# 安装APR库
apt update
apt install libapr1 libapr1-dev libssl-dev -y

# 查看APR版本
apr-1-config –version

# 输出示例：
1.7.0

# 配置Tomcat APR连接器
cat > /Tomcat/app/conf/server.xml << EOF










EOF

# 重启Tomcat服务
/Tomcat/app/bin/shutdown.sh
/Tomcat/app/bin/startup.sh

# 查看Tomcat日志，确认APR已加载
cat /Tomcat/app/logs/catalina.out | grep “APR”

# 输出示例：
INFO: Loaded APR based Apache Tomcat Native library [1.2.30] using APR version [1.7.0].
INFO: APR capabilities: IPv6 [true], sendfile [true], accept filters [true], random [true].

# 测试APR连接器
curl http://localhost:8080/

# 输出示例：

It works!

# 查看APR性能
# 使用ab工具进行压力测试
ab -n 1000 -c 10 http://localhost:8080/

# 输出示例：
Server Software: Apache-Coyote/1.1
Server Hostname: localhost
Server Port: 8080

Document Path: /
Document Length: 123

Concurrency Level: 10
Time taken for tests: 1.234 seconds
Complete requests: 1000
Failed requests: 0
Total transferred: 123000 bytes
HTML transferred: 123000 bytes
Requests per second: 810.23 [#/sec] (mean)
Time per request: 12.345 [ms] (mean)
Time per request: 1.234 [ms] (mean, across all concurrent requests)
Transfer rate: 99.68 [Kbytes/sec] received
99.68 [Kbytes/sec] send

# 生成自签名证书
mkdir -p /Tomcat/app/ssl
cd /Tomcat/app/ssl

# 生成私钥
openssl genrsa -out server.key 2048

# 输出示例：
Generating RSA private key, 2048 bit long modulus
…………………………………………..+++++
……..+++++
e is 65537 (0x10001)

# 生成证书签名请求
openssl req -new -key server.key -out server.csr

# 输出示例：
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter ‘.’, the field will be left blank.
—–
Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:Beijing
Locality Name (eg, city) []:Beijing
Organization Name (eg, company) [Internet Widgits Pty Ltd]:fgedu
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:fgedu.net.cn
Email Address []:admin@fgedu.net.cn

# 生成自签名证书
openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt

# 输出示例：
Signature ok
subject=/C=CN/ST=Beijing/L=Beijing/O=fgedu/OU=IT/CN=fgedu.net.cn/emailAddress=admin@fgedu.net.cn
Getting CA Private Key
Getting Private Key

# 配置Tomcat HTTPS连接器
cat > /Tomcat/app/conf/server.xml << EOF















EOF

# 重启Tomcat服务
/Tomcat/app/bin/shutdown.sh
/Tomcat/app/bin/startup.sh

# 测试HTTPS连接
curl -k https://localhost:8443/

# 输出示例：

It works!

# 查看SSL证书信息
openssl s_client -connect localhost:8443 -showcerts

# 输出示例：
CONNECTED(00000003)
Certificate chain
0 s:/C=CN/ST=Beijing/L=Beijing/O=fgedu/OU=IT/CN=fgedu.net.cn/emailAddress=admin@fgedu.net.cn
i:/C=CN/ST=Beijing/L=Beijing/O=fgedu/OU=IT/CN=fgedu.net.cn/emailAddress=admin@fgedu.net.cn
—
Server certificate
subject=/C=CN/ST=Beijing/L=Beijing/O=fgedu/OU=IT/CN=fgedu.net.cn/emailAddress=admin@fgedu.net.cn
issuer=/C=CN/ST=Beijing/L=Beijing/O=fgedu/OU=IT/CN=fgedu.net.cn/emailAddress=admin@fgedu.net.cn
—
No client certificate CA names sent
—
Peer signing digest: SHA256
Server Temp Key: ECDH, P-256, 256 bits
—
SSL handshake has read 0 bytes and written 289 bytes
—
New, TLSv1.3, Cipher is TLS_AES_256_GCM_SHA384
Server public key is 2048 bit
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
—

# 创建证书管理脚本
cat > /Tomcat/app/scripts/cert_manager.sh << EOF #!/bin/bash # cert_manager.sh # from:www.itpux.com.qq113257174.wx:itpux-com # web: `http://www.fgedu.net.cn` CERT_DIR="/Tomcat/app/ssl" BACKUP_DIR="/Tomcat/app/ssl/backup" DATE=$(date +%Y%m%d) # 备份当前证书 mkdir -p BACKUP_DIR cp CERT_DIR/server.key BACKUP_DIR/server.key.DATE cp CERT_DIR/server.crt BACKUP_DIR/server.crt.DATE # 检查证书有效期 EXPIRE_DATE=$(openssl x509 -in CERT_DIR/server.crt -noout -dates | grep notAfter | cut -d= -f2) EXPIRE_EPOCH=$(date -d "EXPIRE_DATE" +%s) CURRENT_EPOCH=$(date +%s) DAYS_LEFT=$(( (EXPIRE_EPOCH - CURRENT_EPOCH) / 86400 )) echo "Certificate expires in DAYS_LEFT days" # 如果证书即将过期（30天内），发送告警 if [ DAYS_LEFT -lt 30 ]; then echo "WARNING: Certificate will expire in DAYS_LEFT days" # 发送邮件告警 echo "Certificate will expire in DAYS_LEFT days" | mail -s "Certificate Expiration Warning" admin@fgedu.net.cn fi # 清理旧备份（保留最近30天） find BACKUP_DIR -name "*.key.*" -mtime +30 -delete find BACKUP_DIR -name "*.crt.*" -mtime +30 -delete EOF # 设置脚本权限 chmod +x /Tomcat/app/scripts/cert_manager.sh # 配置定时任务 # 编辑crontab crontab -e # 添加以下行（每天凌晨2点检查证书） # 0 2 * * * /Tomcat/app/scripts/cert_manager.sh # 手动运行证书管理脚本 /Tomcat/app/scripts/cert_manager.sh # 输出示例： Certificate expires in 365 days # 更新证书 # 1. 生成新的私钥 openssl genrsa -out /Tomcat/app/ssl/server.key.new 2048 # 2. 生成新的证书签名请求 openssl req -new -key /Tomcat/app/ssl/server.key.new -out /Tomcat/app/ssl/server.csr.new # 3. 生成新的自签名证书 openssl x509 -req -days 365 -in /Tomcat/app/ssl/server.csr.new -signkey /Tomcat/app/ssl/server.key.new -out /Tomcat/app/ssl/server.crt.new # 4. 备份旧证书 cp /Tomcat/app/ssl/server.key /Tomcat/app/ssl/server.key.old cp /Tomcat/app/ssl/server.crt /Tomcat/app/ssl/server.crt.old # 5. 替换新证书 mv /Tomcat/app/ssl/server.key.new /Tomcat/app/ssl/server.key mv /Tomcat/app/ssl/server.crt.new /Tomcat/app/ssl/server.crt # 6. 重启Tomcat服务 /Tomcat/app/bin/shutdown.sh /Tomcat/app/bin/startup.sh # 验证新证书 openssl x509 -in /Tomcat/app/ssl/server.crt -noout -text | grep "Subject" # 输出示例： Subject: C = CN ST = Beijing L = Beijing O = fgedu OU = IT CN = fgedu.net.cn emailAddress = admin@fgedu.net.cn # 测试HTTPS连接 curl -k https://localhost:8443/ # 输出示例：

It works!

更多学习教程公众号风哥教程itpux_com