[리눅스] Tomcat 시스템 프로토콜 변경(http -> https)

Tomcat 시스템 프로토콜 변경(http -> https)

• pasdev.scbyun.com.pfx 인증서 패스워드 : 1234
• 기본 keystore 패스워드 : changeit

1. pfx를 jks로 변환 후 keystore에 저장

keytool -importkeystore -srckeystore /home/anti1346/pasdev.scbyun.com.pfx -srcstoretype pkcs12 -destkeystore /usr/lib/jvm/java-7-oracle/jre/lib/security/cacerts -deststoretype JKS

$ keytool -importkeystore -srckeystore /home/anti1346/pasdev.scbyun.com.pfx -srcstoretype pkcs12 -destkeystore /usr/lib/jvm/java-7-oracle/jre/lib/security/cacerts -deststoretype JKS
대상 키 저장소 비밀번호 입력: 
소스 키 저장소 비밀번호 입력:
te-86513747-9c5f-4036-a2f0-dc8570c37185 별칭에 대한 항목이 성공적으로 임포트되었습니다.
임포트 명령 완료: 성공적으로 임포트된 항목은 1개, 실패하거나 취소된 항목은 0개입니다.

2. keystore에 있는 인증서 확인

keytool -list -v -keystore cacerts -storepass changeit | grep "korea"

$ keytool -list -v -keystore cacerts -storepass changeit | grep "korea"
소유자: CN=pasdev.scbyun.com
발행자: CN=ScbyunIssuingCA, DC=scbyun, DC=com
   accessLocation: URIName: http://keseldc102.scbyun.com/CertEnroll/keseldc102.scbyun.com_ScbyunIssuingCA(2).crt
     [URIName: ldap:///CN=ScbyunIssuingCA,CN=keseldc102,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=sangchulgroup,DC=net?certificateRevocationList?base?objectClass=cRLDistributionPoint, URIName: http://keseldc102.scbyun.com/CertEnroll/ScbyunIssuingCA.crl]
소유자: CN=ScbyunIssuingCA, DC=scbyun, DC=com
발행자: CN=ScbyunPolicyCA, DC=scbyun, DC=com
   accessLocation: URIName: http://policyca.scbyun.com/CertData/keseldc101.scbyun.com_ScbyunPolicyCA(1).crt
     [URIName: ldap:///CN=ScbyunPolicyCA,CN=keseldc101,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=sangchulgroup,DC=net?certificateRevocationList?base?objectClass=cRLDistributionPoint, URIName: http://policyca.scbyun.com/CertData/ScbyunPolicyCA.crl]
0010: 63 61 2E 6B 6F 72 65 61   6E 61 69 72 2E 63 6F 6D  ca.scbyun.com
소유자: CN=ScbyunPolicyCA, DC=scbyun, DC=com
0010: 61 2E 6B 6F 72 65 61 6E   61 69 72 2E 63 6F 6D 2F  a.scbyun.com/

 

[에러]

nested exception is:

javax.net.ssl.SSLHandshakeException:

sun.security.validator.ValidatorException:

PKIX path building failed:

sun.security.provider.certpath.SunCertPathBuilderException:

unable to find valid certification path to requested target

 

참고URL

- https://www.sslshopper.com/article-most-common-java-keytool-keystore-commands.html