编缉$CATALINA_HOEM/conf/server.xml配置文件,找到https端口配置处,7.0及以前版本默认应以下:html
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS"/>
修改以下:算法
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"/>
8.5及以后版本默认应以下:apache
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true"> <SSLHostConfig> <Certificate certificateKeystoreFile="conf/localhost-rsa.jks" type="RSA" /> </SSLHostConfig> </Connector>
修改以下:tomcat
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" maxThreads="150" SSLEnabled="true" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" > </Connector>
也就是先删除<SSLHostConfig>标签及其子标签,而后再和7.0以前版本同样追加。ide
若是不删除<SSLHostConfig>直接追加,启动会报错:conf/server.xml: Error at (92, 25) : Multiple SSLHostConfig elements were provided for the host name [_default_]. Host names must be unique.post
应该是说有两个证书的配置入口,8.5版本以后应该是推荐使用<SSLHostConfig>做为新的证书配置方法。但其实旧的配置方法仍是兼容的,因此咱们这里直接删除<SSLHostConfig>,而后再和7.0以前版本同样追加(下边的漏洞相似操做)。加密
尝试了一下变动为新的对应属性并无成功启动,若是已经在<SSLHostConfig>中配置其余内容,那只能本身研究一下该怎么写了。spa
2.禁用RC4(SSL/TLS 受诫礼(BAR-MITZVAH)攻击漏洞(CVE-2015-2808)【原理扫描】)
编缉$CATALINA_HOEM/conf/server.xml配置文件,找到https端口配置处,修改以下:.net
<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" maxThreads="150" SSLEnabled="true" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2" ciphers="TLS_ECDHE_RSA_WITAES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA"/>
说明:code
1.RC4与DES/AES同样是一种对称加密算法
2.算法的说明,TLS_RSA_WITH_AES_128_CBC_SHA256:TLS--SSL仍是TSL,RSA--所用非对称加密算法,AES--所用对称加密算法,128--对称加密分组长度,CBC--分组加密模式,SHA256--所用完整性验证算法
参考:
https://www.cnblogs.com/lsdb/p/7193291.html
http://www.mamicode.com/info-detail-1340430.html
https://www.chinassl.net/?f=faq&a=view&r=605
http://blog.csdn.net/baidu_18607183/article/details/51593586