近日,幫一個(gè)朋友配置一臺服務(wù)器,在該服務(wù)器上啟動(dòng)一個(gè)Tomcat運行兩個(gè)應用,分別對應兩個(gè)域名:www.domain1.com 和 www.domain2.cn ,對于http協(xié)議(80端口),只要配置Tomcat的虛擬主機就可以了。
但朋友為了數據的安全性,分別為每個(gè)域名購買(mǎi)了一個(gè)CA證書(shū)。這就要求在一個(gè)Tomcat上配置兩個(gè)證書(shū)。在網(wǎng)上搜了好久,沒(méi)見(jiàn)有相同的案例。只查到有人說(shuō)了兩種辦法:
一、兩個(gè)域名使用不同的HTTPS端口,比如:www.domain1.com使用443端口,www.domain2.cn 使用8443端口,這種方式對于測試可以,但用于生產(chǎn)環(huán)境,要求普通用戶(hù)在輸入地址時(shí)還要輸入端口8443,不方便不說(shuō),有些用戶(hù)還不懂。所以這種方案只能暫時(shí)放棄。
二、使用兩個(gè)公網(wǎng)IP,每個(gè)域名對應一個(gè)IP,這樣就可以使每個(gè)域名都使用443作為HTTPS的端口,方便用戶(hù)使用。但沒(méi)有查到實(shí)際的配置案例。
既然沒(méi)有案例,那就自己動(dòng)手,開(kāi)始嘗試。經(jīng)過(guò)N次嘗試之后,終于配置成功。為了防止忘記,也為了方便別人,把配置文件貼出來(lái)。為了減少篇幅,把大部分注釋刪除了。
- <?xml version="1.0" encoding="UTF-8"?>
-
- <Server port="8005" shutdown="SHUTDOWN">
-
- <!-- Comment these entries out to disable JMX MBeans support used for the administration web application -->
- <Listener className="org.apache.catalina.core.AprLifecycleListener" />
- <Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
- <Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
- <Listener className="org.apache.catalina.storeconfig.StoreConfigLifecycleListener"/>
-
- <!-- Global JNDI resources -->
- <GlobalNamingResources>
-
- <!-- Test entry for demonstration purposes -->
- <Environment name="simpleValue" type="java.lang.Integer" value="30"/>
-
- <!-- Editable user database that can also be used by
- UserDatabaseRealm to authenticate users -->
- <Resource name="UserDatabase" auth="Container"
- type="org.apache.catalina.UserDatabase"
- description="User database that can be updated and saved"
- factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
- pathname="conf/tomcat-users.xml" />
-
- </GlobalNamingResources>
-
- <!-- Define the Tomcat Stand-Alone Service -->
- <Service name="Catalina">
-
- <!-- Define a non-SSL HTTP/1.1 Connector on port 80 -->
- <Connector port="80" maxHttpHeaderSize="8192"
- maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
- enableLookups="false" redirectPort="8443" acceptCount="100"
- connectionTimeout="20000" disableUploadTimeout="true" />
-
- <!-- Define a SSL HTTP/1.1 Connector on port 443 -->
- <Connector port="443" maxHttpHeaderSize="8192"
- maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
- enableLookups="false" disableUploadTimeout="true"
- acceptCount="100" scheme="https" secure="true"
- clientAuth="false" sslProtocol="TLS"
- keystoreFile ="D:/certs/mydomain1.com_keystore.jks" keystorePass="www.mydomain1.com" keystoreType="JKS"
- truststoreFile="D:/certs/mydomain1.com_keystore.jks" truststorePass="www.mydomain1.com" truststoreType="JKS"
- address="xxx.xxx.2.83"
- />
-
- <Connector port="443" maxHttpHeaderSize="8192"
- maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
- enableLookups="false" disableUploadTimeout="true"
- acceptCount="100" scheme="https" secure="true"
- clientAuth="false" sslProtocol="TLS"
- keystoreFile ="D:/certs/mydomain2.cn_keystore.jks" keystorePass="www.mydomain2.cn" keystoreType="JKS"
- truststoreFile="D:/certs/mydomain2.cn_keystore.jks" truststorePass="www.mydomain2.cn" truststoreType="JKS"
- address="xxx.xxx.2.81"
- />
-
- <!-- Define an AJP 1.3 Connector on port 8009 -->
- <Connector port="8009" enableLookups="false" redirectPort="8443" protocol="AJP/1.3" />
-
- <!-- Define the top level container in our container hierarchy -->
- <Engine name="Catalina" defaultHost="localhost">
-
- <!-- This Realm uses the UserDatabase configured in the global JNDI
- resources under the key "UserDatabase". Any edits
- that are performed against this UserDatabase are immediately
- available for use by the Realm. -->
- <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
-
- <!-- Define the default virtual host
- Note: XML Schema validation will not work with Xerces 2.2.
- -->
- <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true" xmlValidation="false" xmlNamespaceAware="false">
- </Host>
-
- <Host name="xxx.xxx.2.81" appBase="D:/mydomain2/webapp" unpackWARs="true" autoDeploy="true" xmlValidation="false" xmlNamespaceAware="false">
- <Alias>mydomain2.cn</Alias>
- <Alias>www.mydomain2.cn</Alias>
- </Host>
-
- <Host name="xxx.xxx.2.83" appBase="D:/mydomain1/webapp" unpackWARs="true" autoDeploy="true" xmlValidation="false" xmlNamespaceAware="false">
- <Alias>mydomain1.com</Alias>
- <Alias>tax.mydomain1.com</Alias>
- <Alias>www.mydomain1.com</Alias>
- <Alias>www.mydomain1.cn</Alias>
- <Alias>mydomain1.cn</Alias>
- </Host>
-
-
- </Engine>
-
- </Service>
-
- </Server>
注意兩個(gè)Port="443"的Connector配置,最后面的address參數是關(guān)鍵,如果不加address,那么Tomcat將會(huì )報錯,說(shuō)443端口已被使用。其他的配置信息,網(wǎng)絡(luò )上都能找到例子或說(shuō)明,就不多做說(shuō)明了。
http://www.iteye.com/topic/554238
本站僅提供存儲服務(wù),所有內容均由用戶(hù)發(fā)布,如發(fā)現有害或侵權內容,請
點(diǎn)擊舉報。