Android开发环境、tomcat
整体的步骤就是
1. 用keystore生成服务器端所用的密钥,用它配置服务器
2.客户端导入其中的公钥,将其添加到信任的证书库中。
下面是具体的参考资料。
1.密码学基础(像我这样非科班出身的需要看一下,知其然还得知其所以然)http://www.williamlong.info/archives/499.html
2.keytool使用与tomcat配置
英文好的朋友请直接看tomcat文档,SSL部分;
英文不好的朋友请寻找中文版文档,或者看这篇文章:
http://ln-ydc.iteye.com/blog/1330674
注意:具体的配置可能不一样,请找你的tomcat文档,SSL部分。
<!-- 不配置APR时 -->
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="conf/cert/tomcat.keystore" keystorePass="password"
/>
3.android配置
如果不需要验证服务器端证书,直接照这里做
http://elsila.blog.163.com/blog/static/17319715820101128832427/
如果需要验证服务器端证书(这样能够防钓鱼),我是这样做的,还有些问题问大牛:
a. 导出公钥。在浏览器上用https访问tomcat,查看其证书,并另存为一个文件(存成了X.509格式:xxxx.cer)
b. 导入公钥。把xxxx.cer放在Android的assets文件夹中,以方便在运行时通过代码读取此证书。
获取本地的证书
public static KeyStore getCertificate(Context context) {
AssetManager assetManager = context.getAssets();
InputStream ins = null;
KeyStore keyStore = null;
try {
ins = assetManager.open("darrenf.crt");
// 读取证书
CertificateFactory cerFactory = CertificateFactory.getInstance("X.509"); //Certificate的type
Certificate cer = cerFactory.generateCertificate(ins);
// 创建一个证书库,并将证书导入证书库
//android平台上支持的keystore type好像只有PKCS12,不支持JKS
keyStore = KeyStore.getInstance("PKCS12", "BC");
keyStore.load(null, null);
keyStore.setCertificateEntry("trust", cer);
return keyStore;
} catch (IOException e) {
e.printStackTrace();
} catch (CertificateException e) {
e.printStackTrace();
} catch (KeyStoreException e) {
e.printStackTrace();
} catch (NoSuchProviderException e) {
e.printStackTrace();
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} finally {
try {
if(ins != null){
ins.close();
}
} catch (IOException e) {
e.printStackTrace();
}
}
return keyStore;
}
// 连接服务器获取信息
public void connectServer() {
// 获取本地证书
KeyStore keystore = CertificateUtils.getCertificate(getContext());
if(keystore == null){
Log.e(TAG, "获取证书错误");
return;
}
// 把咱的证书库作为信任证书库
SSLSocketFactory socketFactory = null;
try {
socketFactory = new SSLSocketFactory(keystore);
// 允许所有主机
socketFactory.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
} catch (KeyManagementException e) {
e.printStackTrace();
} catch (UnrecoverableKeyException e) {
e.printStackTrace();
} catch (NoSuchAlgorithmException e) {
e.printStackTrace();
} catch (KeyStoreException e) {
e.printStackTrace();
}
final Scheme sch = new Scheme("https", socketFactory, 443);
Thread thread = new Thread() {
public void run() {
String path = "https://192.168.16.34:8443/SpringREST/simple/22";
HttpClient mHttpClient = new DefaultHttpClient();
mHttpClient.getConnectionManager().getSchemeRegistry().register(sch);
HttpGet httpGet = new HttpGet(path);
InputStream inputStream = null;
ByteArrayOutputStream baos = null;
try {
HttpResponse response = mHttpClient.execute(httpGet);
StatusLine stateLine = response.getStatusLine();
if (stateLine.getStatusCode() == HttpStatus.SC_OK) {
HttpEntity entity = response.getEntity();
inputStream = entity.getContent();
baos = new ByteArrayOutputStream();
int len = 0;
byte[] buffer = new byte[1024];
while ((len = inputStream.read(buffer)) != -1) {
baos.write(buffer, 0, len);
}
String content = new String(baos.toByteArray());
}
} catch (ClientProtocolException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
} finally {
try {
if (baos != null) {
baos.close();
}
if (inputStream != null) {
inputStream.close();
}
} catch (IOException e) {
e.printStackTrace();
}
}
}
};
thread.start();
}
web.xml中配置http访问转向https
<!-- 配置使http访问转向https -->
<security-constraint>
<web-resource-collection>
<web-resource-name>SSL</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
为 Tomcat 安装 apr
http://pengranxiang.iteye.com/blog/1128905
在tomcat7中启用HTTPS的详细配置
http://blog.sina.com.cn/s/blog_64a52f2a0101g35m.html
TOMCAT官方文档
http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Configuration
来源:oschina
链接:https://my.oschina.net/u/2501904/blog/550567