| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1 | <html><head><META http-equiv="Content-Type" content="text/html; charset=iso-8859-1"><title>Apache Tomcat 7 Configuration Reference (7.0.77) - The HTTP Connector</title><meta name="author" content="Craig R. McClanahan"><meta name="author" content="Yoav Shapira"><style type="text/css" media="print">
|
| 2 | .noPrint {display: none;}
|
| 3 | td#mainBody {width: 100%;}
|
| 4 | </style><style type="text/css">
|
| 5 | code {background-color:rgb(224,255,255);padding:0 0.1em;}
|
| 6 | code.attributeName, code.propertyName {background-color:transparent;}
|
| 7 |
|
| 8 |
|
| 9 | table {
|
| 10 | border-collapse: collapse;
|
| 11 | text-align: left;
|
| 12 | }
|
| 13 | table *:not(table) {
|
| 14 | /* Prevent border-collapsing for table child elements like <div> */
|
| 15 | border-collapse: separate;
|
| 16 | }
|
| 17 |
|
| 18 | th {
|
| 19 | text-align: left;
|
| 20 | }
|
| 21 |
|
| 22 |
|
| 23 | div.codeBox pre code, code.attributeName, code.propertyName, code.noHighlight, .noHighlight code {
|
| 24 | background-color: transparent;
|
| 25 | }
|
| 26 | div.codeBox {
|
| 27 | overflow: auto;
|
| 28 | margin: 1em 0;
|
| 29 | }
|
| 30 | div.codeBox pre {
|
| 31 | margin: 0;
|
| 32 | padding: 4px;
|
| 33 | border: 1px solid #999;
|
| 34 | border-radius: 5px;
|
| 35 | background-color: #eff8ff;
|
| 36 | display: table; /* To prevent <pre>s from taking the complete available width. */
|
| 37 | /*
|
| 38 | When it is officially supported, use the following CSS instead of display: table
|
| 39 | to prevent big <pre>s from exceeding the browser window:
|
| 40 | max-width: available;
|
| 41 | width: min-content;
|
| 42 | */
|
| 43 | }
|
| 44 |
|
| 45 | div.codeBox pre.wrap {
|
| 46 | white-space: pre-wrap;
|
| 47 | }
|
| 48 |
|
| 49 |
|
| 50 | table.defaultTable tr, table.detail-table tr {
|
| 51 | border: 1px solid #CCC;
|
| 52 | }
|
| 53 |
|
| 54 | table.defaultTable tr:nth-child(even), table.detail-table tr:nth-child(even) {
|
| 55 | background-color: #FAFBFF;
|
| 56 | }
|
| 57 |
|
| 58 | table.defaultTable tr:nth-child(odd), table.detail-table tr:nth-child(odd) {
|
| 59 | background-color: #EEEFFF;
|
| 60 | }
|
| 61 |
|
| 62 | table.defaultTable th, table.detail-table th {
|
| 63 | background-color: #88b;
|
| 64 | color: #fff;
|
| 65 | }
|
| 66 |
|
| 67 | table.defaultTable th, table.defaultTable td, table.detail-table th, table.detail-table td {
|
| 68 | padding: 5px 8px;
|
| 69 | }
|
| 70 |
|
| 71 |
|
| 72 | p.notice {
|
| 73 | border: 1px solid rgb(255, 0, 0);
|
| 74 | background-color: rgb(238, 238, 238);
|
| 75 | color: rgb(0, 51, 102);
|
| 76 | padding: 0.5em;
|
| 77 | margin: 1em 2em 1em 1em;
|
| 78 | }
|
| 79 | </style></head><body bgcolor="#ffffff" text="#000000" link="#525D76" alink="#525D76" vlink="#525D76"><table border="0" width="100%" cellspacing="0"><!--PAGE HEADER--><tr><td><!--PROJECT LOGO--><a href="http://tomcat.apache.org/"><img src="../images/tomcat.gif" align="right" alt="
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 80 | The Apache Tomcat Servlet/JSP Container
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 81 | " border="0"></a></td><td><h1><font face="arial,helvetica,sanserif">Apache Tomcat 7</font></h1><font face="arial,helvetica,sanserif">Version 7.0.77, Mar 28 2017</font></td><td><!--APACHE LOGO--><a href="http://www.apache.org/"><img src="../images/asf-logo.svg" align="right" alt="Apache Logo" border="0" style="width: 266px;height: 83px;"></a></td></tr></table><table border="0" width="100%" cellspacing="4"><!--HEADER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><tr><!