Spring配置：启用Jetty SSL传输的CXF
Spring配置文件
|
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 |
<beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:sec="http://cxf.apache.org/configuration/security" xmlns:http="http://cxf.apache.org/transports/http/configuration" xmlns:httpj="http://cxf.apache.org/transports/http-jetty/configuration" xmlns:cxf="http://cxf.apache.org/core" xmlns:jaxws="http://cxf.apache.org/jaxws" xsi:schemaLocation=" http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/transports/http-jetty/configuration http://cxf.apache.org/schemas/configuration/http-jetty.xsd http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd http://cxf.apache.org/core http://cxf.apache.org/schemas/core.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd "> <import resource="classpath:META-INF/cxf/cxf.xml" /> <import resource="classpath:META-INF/cxf/cxf-extension-jaxws.xml" /> <cxf:bus> <cxf:features> <cxf:logging /> </cxf:features> </cxf:bus> <bean id="cfg" class="sparknet.canary.core.cfg" init-method="init"> <property name="params"> <value> <![CDATA[ http.port=5050 https.port=5051 https.keyManagers.keyStore.type=JKS https.keyManagers.keyPassword=sparknet https.keyManagers.keyStore.password=sparknet https.keyManagers.keyStore.url=#{@cfg.baseDirUrl}/work/security/key/platform.jks https.trustManagers.keyStore.type=JKS https.trustManagers.keyStore.password=sparknet https.trustManagers.keyStore.url=#{@cfg.baseDirUrl}/work/security/cert/trust.jks http.minThreads=5 http.maxThreads=50 ]]> </value> </property> </bean> <bean name="dataTransServiceImplHttp" class="cc.gmem.demo.ws.DataTransServiceImpl" autowire="byName"> <property name="https" value="false" /> </bean> <bean name="dataTransServiceImplHttps" class="cc.gmem.demo.ws.DataTransServiceImpl" autowire="byName"> <property name="https" value="true" /> </bean> <jaxws:endpoint id="dataTransServiceHttp" implementor="#dataTransServiceImplHttp" address="http://0.0.0.0:#{@cfg.params['http.port']}/dataTransService" publish="true" /> <jaxws:endpoint id="dataTransServiceHttps" implementor="#dataTransServiceImplHttps" address="https://0.0.0.0:#{@cfg.params['https.port']}/dataTransService" publish="true" /> <httpj:engine-factory bus="cxf"> <httpj:identifiedThreadingParameters id="threadPool"> <httpj:threadingParameters minThreads="#{@cfg.params['http.minThreads']}" maxThreads="#{@cfg.params['http.maxThreads']}" /> </httpj:identifiedThreadingParameters> <httpj:engine port="#{@cfg.params['http.port']}"> <httpj:threadingParametersRef id="threadPool" /> <httpj:connector> <bean class="org.eclipse.jetty.server.bio.SocketConnector"> <property name="port" value="#{@cfg.params['http.port']}" /> </bean> </httpj:connector> </httpj:engine> <httpj:engine port="#{@cfg.params['https.port']}"> <httpj:tlsServerParameters> <sec:keyManagers keyPassword="#{@cfg.params['https.keyManagers.keyPassword']}"> <sec:keyStore type="#{@cfg.params['https.keyManagers.keyStore.type']}" url="#{@cfg.params['https.keyManagers.keyStore.url']}" password="#{@cfg.params['https.keyManagers.keyStore.password']}" /> </sec:keyManagers> <sec:trustManagers> <sec:keyStore type="#{@cfg.params['https.trustManagers.keyStore.type']}" url="#{@cfg.params['https.trustManagers.keyStore.url']}" password="#{@cfg.params['https.trustManagers.keyStore.password']}" /> </sec:trustManagers> <sec:cipherSuitesFilter> <sec:include>.*_EXPORT_.*</sec:include> <sec:include>.*_EXPORT1024_.*</sec:include> <sec:include>.*_WITH_DES_.*</sec:include> <sec:include>.*_WITH_AES_.*</sec:include> <sec:include>.*_WITH_NULL_.*</sec:include> <sec:exclude>.*_DH_anon_.*</sec:exclude> </sec:cipherSuitesFilter> <sec:clientAuthentication want="true" required="true" /> </httpj:tlsServerParameters> <httpj:threadingParametersRef id="threadPool" /> <httpj:connector> <bean class="org.eclipse.jetty.server.ssl.SslSocketConnector"> <property name="port" value="#{@cfg.params['https.port']}" /> <property name="password" value="#{@cfg.params['https.keyManagers.keyStore.password']}" /> <property name="trustPassword" value="#{@cfg.params['https.trustManagers.keyStore.password']}" /> <property name="keyPassword" value="#{@cfg.params['https.keyManagers.keyPassword']}" /> <property name="protocol" value="TLS" /> <property name="keystore" value="#{@cfg.params['https.keyManagers.keyStore.url']}" /> <property name="keystoreType" value="#{@cfg.params['https.keyManagers.keyStore.type']}" /> <property name="truststore" value="#{@cfg.params['https.trustManagers.keyStore.url']}" /> <property name="truststoreType" value="#{@cfg.params['https.trustManagers.keyStore.type']}" /> <property name="wantClientAuth" value="false" /> <property name="needClientAuth" value="false" /> </bean> </httpj:connector> </httpj:engine> </httpj:engine-factory> </beans> |
使用JDK的keytool密钥对
使用JDK自带的keytool命令可以生成JKS（Java KeyStore）文件，作为数字证书库使用。在配置SSL时，一般需要用到两个JKS：信任库、证书库（对应上节配置文件中的truststore、keystore）。
下面是生成证书库的示例：
|
1 |
keytool -genkey -alias platform -keyalg RSA -keypass key_password -storepass store_password -dname "CN=DataTrans Platform, OU=, O=Gmem.cc, L=Nan Jing, ST=Jiang Su, C=CN" -validity 3650 -keystore platform.jks |
Leave a Reply