untitled

Size: px

Start display at page:

Download "untitled"

暌符
9 years ago
Views:

1 行年度說年

2 錄 SSL 說 SSL? 金...5 SSL ( Secure Socket Layer )...5 金 SSL AP Server...7 參 HCA...17 HCA ( HCA 路列 )...17 說 HCA 參...19 I

3 錄 1 SSL 流 SSL 流 Sun Application Console 理 Sun Application Console 理 HTTP HCA HCA 流 HCA 流 HCA 流 HCA 流 HCA 流 II

..13 4 Sun Application Console 理 2...14 5 HTTP...15 6.

4 SSL 說 Intranet Internet 料 (Client) (Server) 立料路了 Internet 行來不路更不 Internet TCP/IP TCP/IP 不讀亂路路 SSL? SSL 行料行連都行 1

5 流 1 SSL 流 1 2

6 2 SSL 流 2 3

7 Web 1 行理理行 Web 2 Web Sun Application Server (1) Web 理 (2) Sun Application Server Web 3(1) 立行 Web 理行行不理 (1) 不不 (2) 4

8 金 SSL ( Secure Socket Layer ) Web 料 Netscape 1994 年 Web 流了路 SSL (Secure Socket Layer) 料路料 SSL 料兩兩 SSL Internet SSL 利金 (RSA) 來料 SSL Client/Server 不行 Client 行 SSL (Application Layer) (TCP) 料 TCP/IP 行 Web 流 SSL HTTP Internet 金行料都 SSL 128 / 256 行易料 SSL 料料路金 1 金 public key infranstructures, PKI 金金 PKI 金理 CA 金 1 錄金 5

SSL (Application Layer) (TCP) 料 TCP/IP 行 Web 流 SSL HTTP Internet 金行料都 SSL 128 /

9 行金不料 2 金金金不金 1978 年 MIT Ron RivestAdi Shamir Len Adleman 金 RSA 了金了數數數都易數數兩金理金 RSA DSA 兩流行數數金路 SSL/TLS, VPNs 3 兩不金金金金金金金金理讀金利金來金金留金 2 錄 3 錄 6

10 RSA RSA RSA 1977 年羅李 Ron Rivest Adi Shamir 倫 Leonard Adleman 都省理 RSA SSL AP Server 說行 Web 流 SSL HTTP Internet Client Web 流 Application Server 都 SSL Weblogical ServerTomcat Sun Application Server () SSL 說 WebLogic Server SSL Tomcat 6 SSL SSL 7

Client Web 流 Application Server 都 SSL Weblogical ServerTomcat

11 () WebLogic Server SSL 4 SSL SSL 數 SSL 不 SSL 立 SSL 數 SSL Web 行 SSL 參 SSL 流 WebLogic Server 行 SSL WebLogic Server config.xml 來 WebLogic Server SSL 參 WebLogic Server 8.1 Configuring Two-Way SSL config.xml WebLogic Server 行 SSL config.xml 錄例 Workshop SamplesApp config.xml BEA_HOME\weblogic81\samples\workshop\config.xml config.xml <SSL> TwoWaySSLEnabled True SSL <SSL Enabled="true" TwoWaySSLEnabled="true" IdentityAndTrustLocations="KeyStores" ListenPort="7002" Name="cgServer"/> SSL 不 SSL SSL 數數 SSL TwoWaySSLEnabled ClientCertificateEnforced True SSL <SSL TwoWaySSLEnabled="true" ClientCertificateEnforced="true" Enabled="true" IdentityAndTrustLocations="KeyStores" ListenPort="7002" Name="cgServer"/> config.xml <SSL> 參 WebLogic Server 8.1 SSL 4 錄 8

xml <SSL> TwoWaySSLEnabled True SSL <SSL Enabled="true" TwoWaySSLEnabled="true" IdentityAndTrustLocations="KeyStores" ListenPort="7002" Name="cgServer"/> SSL 不 SSL SSL 數數 SSL

12 Web 來參 () Tomcat 6 SSL 5 Tomcat 6 SSL 易 JDK keytool 來 Tomcat SSL JDK 5.0 Tomcat keytool Tomcat 數 localhostkeystore C:\tomcat.keystore 令 password 令 Tomcat 數不 localhost 數流不 5 錄 9

$16 keytool Tomcat 數 localhostkeystore C:\tomcat.$

13 localhost 流便來了利 IE Firefox PKCS12 令 C:\my.p12 CN my.p12 IE Firefox SSL 不 PKCS12 CER 令 10

14 令 C:\my.cer 了 list 令兩 11

15 Tomcat Tomcat 錄 /conf/server.xml <Connector port="8443" protocol="http/1.1" SSLEnabled="true" /> maxthreads="150" scheme="https" secure="true" clientauth="true" sslprotocol="tls" keystorefile="c:/tomcat.keystore" keystorepass="password" truststorefile="c:/tomcat.keystore" truststorepass="password" clientauth false SSL SSL clientauth true SSL clientauth want 不了 clientauth="true" C:\my.p12 IE Tomcat IE 行 FireFox FireFox () Sun Application Server SSL 12

keystorefile="c:/tomcat.keystore" keystorepass="password" truststorefile="c:/tomcat.

16 Sun Application Server 行 Web Server Web 理了 SSL Client Client 行 Client Sun Application Server SSL 1 Sun Application Console 理 Sun Application Server SSL Sun Application Server Console 理行理 3 Sun Application Console 理 1 13

Application Console 理 Sun Application Server SSL Sun

17 4 Sun Application Console 理 2 2 HTTP Sun Application Server 便了 SSL Server Server 行行 https 行 Client 行 SSL 行 8182 Port 說 (1) HTTP 理 [] [ server-config( 理 ) HTTP HTTP ] 14

18 5 HTTP (2) : 行 [] A 6 例 15

19 (3) SSL [http-listener-3] 連 Port HTTP HTTPS 連 Port [8182]Port SSL [Server] 若 SSL Sun Application Server Client 行 SSL3/TLS SSL3 TLS [] (4) 行便立 8182 Port SSL 3 RootCA Server 來 Server RootCA 行來 RootCA Server Server RootCA Command HCA Root /usr/sfw/bin/certutil -A -n "HCA" -t "TC,c,c" -i HCA.cer d GRCA Root /usr/sfw/bin/certutil -A -n "GRCA" -t "T,c,c" -i GRCA.cer -d 16

Server RootCA 行來 RootCA Server Server RootCA Command HCA Root /usr/sfw/bin/certutil -A -n

20 參 HCA HCA ( HCA 路列 ) 17

21 7 HCA 1 (ServerAP) 18

22 2 行 CSR 3 2 HCA 行說 HCA 參 1 2 行 CSR 3 連 HCA (1) > IC / 8 HCA 流 1 19

23 (2) [] 9 HCA 流 2 (3) [] 10 HCA 流 3 20

24 (4) [] (5) [] 11 HCA 流 4 12 HCA 流 5 21

25 欄料參 HCA 1 欄說 HCA 聯來路 6 數牢 2 行 HCA 列 22

keystore weblogic.jks certreq.pem CA server.cer

keystore weblogic.jks certreq.pem CA server.cer \\\\\\\\\\\\ 2005 6 17 Windows 2000 Server WebLogic server 8.1 SP2 JDK1.4.2; IE 5.0 WebLogic8.1 www.cnca.net Guangdong Electronic Certification Authority 1...4 2...5 3...5 3.1...5 3.2 keystore weblogic.jks...5