我已经通过使用openssl生成csr请求了一个证书。我有私钥文件。现在我想在tomcat中使用的密钥库中安装证书。我尝试了以下方法:
使用以下命令创建p12文件: openssl pkcs12 -export -in website_com.crt -inkey website_com.key -name tomcat -out website_com.p12
使用以下命令将其导入密钥库: keytool -importkeystore -deststorepass mypass -destkeystore somename.jks -srckeystore website_com.p12 -srcstoretype PKCS12
导入成功,在somename.jks中创建了tomcat别名。ssl端口的tomcat连接器:
< Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true" URIEncoding="UTF-8">
<!-- <SSLHostConfig sslProtocol="TLS" sslEnabledProtocols="TLSv1.2" -->
<SSLHostConfig protocols="TLSv1.3"
ciphers="TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_GCM_SHA384,
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_EMPTY_RENEGOTIATION_INFO_SCSVF">
<Certificate certificateKeystoreFile="D:\apache-tomcat-9.0.37\conf\somename.jks"
certificateKeystorePassword="mypass"
certificateKeyAlias="tomcat"
type="RSA" />
</SSLHostConfig>
</Connector>
终端窗口截图
知道我做错什么了吗?
p、 无法生成新的csr并请求新的证书
1条答案
按热度按时间agyaoht71#
我通过使用第一步中生成的p12文件而不是.jks文件来解决这个问题。