Ubuntu 14、tomcat 7、java 7
我们从godaddy获取了our.crt、our.key和gd_bundle-g2-g1.crt。该捆绑包中有3个证书(通过vi命令查看文件可见)。
请注意,我们的密钥和证书已在node.js上使用,没有出现问题。
我们通过现有的crt文件创建了一个密钥库,步骤如下:
cd /etc/ssl
openssl pkcs12 -export -in our.crt -inkey our.key -out our.p12 -name tomcat -CAfile gd_bundle-g2-g1.crt -caname root -chain
服务器配置文件server.xml如下:
<Server port="8005" shutdown="SHUTDOWN">
<Listener className="org.apache.catalina.core.JasperListener" />
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />
<GlobalNamingResources>
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<Service name="Catalina">
<Connector port="80" protocol="HTTP/1.1"
connectionTimeout="20000"
URIEncoding="UTF-8"
redirectPort="8443" />
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="200" scheme="https" secure="true"
keystoreType="PKCS12"
keystoreFile="/etc/ssl/our.p12" keystorePass=""
clientAuth="false" sslProtocol="TLS" />
- Tomcat启动没有错误。
- Web应用在80端口上正常工作。
- 服务器没有运行防火墙。
我们设置了从443到8443的本地重定向:
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
那么请尝试 https://www.ourserver.com/ourapp
Chrome 显示: ERR_SSL_VERSION_OR_CIPHER_MISMATCH
在本地机器上运行的 curl 示例:
curl -Iv https://www.ourserver.com:8443
* Rebuilt URL to: https://www.ourserver.com:8443/
* Hostname was NOT found in DNS cache
* Trying 1xxxxxxxx...
* Connected to www.ourserver.com (1xxxx) port 8443 (#0)
* successfully set certificate verify locations:
* CAfile: none
CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS alert, Server hello (2):
* error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
有什么想法吗?
更新1
我尝试在新服务器上设置一个新的tomcat 7,并安装了一个全新的证书副本,但仍然出现相同的错误。