Ubuntu部署Tomcat8配置HTTPS遇ConnectionRefusedError问题求助

环境信息 #

系统：Ubuntu 22.04
Tomcat版本：8.0.3
Java版本：

openjdk version "1.8.0_382"
OpenJDK Runtime Environment (build 1.8.0_382-8u382-ga-1~22.04.1-b05)
OpenJDK 64-Bit Server VM (build 25.382-b05, mixed mode)

证书获取与转换 #

通过acme.sh获取Let's Encrypt证书：

acme.sh --issue --dns dns_namesilo -d example.com -d www.example.com --dnssleep 2000

证书列表：

root@server:/# acme.sh --list                                                                                
Main_Domain  KeyLength  SAN_Domains      CA               Created               Renew        
example.com  "ec-256"   www.example.com  LetsEncrypt.org  2023-11-02T19:40:54Z  2023-12-31T19:40:54Z 

生成的证书文件路径：

SSLCertificateFile="/root/.acme.sh/example.com_ecc/fullchain.cer"
SSLCACertificateFile="/root/.acme.sh/example.com_ecc/ca.cer"
SSLCertificateKeyFile="/root/.acme.sh/example.com_ecc/example.com.key"

将证书和密钥转换为PKCS12格式并导入keystore：

openssl pkcs12 -export -in /root/.acme.sh/example.com_ecc/example.com.cer -inkey /root/.acme.sh/example.com_ecc/example.com.key -name example.com -out example.com.p12

keytool -importkeystore -deststorepass changeit -destkeystore /root/.keystore -srckeystore example.com.p12 -srcstoretype PKCS12

生成的两个密钥库文件状态：

• example.com.jks（trustedCertEntry）：

root@server:/# keytool -list -keystore /example.com.jks
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

example.com, Nov 5, 2023, trustedCertEntry,
Certificate fingerprint (SHA-256)

• example.com.p12（PrivateKeyEntry）：

root@server:/# keytool -list -keystore /example.com.p12
Keystore type: PKCS12
Keystore provider: SUN

Your keystore contains 1 entry

example.com, Nov 5, 2023, PrivateKeyEntry,
Certificate fingerprint (SHA-256)

Tomcat SSL配置 #

修改server.xml中的Connector配置：

...
    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
               SSLEnabled="true" maxThreads="150" scheme="https" secure="true"
               keystoreAlias="example.com"
               keystoreFile="/example.com.p12"
               keystorePass="changeit"
               clientAuth="false" sslProtocol="TLS" />
...

问题现象 #

配置完成后，访问443端口被拒绝：

root@server:/# openssl s_client -connect example.com:443
4047E1C40B7F0000:error:8000006F:system library:BIO_connect:Connectionrefused:../crypto/bio/bio_sock2.c:125:calling connect()
4047E1C40B7F0000:error:10000067:BIO routines:BIO_connect:connect error:../crypto/bio/bio_sock2.c:127:connect:errno=111

检查端口状态，443端口处于关闭状态：

root@server:/# nmap -p 443 example.com --reason
Starting Nmap 7.80 ( https://nmap.org ) at 2023-11-06 23:36 +03
Nmap scan report for example.com
Host is up, received localhost-response (0.00012s latency).

PORT    STATE  SERVICE REASON
443/tcp closed https   reset ttl 64

Nmap done: 1 IP address (1 host up) scanned in 0.29 seconds

查看监听端口，Tomcat仅监听8443端口（IPv6）：

root@server:/# netstat -anltp | grep LISTEN                                                                  
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      229/systemd-resolve          
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      336/sshd: /usr/sbin          
tcp6       0      0 :::8080                 :::*                    LISTEN      254540/java                  
tcp6       0      0 :::22                   :::*                    LISTEN      336/sshd: /usr/sbin          
tcp6     101      0 :::8443                 :::*                    LISTEN      254540/java                  
tcp6       0      0 127.0.0.1:8005          :::*                    LISTEN      254540/java                  
tcp6       0      0 :::8009                 :::*                    LISTEN      254540/java

UFW已允许443端口：

root@server:/# ufw status numbered
Status: active

     To                         Action      From
     --                         ------      ----
[ 1] 22/tcp                     ALLOW IN    Anywhere
[ 2] 22                         ALLOW IN    Anywhere
[ 3] 80                         ALLOW IN    Anywhere
[ 4] 443                        ALLOW IN    Anywhere
[ 5] 8080                       ALLOW IN    Anywhere
[ 6] 8443                       ALLOW IN    Anywhere
[ 7] OpenSSH                    ALLOW IN    Anywhere

端口进程关联：

• 8080端口：

root@server:/# lsof -i:8080
COMMAND    PID     USER     FD   TYPE     DEVICE SIZE/OFF  NODE  NAME
java       254540  tomcat   57u  IPv6     2619532819       0t0   TCP *:http-alt (LISTEN)

• 8443端口：

root@server:/# lsof -i:8443
COMMAND    PID     USER     FD   TYPE     DEVICE SIZE/OFF  NODE  NAME                                               
java       254540  tomcat   58u  IPv6     2619532820       0t0   TCP *:8443 (LISTEN)

• 80端口：

root@server:/# lsof -i:80
COMMAND  PID  USER   FD   TYPE     DEVICE SIZE/OFF   NODE  NAME                                                    
dhpcd    431  root   10u  IPv4     2625048130        0t0   TCP server.example.com:36174->ns31430745.ip-141-94-96.eu:http (ESTABLISHED)

补充测试 #

测试8443端口SSL握手失败：

root@server:/# openssl s_client -connect example.com:8443
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 321 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

解决方案 #

问题根源在于iptables重定向规则异常，需执行以下操作：

1. 删除异常的PREROUTING规则（根据实际规则填写完整命令）：

iptables -t nat -D PREROUTING...

2. 永久保存iptables规则：

/sbin/iptables-save > /etc/iptables/rules.v4
/sbin/ip6tables-save > /etc/iptables/rules.v6

内容的提问来源于stack exchange，提问作者OzanD