1修改server.xml

 <Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
    maxThreads="150" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS" keystoreType="JKS"
   keystoreFile="conf/ssl/server.jks（證書路徑）" keystorePass="證書密碼"       useBodyEncodingForURI="true" URIEncoding="UTF-8" />

2修改web.xml

<security-constraint>
        <web-resource-collection >
        <web-resource-name >SSL</web-resource-name>
        <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
        <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint></security-constraint>

3在conf目錄下 新建ssl文件目錄 進(jìn)入ssl目錄執(zhí)行操作

1.1創(chuàng)建CA私鑰

openssl genrsa -out ca.key 2048

創(chuàng)建CA證書

openssl req -new -x509 -days 3650 -key ca.key -out ca.crt -subj "/C=CN/ST=ZheJiang/L=HangZhou/O=NetEase/OU=CA"

1.2 生成服務(wù)器證書簽署請求和私鑰
創(chuàng)建服務(wù)器證書簽署請求CSR

  openssl genrsa -out server.key 2048

創(chuàng)建服務(wù)器證書簽署請求CSR

openssl req -new -days 365 -key server.key -out server.csr -subj "/C=CN/ST=ZheJiang/L=HangZhou/O=NetEase/OU=XX Server/CN=localhost"

使用自己的CA進(jìn)行簽署證書

openssl ca -in server.csr -out server.crt -cert ca.crt -keyfile ca.key

需要輸入2次確認(rèn)的y
轉(zhuǎn)換格式 需要輸入密碼
轉(zhuǎn)換為pkcs12格式

openssl pkcs12 -export -clcerts -in server.crt -inkey server.key -out server.p12

轉(zhuǎn)換為jks格式

 keytool -importkeystore -srckeystore server.p12 -destkeystore server.jks -srcstoretype pkcs12 -deststoretype jks

查看證書

keytool -list -v -keystore server.jks