Springboot 2.0 https通过CA的SSL证书启用

Question

我有一个小的springboot应用程序。我需要使用HTPPS，我从CA购买带有嵌入式tomcat的SSL证书。我试着配置它。应用财产：

#https server properties
server.port=8443
server.ssl.key-alias=tomcat
server.ssl.key-store-type=PKCS12
server.ssl.key-store-provider=SUN
server.ssl.key-store=classpath:https/keystore1.p12
server.ssl.key-store-password=password

p、 12.使用keytool创建

keytool.exe -import -alias tomcat -file C:\**\*.crt -keystore C:\**\resources\https\keystore1.p12 -storetype pkcs12 -storepass password

**.我从加州得到的crt。我也有私钥，但不知道我需要在哪里使用它。

当我尝试启动此应用程序时，出现了一个错误

org.apache.catalina.LifecycleException: Failed to start component [Connector[HTTP/1.1-8443]]
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:167) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.catalina.core.StandardService.addConnector(StandardService.java:225) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.addPreviouslyRemovedConnectors(TomcatWebServer.java:255) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:197) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.startWebServer(ServletWebServerApplicationContext.java:300) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.finishRefresh(ServletWebServerApplicationContext.java:162) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:552) [spring-context-5.0.4.RELEASE.jar:5.0.4.RELEASE]
    at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:140) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:752) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:388) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:327) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1246) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at org.springframework.boot.SpringApplication.run(SpringApplication.java:1234) [spring-boot-2.0.0.RELEASE.jar:2.0.0.RELEASE]
    at xmpptelegram.XmppTelegramApplication.main(XmppTelegramApplication.java:12) [classes/:na]
Caused by: org.apache.catalina.LifecycleException: Protocol handler start failed
    at org.apache.catalina.connector.Connector.startInternal(Connector.java:1021) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    ... 13 common frames omitted
Caused by: java.lang.IllegalArgumentException: Alias name [tomcat] does not identify a key entry
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:116) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:87) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:225) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.tomcat.util.net.AbstractEndpoint.start(AbstractEndpoint.java:1150) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.coyote.AbstractProtocol.start(AbstractProtocol.java:591) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.catalina.connector.Connector.startInternal(Connector.java:1018) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    ... 14 common frames omitted
Caused by: java.io.IOException: Alias name [tomcat] does not identify a key entry
    at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:229) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114) ~[tomcat-embed-core-8.5.28.jar:8.5.28]
    ... 19 common frames omitted

2018-04-02 11:20:16.662  INFO 15988 --- [           main] o.apache.catalina.core.StandardService   : Stopping service [Tomcat]
2018-04-02 11:20:16.674  INFO 15988 --- [           main] ConditionEvaluationReportLoggingListener : 

Error starting ApplicationContext. To display the conditions report re-run your application with 'debug' enabled.
2018-04-02 11:20:16.678 ERROR 15988 --- [           main] o.s.b.d.LoggingFailureAnalysisReporter   : 

***************************
APPLICATION FAILED TO START
***************************

Description:

The Tomcat connector configured to listen on port 8443 failed to start. The port may already be in use or the connector may be misconfigured.

Action:

Verify the connector's configuration, identify and stop any process that's listening on port 8443, or configure this application to listen on another port.

为什么应用程序看不到别名？我在keystore中看到了。

可能我需要一些其他设置来在springboot tomcat中使用https？所有关于使用celfsinght证书的说明。。。

Answer 1

为了让这一切顺利进行，我必须付出很多努力。

这适用于所有从证书颁发机构获得证书的人。

这是因为。p12没有正确生成。

你需要openssl来实现这一点。

在windows中，可以转到Gitbash并键入：winpty openssl

执行以下命令：

pkcs12 -export -in yourcert.cer -inkey yourkey.key -out keystore1.p12

它将要求一个密码：这是.秘密文件中的值。

它会要求输入一个导出密码：输入你想要的任何东西，例如exportpassword

在Spring Boot应用程序中，放入生成的keystore1。p12在资源文件夹中。

正在申请中。yml文件，配置如下：

server:
  port: 7878
  ssl:
    enabled: true
    key-store: classpath:keystore1.p12
    key-store-type: PKCS12
    key-store-password: exportpassword  

Answer 2

您应该将整个CA回复导入密钥库，而不仅仅是已签名的证书。这可能是一个p7b或p7r文件。您所做的只会将证书添加为受信任的证书。它不会将证书链关联到您的私钥。

你需要编辑你的-file参数（在这里提供正确的文件）。