jetty嵌入式开发中使用ssl连接，ssl证书生成

最新项目使用jetty嵌入式开发，但是需要使用ssl连接，通过2个小时的努力，搭建出ssl环境。包括证书的生成。

1:生成服务端keystore

keytool -genkey -alias cheetah -keyalg RSA -keystore E:/cheetah-gateway-web/WebRoot/ssl/cheetah.keystore -validity 365

2:生成客户端证书p12

keytool -genkey -v -alias cheetah -keyalg RSA -storetype PKCS12 -keystore e:\ssl\cheetah.p12

3:根据客户端证书p12生成cer

keytool -export -alias cheetah -keystore e:\ssl\cheetah.p12 -storetype PKCS12 -storepass cheetah -rfc -file e:\ssl\cheetah.cer

4:客户端证书导入keystore

keytool -import -v -file e:\ssl\cheetah.cer  -keystore E:/cheetah-gateway-web/WebRoot/ssl/cheetah.keystore

5:查看keystore中的证书cer

keytool -list -keystore E:/cheetah-gateway-web/WebRoot/ssl/cheetah.keystore

6:服务端keystore导出cer

keytool -keystore E:/cheetah-gateway-web/WebRoot/ssl/cheetah.keystore -export -alias cheetah -file e:\ssl\server.cer

7:证书导入到jdk默认的keystore

keytool -import -trustcacerts -alias cheetah -file e:\ssl\server.cer  -keystore  "%JAVA_HOME%/jre/lib/security/cacerts" -storepass changeit

8:删除keystore中的证书
keytool -delete -alias cheetah -keystore "%JAVA_HOME%/jre/lib/security/cacerts" -storepass changeit

按上面步骤1、4生成证书，按下面代码启动ssl连接

        SslSocketConnector ssl_connector = new SslSocketConnector();

        ssl_connector.setPort(8090);

        SslContextFactory cf = ssl_connector.getSslContextFactory();

        cf.setKeyStorePath("WebRoot/ssl/cheetah.keystore");

        cf.setKeyStorePassword("cheetah");

        cf.setKeyManagerPassword("cheetah");

        _server.addConnector(ssl_connector);

如果Firefox中出现Error code: ssl_error_weak_server_ephemeral_dh_key 然后就打不开了。

需要修改的话，进去about:config 里，把下面两个值从true改成false security.ssl3.dhe_rsa_aes_128_sha=false security.ssl3.dhe_rsa_aes_256_sha=false