nginx和tomcat ssl问题-SSL23_GET_SERVER_HELLO：SSLv3警报握手失败

Question

nginx配置

server {
  listen 443;
  server_name     app.somewhere.com;
  root            /usr/share/tomcat8/webapps;
  ssl on;
  ssl_session_timeout 5m;
  ssl_session_cache shared:SSL:5m;
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_ciphers ECDH+AESGCM:ECDH+AES256:ECDH+AES128:DH+3DES:!ADH:!AECDH:!MD5;  
  ssl_certificate /opt/jdk1.8.0_45/jre/lib/security/app_somewhere_com.pem;
  ssl_certificate_key /opt/jdk1.8.0_45/jre/lib/security/app_somewhere_com.key;
  ssl_dhparam /etc/nginx/certs/dhparam.pem;
  proxy_ssl_server_name on;
  location / {
        proxy_read_timeout 120s;        
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_pass https://app.somewhere.com:8443;
  }
}

tomcat server.xml

<Connector port="8443"
                maxThreads="100"
                scheme="https"
                secure="true"
                SSLEnabled="true"
                keystoreFile="/opt/jdk1.8.0_45/jre/lib/security/my-keystore.jks"
                protocol="org.apache.coyote.http11.Http11NioProtocol"
                keystorePass="mypass"
                clientAuth="false"
                sslProtocol="TLS"
                proxyPort="443"/>

Answer 1

发现问题时，证书被导入到错误的密钥存储区。因此，我使用以下命令使用证书和私钥创建了新的密钥存储。

创建新密钥库

openssl pkcs12 -export -in cert.crt -inkey private-key.key -certfile cert.crt -name "tomcat" -out keystore.p12

将keystore转换为jks格式

keytool -importkeystore -srckeystore keystore.p12 -srcstoretype pkcs12 -destkeystore keystore.jks -deststoretype JKS