src/jni/native/ ./configure --with-apr=/usr/bin/apr-1-config --with-ssl=yes make && make install cd /usr/java/default/jre/lib/amd64/ ln -s /usr/local/apr/lib/libtcnative-1.so
当你启动tomcat时，你必须在你的catalina.out中看到这行：
INFO: Loaded APR based Apache Tomcat Native library 1.1.20.
另一种方法是使用JSSE并将您的证书/密钥添加到java密钥库（.keystore文件）中。 我发现Java的密钥库是一个痛苦的屁股使用，所以我通常与APR去。
我有同样的问题。 我通过添加protocol="org.apache.coyote.http11.Http11NioProtocol"到连接器
我希望你的机器上应该有keystore文件
确保在server.xml文件中，也可以参考这个链接可能对你有所帮助
<Connector port=”8443” maxHttpHeaderSize=”8192″ maxThreads=”150″ minSpareThreads=”25″ maxSpareThreads=”75″ enableLookups=”false” disableUploadTimeout=”true” acceptCount=”100″ scheme=”https” secure=”true” **keystoreFile=”/../../../Tomcat/mycert.jks”** clientAuth=”false” sslProtocol=”TLS>
我设法通过更改端口值来解决这个问题。 值443被保留，所以我把1443，重新启动Tomcat，它的工作。
我的Connector是：
<Connector port="1443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="D:/path_to_ca.jks" keystorePass="somePass" />
现在网址是：
https：//开头本地主机：1443 / index.jsp的
干杯!