Apache Tomcat SSL 问题
我正在尝试将 Apache Tomcat 配置为使用带有客户端身份验证的 SSL 连接（双向身份验证）。我的证书是 CA 签名的。 如果我将 CA 证书与客户端证书一起放入 tomcat 信任库中，则一切正常。如果我不将 CA 证书放入 tomcat 信任库中，Tomcat 将不会信任客户端。
tomcat 信任库中是否需要 CA 证书？
如果我将 CA 证书放入 truststre 中，那么 Tomcat 将信任拥有由同一 CA 签名的证书的每个客户端。
I'm trying to configure Apache Tomcat to use SSL connection with client authentication (two way authentication). My certificates are CA signed.
If I put CA certificate, together with client certificates, in tomcat truststore everything is OK. If I don't put CA cert in tomcat truststore, Tomcat won't trust to clients.
Do I need CA certificate in tomcat truststore?
If I put CA certificate in truststre then Tomcat will trust to every client that have certificate signed by the same CA.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，您需要信任库中的 CA。如果您不愿意将 CA 放入信任库中，则不应使用该 CA。
关于最后一段，您还可以检查客户端证书的可分辨名称以进行进一步授权。
Yes, you need the CA in the truststore. If you are unwilling to put the CA in the truststore, you should not use the CA.
Regarding your last paragraph, you could also examine the Distinguished Name of the client certificates for further authorization.
您将信任或授权与身份验证混淆了。 SSL 证书的唯一目的是证明对等方就是他所说的那个人，即建立他的身份。在签署 CSR 之前，您需要决定是否信任该 CA 的身份验证程序，如果是，则将其证书放入信任库中。
您是否希望该身份访问系统的某些部分是一个完全不同的问题，您必须通过授予身份的角色数据库以不同的方式解决该问题。这是 LDAP 特别擅长的事情，但您也可以在 Tomcat 中使用 DBMS 甚至 XML 文件。查看 Tomcat Realms 了解如何执行此操作。
您绝对不能尝试使用信任库作为该数据库。这不是它的用途，也不是它或 PKI 设计的目的。这就是为什么您在尝试以这种方式使用它时遇到问题。
You are confusing trust, or authorization, with authentication. The only purpose of SSL certificates is to prove that the peer is who he says he is, i.e. establish his identity. You need to decide whether or not you trust that CA's procedures for verifying identity prior to signing CSRs, and if so put its certificate into the truststore.
Whether you want that identity to access parts of your system is a completely different question which you must solve in a different way, via a database of roles granted to identities. This is something that LDAP is particularly good at, but you can also use a DBMS or even an XML file in Tomcat. Have a look at Tomcat Realms for how to do this.
What you mustn't do is attempt to use the truststore as that database. That's not what it's for, and not the purpose for which it or PKI was designed. Which is why you're having problems trying to use it that way.