针对Apache和Tomcat的SSL问题

我有一个运行Apache和Tomcat的服务器。 前端应用程序（内置在angularjs中）在Apache中运行，我安装了SSL证书，它工作正常，我可以通过HTTPS和浏览器信任证书访问。 但是，这个应用程序正在使用来自另一个在SAME服务器中的应用程序的一些服务，但它运行在Tomcat 8上（因为它是一个使用Java构build的应用程序）。

问题是浏览器（chrome）不允许https使用服务从其他服务器（实际上它运行在同一服务器，但它是一个不同的应用程序），不使用SSL的服务。 所以我试图使用Tomcat中Apache中使用的SSL。 我不能让它工作。 根据我读的，我neet将证书添加到密钥库，但是当我尝试这样做时，证书被列为trustedCertEntry和根据文档是因为我没有使用我用来生成相同的别名私人密钥….但是当我创build私钥我没有使用别名，所以我不知道如何解决这个…

总结：一个服务器，Apache（端口80）中的应用程序和Tomcat（端口8080）中的其他应用程序正在运行。 在Apache的设置是可以使用SSL我生成的私钥：

openssl genrsa -out mydomain.key 2048 openssl req -new -key mydomain.key -out mydomain.csr 

然后我试着把证书添加到密钥库中

• 检查Windows Server 2008R2是否可以使用TLS 1.2
• 间歇性SSL证书错误，证书是针对不同的网站
• 如何使用NGINX作为具有客户端证书的https服务的代理
• SSL与蜻蜓和Apache
• 如何在centos 7服务器上的单个域中删除LetsEncrypt证书时解决问题

 keytool -import -keystore mydomain -alias mydomain -file [certificate file] 

但是它被列为trustedCertEntry，并且tomcat在端口8080或8443中不支持HTTPS。

我错过了什么？ 我可以用一个证书来做这个吗？ 还是我需要两个，即使他们在同一台服务器上？

我的server.xml是

 <?xml version="1.0" encoding="UTF-8"?> 

  http://www.apache.org/licenses/LICENSE-2.0 

除非适用法律要求或书面同意，否则根据许可证分发的软件按“原样”分发，不附有任何明示或暗示的保证或条件。 请参阅许可证以获取有关许可证下的权限和限制的特定语言。 – > – >

 <!--The connectors can use a shared executor, you can define one or more named thread pools--> <!-- <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" maxThreads="150" minSpareThreads="4"/> --> <!-- A "Connector" represents an endpoint by which requests are received and responses are returned. Documentation at : Java HTTP Connector: /docs/config/http.html Java AJP Connector: /docs/config/ajp.html APR (HTTP/AJP) Connector: /docs/apr.html Define a non-SSL/TLS HTTP/1.1 Connector on port 8080 --> <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" /> <!-- A "Connector" using the shared thread pool--> <!-- <Connector executor="tomcatThreadPool" port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" /> --> <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 This connector uses the NIO implementation. The default SSLImplementation will depend on the presence of the APR/native library and the useOpenSSL attribute of the AprLifecycleListener. Either JSSE or OpenSSL style configuration may be used regardless of the SSLImplementation selected. JSSE style configuration is used below. --> <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true"> <SSLHostConfig> <Certificate certificateKeystoreFile="conf/localhost-rsa.jks" type="RSA" /> </SSLHostConfig> </Connector> <!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2 This connector uses the APR/native implementation which always uses OpenSSL for TLS. Either JSSE or OpenSSL style configuration may be used. OpenSSL style configuration is used below. --> <Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol" maxThreads="150" SSLEnabled="true" > <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" /> <SSLHostConfig> <Certificate certificateKeyFile="conf/localhost-rsa-key.pem" certificateFile="conf/localhost-rsa-cert.pem" certificateChainFile="conf/localhost-rsa-chain.pem" type="RSA" /> </SSLHostConfig> </Connector> <!-- Define an AJP 1.3 Connector on port 8009 --> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> <!-- An Engine represents the entry point (within Catalina) that processes every request. The Engine implementation for Tomcat stand alone analyzes the HTTP headers included with the request, and passes them on to the appropriate Host (virtual host). Documentation at /docs/config/engine.html --> <!-- You should set jvmRoute to support load-balancing via AJP ie : <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1"> --> <Engine name="Catalina" defaultHost="localhost"> <!--For clustering, please take a look at documentation at: /docs/cluster-howto.html (simple how to) /docs/config/cluster.html (reference documentation) --> <!-- <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/> --> <!-- Use the LockOutRealm to prevent attempts to guess user passwords via a brute-force attack --> <Realm className="org.apache.catalina.realm.LockOutRealm"> <!-- This Realm uses the UserDatabase configured in the global JNDI resources under the key "UserDatabase". Any edits that are performed against this UserDatabase are immediately available for use by the Realm. --> <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/> </Realm> <Host name="localhost" appBase="webapps" unpackWARs="true" autoDeploy="true"> <!-- SingleSignOn valve, share authentication between web applications Documentation at: /docs/config/valve.html --> <!-- <Valve className="org.apache.catalina.authenticator.SingleSignOn" /> --> <!-- Access log processes all example. Documentation at: /docs/config/valve.html Note: The pattern used is equivalent to using pattern="common" --> <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs" prefix="localhost_access_log" suffix=".txt" pattern="%h %l %u %t &quot;%r&quot; %s %b" /> </Host> </Engine> 

 <Service name="Catalina"> <Connector port="8080" protocol="HTTP/1.1" connectionTimeout="20000" redirectPort="8443" /> <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" /> ...