ssl - How do I configure certbot certificates on Tomcat for HTTPS?
问题描述
I've been trying to configure SSL for Tomcat 8.5 server on the school I work to use HTTPS protocol. Since we haven't buy a certificate with a CA, I used certbot to get a free one. I did some configuration and my Tomcat is serving on HTTP but not yet on HTTPS, and there are no errors on the logs. Here is what I did.
-The Tomcat 8.5 is installed on Windows server 2012. It has worked perfectly for 2 years serving applications on regular HTTP.
-Certbot does not support Windows, therefore, I had to install Ubuntu 16.04 on a VM.
-I installed certboot successfully on Ubuntu.
-I used the folowing command to get my certbot certificates:
sudo certbot certonly --preferred-challenges http --manual -d theDomainOfMySchool.com
-After succeeding the ACME challenge, I got these 4 .pem files: cert1.pem, chain1.pem, fullchain1.pem and privkey1.pem.
-All 4 files are clear text in base64 like this extract I’m pasting here:
-----BEGIN CERTIFICATE-----
MIIFYTCCBEmgAwIBAgISAwyxKh7NQWpNnH6w2enPbOlxMA0GCSqGSIb3DQEBCwUA
MEoxCzAJBgNVBAYTAlVTMRYwFAYDVQQKEw1MZXQncyBFbmNyeXB0MSMwIQYDVQQD
-After fighting a while with permissions to copy the 4 files from /etc/letsencrypt/archive, I placed them in the folder of my Tomcat server in Windows. -I configured Tomcat with the following nodes on server.xml:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true" >
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
<SSLHostConfig>
<Certificate certificateKeyFile="conf/cert/certbot_gallery/privkey1.pem"
certificateFile="conf/cert/certbot_gallery/cert1.pem"
certificateChainFile="conf/cert/certbot_gallery/chain1.pem"
type="RSA" />
</SSLHostConfig>
</Connector>
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
-When I start my Tomcat, there are no errors on the logs.
-The server starts fine and serves on HTTP with no problem.
-When I try to access the applications through HTTPS I get ERR_CONNECTION_RESET on the browser.
What am I doing wrong. Are this kind of certificates not suitable for this Tomcat connector? Am I missing any configuration?
Thank you all.
解决方案
Solved! As it turns out, I'm an as$. The configuration on my server.xml is wrong. The connector for Http11NioProtocol should use the port 443 (which is the default for HTTPS), instead of 8443. The rest of the configuration and the request of the certs on certboot is OK.
I think the use of 8443 is in case that your Tomcat is behind Apache or something else. Since I'm using directly, and only, Tomcat, the connector port should be 443. Also, make sure that your firewall allows 443 port.
推荐阅读
- vue.js - 我可以从 btn 做一个浮动对话框吗?
- c# - 从 .net 应用程序到 Azure 数据工厂的 Rest 调用以获取预览数据
- .net-core - 在 aspnetboilerplate 上使用 Hot Chocolate Graphql
- git - 只保留 Git 历史的标签
- php - PHP imap: how to decode and convert Windows-1252 charset emails?
- javascript - use position: "absolute" in CSS React grid context with gridTemplateColumns
- kubernetes - How to implement security in confluent helm charts for kafka
- r - Matching data from unequal data frames in R
- c++ - 将 Bytes 数组转换为 tagVARIANT 数组
- angularjs - Angularjs $digest() 迭代次数达到。中止!以角度运行 angularjs