单向验证，客户机只验证服务器的证书，服务器不验证客户机的证书。所以只需要生成服务器端的keystore.

1. 以jks格式生成服务器端包含Public key和Private Key的keystore文件，keypass与storepass务必要一样，因为在tomcat server.xml中只配置一个password. keytool -genkey -alias server -keystore serverKeystore.jks -keypass 123456 -storepass 123456 -keyalg RSA  -keysize 512 -validity 365 -v -dname "CN = W03GCA01A,O = ABC BANK,DC = Server Https,DC = ABC,OU = Firefly Technology And Operation" 2. 从keystore中导出别名为server的服务端证书. keytool -export -alias server -keystore serverKeystore.jks -storepass 123456 -file server.cer   3. 将server.cer导入客户端的信任证书库clientTruststore.jks。    keytool -import -alias trustServer -file server.cer -keystore clientTruststore.jks -storepass 123456    服务器端： serverKeystore.jks   客户端：   clientTruststore.jks   4. 在tomcat 配置server.xml

Xml代码  

1. <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"  

2.                  maxThreads="150" scheme="https" secure="true"  

3.              clientAuth="false" sslProtocol="TLS"   

4.              keystoreFile="keystore/serverKeystore.jks" keystorePass="123456"  />  

5. 客户端代码

Java代码  

1. /** 

2.  *  

3.  */  

4. package com.ssl.http;  

5.   

6. import java.io.File;  

7. import java.io.FileInputStream;  

8. import java.security.KeyStore;  

9.   

10. import org.apache.http.HttpEntity;  

11. import org.apache.http.HttpResponse;  

12. import org.apache.http.client.methods.HttpGet;  

13. import org.apache.http.conn.scheme.Scheme;  

14. import org.apache.http.conn.ssl.SSLSocketFactory;  

15. import org.apache.http.impl.client.DefaultHttpClient;  

16.   

17. /** 

18.  *  

19.  * @author kevin 

20.  * 

21.  */  

22. public class ClientOneWaySSL {  

23.   

24.     public final static void main(String[] args) throws Exception {  

25.         DefaultHttpClient httpclient = new DefaultHttpClient();  

26.   

27.         KeyStore trustStore  = KeyStore.getInstance(KeyStore.getDefaultType());          

28.         FileInputStream instream = new FileInputStream(new File("com/ssl/http/clientTruststore.jks"));   

29.         try {  

30.             trustStore.load(instream, "123456".toCharArray());  

31.         } finally {  

32.             instream.close();  

33.         }  

34.           

35.         SSLSocketFactory socketFactory = new SSLSocketFactory(trustStore);  

36.         Scheme sch = new Scheme("https", socketFactory, 8443);  

37.         httpclient.getConnectionManager().getSchemeRegistry().register(sch);  

38.   

39.         HttpGet httpget = new HttpGet("https://w03gca01a/");  

40.   

41.         System.out.println("executing request" + httpget.getRequestLine());  

42.           

43.         HttpResponse response = httpclient.execute(httpget);  

44.         HttpEntity entity = response.getEntity();  

45.   

46.         System.out.println("----------------------------------------");  

47.         System.out.println(response.getStatusLine());  

48.         if (entity != null) {  

49.             System.out.println("Response content length: " + entity.getContentLength());  

50.         }  

51.         if (entity != null) {  

52.             entity.consumeContent();  

53.         }  

54.   

55.         // When HttpClient instance is no longer needed,   

56.         // shut down the connection manager to ensure  

57.         // immediate deallocation of all system resources  

58.         httpclient.getConnectionManager().shutdown();          

59.     }  

60.   

61. }  

 

6. 运行成功打印如下：

Console代码  

1. executing requestGET https://w03gca01a/ HTTP/1.1  

2. ----------------------------------------  

3. HTTP/1.1 200 OK  

4. Response content length: 7347  

 

备注：

A. 如出现如下error，请配置C:\WINDOWS\system32\drivers\etc\hosts, 将“127.0.0.1     w03gca01a” 加在hosts文件中

Exception代码  

1. executing requestGET https://w03gca01a/ HTTP/1.1  

2. Exception in thread "main" javax.net.ssl.SSLException: hostname in certificate didn't match: <w03gca01a> != <localhost>  

3.     at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:220)  

4.     at org.apache.http.conn.ssl.BrowserCompatHostnameVerifier.verify(BrowserCompatHostnameVerifier.java:54)  

5.       

 

B. 本文用到 httpcore-4.0.1.jar httpclient-4.0.1.jar httpmime-4.0.1.jar，下载地址：

http://hc.apache.org/downloads.cgi