Linux服务器上Tomcat配置SSL证书并自动续期

本文最后编辑时间：2019-11-12

查看是否安装git
git --version
卸载
yum remove git
安装git
yum install -y git

1.使用git获取，比较慢，请等待
git clone https://github.com/letsencrypt/letsencrypt
2.进入目录
cd letsencrypt
3.查看工具用法
./letsencrypt-auto --help
4.运行（会安装一大推依赖，如果国内主机请更换源），如果有端口占用443，请停止
./letsencrypt-auto certonly
然后，Installing Python packages…会卡顿

如果是干净的系统，以上都走的通；
之后，根据提示：输入验证方式，邮箱，是否订阅，域名，网站根目录等。
我输入的是tomcat的ROOT目录，成功之后出现如下信息：
[root@host letsencrypt]# ./certbot-auto certonly --webroot -w /usr/tomcat7.0.92/webapps/ROOT -d www.xxx.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator webroot, Installer None
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for www.xxx.com
Using the webroot path /usr/tomcat7.0.92/webapps/ROOT for all unmatched domains.
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/www.xxx.com/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/www.xxx.com/privkey.pem
   Your cert will expire on 2019-04-28. To obtain a new or tweaked
   version of this certificate in the future, simply run certbot-auto
   again. To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le

[root@host letsencrypt]# 

#生成p12
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out fullchain_and_key.p12 -name tomcat_letsencrypt -passin pass:123456 -passout pass:123456
#生成jks
keytool -importkeystore -deststorepass '123456' -destkeypass '123456' -destkeystore tomcat_letsencrypt.jks -srckeystore fullchain_and_key.p12 -srcstoretype PKCS12 -srcstorepass '123456' -alias tomcat_letsencrypt

更改tomcat配置文件：server.xml
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
keystoreFile="/etc/letsencrypt/live/www.xxx.com/tomcat_letsencrypt.jks"
keystorePass="123456" />

#重启tomcat

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" URIEncoding="UTF-8" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="/pogaizai/MyDSKeyStore.jks" keystorePass="yourJKSpass" keyAlias="tomcat" keyPass="yourKeyPass"/>

<login-config>
    <!-- Authorization setting for SSL -->
    <auth-method>CLIENT-CERT</auth-method>
    <realm-name>Client Cert Users-only Area</realm-name>
</login-config>
<security-constraint>
    <!-- Authorization setting for SSL -->
    <web-resource-collection >
        <web-resource-name >SSL</web-resource-name>
        <url-pattern>/*</url-pattern>
    </web-resource-collection>
    <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

how to check your pip version:
# pip -V

my pip version is 8.1.1, but the latest version is 9.0.1, so I ran following command to upgrade it:
# pip install --upgrade pip

Now check the pip version again:

# pip -V
pip 9.0.1 from /usr/local/lib/python2.7/dist-packages (python 2.7)

[root@JaneYork letsencrypt]# ./letsencrypt-auto certonly
Bootstrapping dependencies for RedHat-based OSes... (you can skip this with --no-bootstrap)
yum is /usr/bin/yum
yum is hashed (/usr/bin/yum)
Loaded plugins: langpacks, versionlock
Package gcc-4.8.5-36.el7.x86_64 already installed and latest version
Package augeas-libs-1.4.0-6.el7.x86_64 already installed and latest version
Package 1:openssl-1.0.2k-16.el7.x86_64 already installed and latest version
Package 1:openssl-devel-1.0.2k-16.el7.x86_64 already installed and latest version
Package libffi-devel-3.0.13-18.el7.x86_64 already installed and latest version
Package redhat-rpm-config-9.1.0-87.el7.centos.noarch already installed and latest version
Package ca-certificates-2018.2.22-70.0.el7_5.noarch already installed and latest version
Package python-devel-2.7.5-76.el7.x86_64 already installed and latest version
Package python-virtualenv-15.1.0-2.el7.noarch already installed and latest version
Package python-tools-2.7.5-76.el7.x86_64 already installed and latest version
Package python2-pip-8.1.2-6.el7.noarch already installed and latest version
Nothing to do
Creating virtual environment...
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/virtualenv.py", line 2327, in <module>
    main()
  File "/usr/lib/python2.7/site-packages/virtualenv.py", line 712, in main
    symlink=options.symlink)
  File "/usr/lib/python2.7/site-packages/virtualenv.py", line 944, in create_environment
    download=download,
  File "/usr/lib/python2.7/site-packages/virtualenv.py", line 900, in install_wheel
    call_subprocess(cmd, show_stdout=False, extra_env=env, stdin=SCRIPT)
  File "/usr/lib/python2.7/site-packages/virtualenv.py", line 796, in call_subprocess
    % (cmd_desc, proc.returncode))
OSError: Command /opt/eff.org/certbot/venv/bin/python2.7 - setuptools pip wheel failed with error code 1
[root@JaneYork letsencrypt]# ^C

#/bin/sh
#续期   说明：只用renew的话，会先检查证书是否需要更新，大概是距离到期还有三天或者十几天之内才会执行更新，否则会提示不需要更新。（昨天更新了证书，今天直接用renew，提示不允许更新）
#这里方便测试，增加参数--force-renew，能够强制立即更新，官网好像有命令可以用于test
#./certbot-auto renew --force-renew
cd /www/letsencrypt/
./certbot-auto renew
#生成p12
cd /etc/letsencrypt/live/yourDomain && openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out fullchain_and_key.p12 -name tomcat_letsencrypt -passin pass:123456 -passout pass:123456
#移动新生成的证书文件
cp /etc/letsencrypt/live/yourDomain/fullchain.pem /mnt/web/letsTemp
cp /etc/letsencrypt/live/yourDomain/privkey.pem /mnt/web/letsTemp
#生成jks文件
#备份并删除原jks文件
mv /etc/letsencrypt/live/yourDomain/tomcat_letsencrypt.jks /etc/letsencrypt/live/www.xxx.com/tomcat_letsencrypt`date '+%Y-%m-%d'`.jks
cd /etc/letsencrypt/live/yourDoamin && keytool -importkeystore -deststorepass '123456' -destkeypass '123456' -destkeystore tomcat_letsencrypt.jks -srckeystore fullchain_and_key.p12 -srcstoretype PKCS12 -srcstorepass '123456' -alias tomcat_letsencrypt
#重启服务器
/usr/tomcat7.0.92/bin/restartup.sh