SSL证书安装教程

article/2025/11/7 19:15:23

Nginx配置SSL证书

最基本的配置

ssl_certificate "path\fullchain.crt"

ssl_certificate_key "path\private.crt"

server
{listen 80;listen 443 ssl http2;ssl_certificate path\fullchain.crt;ssl_certificate_key path\private.crt;ssl_session_timeout 1d;ssl_session_cache shared:MozSSL:10m;ssl_session_tickets off;ssl_protocols TLSv1.2 TLSv1.3;ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;ssl_prefer_server_ciphers off;# 开启OCSP staplingssl_stapling on;ssl_stapling_verify on;
}

Apache配置SSL证书

基本SSL参数

# 通用性
SSLProtocol             all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite          ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384
SSLHonorCipherOrder     off
SSLSessionTickets       off# 开启 OCSP Stapling(建议)
SSLUseStapling On
SSLStaplingCache "shmcb:logs/ssl_stapling(32768)"

<VirtualHost *:443>SSLEngine onSSLCertificateFile      /path/fullchain.crtSSLCertificateKeyFile   /path/private.crt
</VirtualHost>

Tomcat配置SSL证书

tomcat 需要修改tomcat/conf下的server.xml文件

支持pfx文件和jks文件

pfx文件

核心配置[Tomcat7及以上]

keystoreFile="/path/certificate.pfx"

keystoreType="PKCS12"

keystorePass="证书密码"

certificate.pfx压缩包里有，密码在detail.txt文件中。你也可以自行生成PFX文件。

<!--一种配置示例[pfx]
-->
<Connector port="443" protocol="HTTP/1.1" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" keystoreFile="/path/certificate.pfx" keystoreType="PKCS12" keystorePass="证书密码" clientAuth="false" sslProtocol="TLS" />

jks文件

核心配置

keystoreFile="/path/certificate.pfx"

keystorePass="证书密码"

本站不直接提供该文件，通过Tomcat的keytool生成jks文件,参考命令

keytool -importkeystore -srckeystore path/certificate.pfx -destkeystore path/certificate.jks -srcstoretype PKCS12 -deststoretype JKS

更多参考
1、Mozilla：Mozilla SSL Configuration Generator
2、阿里云：Tomcat服务器安装SSL证书 - 数字证书管理服务 - 阿里云
3、腾讯云：SSL 证书 Tomcat 服务器 SSL 证书安装部署（JKS 格式）-证书安装-文档中心-腾讯云，SSL 证书 Tomcat 服务器 SSL 证书安装部署（PFX 格式）-证书安装-文档中心-腾讯云