1、生成CA自签文件
1.1 在openssl-0.9.8h-1-bin\bin进入cmd窗口
或者 cmd窗口路径到openssl-0.9.8h-1-bin\bin下
1.2
ras的秘钥长度：2048
存放ca公钥证书的路径：D:/cert_test/root_ca/ca_cert.pem
证书的有效期（天）： 3650
根证书配置文件：D:/jx_cert/conf/gen_ca.conf 根据自己的需要调整配置文件的私钥证书证书存放路径，颁发者名称等
openssl req -x509 -newkey rsa:2048 -out D:/cert_test/root_ca/ca_cert.pem -outform PEM -days 3650 -config "D:/jx_cert/conf/gen_ca.conf"
执行此命令需要设置根证书密码
本次测试设置的密码是：test
运行完成1.1和1.2会生成ca_cert.pem和ca_private_key.pem这两个文件
2、 生成tomcat.jks证书
tomcat.jsk证书存放路径：D:\cert_test\service\tomcat.jks
tomcat.jks证书密码：cert_test
颁发者名称（需要和配置名字的颁发者名称一样）：QTHD_CMBC_SMZF
命令行进入jre根目录，执行
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -genkey -keyalg RSA -dname "CN=127.0.0.1, OU=servers, O=QTHD_CMBC_SMZF"
运行该命令后会生成tomcat.jks文件，在tomcat/bin目录service.xml配置Https需要使用到该证书
生成的jks文件如下：
3、根据tomcat.jks证书生成服务器请求证书
tomcat.jks证书存放路径：D:\cert_test\service\tomcat.jks
tomcat.jks证书密码：cert_test
serverreq.pem证书存放路径：D:\cert_test\service\serverreq.pem
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -certreq -file D:\cert_test\service\serverreq.pem
运行该命令后会生成serverreq.pem文件
4、CA签署服务器证书
serverreq.pem证书存放路径：D:\cert_test\service\serverreq.pem
servercert.pem证书存放路径：D:\cert_test\service\servercert.pem
qthd_ca.conf配置文件存放路径：D:\jx_cert\qthd_ca\qthd_ca.conf 根据需要调整配置文件的信息
需在D:\cert_test目录下新建newcerts文件夹，需把index和serial放进D:\test目录下
openssl ca -in D:\cert_test\service\serverreq.pem -out D:\cert_test\service\servercert.pem -config "D:\jx_cert\conf\ca.conf"
执行此命令需要输入根证书密码，并且需要同意签署证书和同意请求认证提交
5、导入CA证书到keystore
tomcat.jks证书存放路径：D:\cert_test\service\tomcat.jks
tomcat.jks证书密码：cert_test
ca公钥证书路径：D:/cert_test/root_ca/ca_cert.pem
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias ca -import -trustcacerts -file D:/cert_test/root_ca/ca_cert.pem
执行此命令需要同意信任此证书
6、导入服务器证书到keystore
tomcat.jks证书路径：D:\cert_test\service\tomcat.jks
tomcat.jks证书密码：cert_test
servercert.pem证书存放路径：D:\cert_test\service\servercert.pem
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cert_test -storepass cert_test -alias tomcat -import -file D:\cert_test\service\servercert.pem
执行此命令可能会提示证书回复已安装在密钥库中，继续执行下一步即可
7、查看keystore受信列表
keytool -keystore D:\cert_test\service\tomcat.jks -keypass cmbc_smzf -storepass cert_test -list -v
8、将CA证书导入到受信keystore
truststore.jks证书路径：D:\cert_test\service\truststore.jks
truststore.jks证书密码：cert_test
ca公钥证书路径：D:\cert_test\root_ca\ca_cert.pem
keytool -keystore D:\cert_test\service\truststore.jks -keypass cert_test -storepass cert_test -alias ca -import -trustcacerts -file D:\cert_test\root_ca\ca_cert.pem
执行此命令时需要同意信任此证书，并且会生成truststore.jks证书
9、tomcat配置https
需要在tomcat/conf目录下调整service.xml文件
A、注释掉<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
B、在两个Connector中间添加
<Connector SSLEnabled="true" acceptCount="100" className="org.apache.coyote.http11.Http11Protocol"
clientAuth="true" connectionTimeout="30000" disableUploadTimeout="true" enableLookups="true"
keepAliveTimeout="30000" keystoreFile="D:\https\apache-tomcat-7.0.78\conf\ssl\tomcat.jks"
keystorePass="cert_test" maxIdleTime="60000" maxSpareThreads="100" maxThreads="350"
minSpareThreads="30" port="8443" scheme="https" secure="true" sslProtocol="TLS"
truststoreFile="D:\https\apache-tomcat-7.0.78\conf\ssl\truststore.jks" truststorePass="cert_test"/>
本文中路径如下，按自己实际路径填写 ：
tomcat.jks路径：D:\https\apache-tomcat-7.0.78\conf\ssl\tomcat.jks
tomcat.jks密码：cert_test
truststore.jks路径：D:\https\apache-tomcat-7.0.78\conf\ssl\truststore.jks
truststore.jks密码：cert_test
配置完成启动tomcat，并且访问服务：https://localhost:8443/。访问时如果提示此网站无法提供安全连接，说明tomcat配置https完成，请完成以下步骤，生成p12证书再次访问。
10、创建客户端秘钥
客户端key.pem路径：D:\cert_test\certs\lzq_testKey.pem
客户端req.pem路径：D:\cert_test\certs\lzq_testreq.pem
颁发者名称：ZAOMZ_CA
openssl req -newkey rsa:2048 -keyout D:\cert_test\certs\testKey.pem -keyform PEM -out D:\cert_test\certs\testreq.pem -outform PEM -subj "/O=ZAOMZ_CA/OU=ZAOMZ_CA/CN=qthd_test" -config "D:\jx_cert\openssl-0.9.8h-1-bin\share\openssl.cnf"
执行此命令会生成lzq_testKey.pem和lzq_testreq.pem
11、签发个人证书
客户端req.pem路径：D:\cert_test\certs\lzq_testreq.pem
客户端cert.pem路径：D:\cert_test\certs\lzq_testreqcert.pem
ca配置文件路径：D:\jx_cert\conf\ca.conf
openssl ca -in D:\cert_test\certs\testreq.pem -out D:\cert_test\certs\testreqcert.pem -config "D:\jx_cert\conf\ca.conf"
执行此命令时需要输入根证书密码：test
并且同意两个条件
12、制作个人p12证书
cert.pem文件路径：D:\cert_test\certs\lzq_testreqcert.pem
key.pem文件路径：D:\cert_test\certs\lzq_testKey.pem
p12证书路径：D:\cert_test\p12\lzq_test.p12
openssl pkcs12 -export -in D:\cert_test\certs\lzq_testreqcert.pem -inkey D:\cert_test\certs\lzq_testKey.pem -out D:\cert_test\p12\lzq_test.p12 -name lzq_test -chain -CAfile "D:\cert_test\root_ca\ca_cert.pem"
执行此命令需要输入三次密码。
到这里p12证书已经生成完成了，双击p12证书进行安装，安装时候需要输入证书密码：lzqtest，再次访问https://localhost:8443/，选择已经按照的p12证书即可
注：
如果只需要生成p12证书，请一直重复第10、11、12步骤