--LEFT SIDE NAVIGATION--><td width="20%" valign="top" nowrap class="noPrint"><p><strong>Links</strong></p><ul><li><a href="../index.html">Docs Home</a></li><li><a href="index.html">Config Ref. Home</a></li><li><a href="http://wiki.apache.org/tomcat/FAQ">FAQ</a></li><li><a href="#comments_section">User Comments</a></li></ul><p><strong>Top Level Elements</strong></p><ul><li><a href="server.html">Server</a></li><li><a href="service.html">Service</a></li></ul><p><strong>Executors</strong></p><ul><li><a href="executor.html">Executor</a></li></ul><p><strong>Connectors</strong></p><ul><li><a href="http.html">HTTP</a></li><li><a href="ajp.html">AJP</a></li></ul><p><strong>Containers</strong></p><ul><li><a href="context.html">Context</a></li><li><a href="engine.html">Engine</a></li><li><a href="host.html">Host</a></li><li><a href="cluster.html">Cluster</a></li></ul><p><strong>Nested Components</strong></p><ul><li><a href="globalresources.html">Global Resources</a></li><li><a href="jar-scanner.html">JarScanner</a></li><li><a href="listeners.html">Listeners</a></li><li><a href="loader.html">Loader</a></li><li><a href="manager.html">Manager</a></li><li><a href="realm.html">Realm</a></li><li><a href="resources.html">Resources</a></li><li><a href="sessionidgenerator.html">SessionIdGenerator</a></li><li><a href="valve.html">Valve</a></li></ul><p><strong>Cluster Elements</strong></p><ul><li><a href="cluster.html">Cluster</a></li><li><a href="cluster-manager.html">Manager</a></li><li><a href="cluster-channel.html">Channel</a></li><li><a href="cluster-membership.html">Channel/Membership</a></li><li><a href="cluster-sender.html">Channel/Sender</a></li><li><a href="cluster-receiver.html">Channel/Receiver</a></li><li><a href="cluster-interceptor.html">Channel/Interceptor</a></li><li><a href="cluster-valve.html">Valve</a></li><li><a href="cluster-deployer.html">Deployer</a></li><li><a href="cluster-listener.html">ClusterListener</a></li></ul><p><strong>web.xml</strong></p><ul><li><a href="filter.html">Filter</a></li></ul><p><strong>Other</strong></p><ul><li><a href="systemprops.html">System properties</a></li></ul></td><!--RIGHT SIDE MAIN BODY--><td width="80%" valign="top" align="left" id="mainBody"><h1>The HTTP Connector</h1><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Table of Contents"><!--()--></a><a name="Table_of_Contents"><strong>Table of Contents</strong></a></font></td></tr><tr><td><blockquote>
|
| 82 | <ul><li><a href="#Introduction">Introduction</a></li><li><a href="#Attributes">Attributes</a><ol><li><a href="#Common_Attributes">Common Attributes</a></li><li><a href="#Standard_Implementation">Standard Implementation</a></li><li><a href="#Java_TCP_socket_attributes">Java TCP socket attributes</a></li><li><a href="#BIO_specific_configuration">BIO specific configuration</a></li><li><a href="#NIO_specific_configuration">NIO specific configuration</a></li><li><a href="#APR/native_specific_configuration">APR/native specific configuration</a></li></ol></li><li><a href="#Nested_Components">Nested Components</a></li><li><a href="#Special_Features">Special Features</a><ol><li><a href="#HTTP/1.1_and_HTTP/1.0_Support">HTTP/1.1 and HTTP/1.0 Support</a></li><li><a href="#Proxy_Support">Proxy Support</a></li><li><a href="#SSL_Support">SSL Support</a><ol><li><a href="#SSL_Support_-_BIO_and_NIO">SSL Support - BIO and NIO</a></li><li><a href="#SSL_Support_-_APR/Native">SSL Support - APR/Native</a></li></ol></li><li><a href="#Connector_Comparison">Connector Comparison</a></li></ol></li></ul>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 83 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Introduction"><strong>Introduction</strong></a></font></td></tr><tr><td><blockquote>
|
| 84 |
|
| 85 | <p>The <strong>HTTP Connector</strong> element represents a
|
| 86 | <strong>Connector</strong> component that supports the HTTP/1.1 protocol.
|
| 87 | It enables Catalina to function as a stand-alone web server, in addition
|
| 88 | to its ability to execute servlets and JSP pages. A particular instance
|
| 89 | of this component listens for connections on a specific TCP port number
|
| 90 | on the server. One or more such <strong>Connectors</strong> can be
|
| 91 | configured as part of a single <a href="service.html">Service</a>, each
|
| 92 | forwarding to the associated <a href="engine.html">Engine</a> to perform
|
| 93 | request processing and create the response.</p>
|
| 94 |
|
| 95 | <p>If you wish to configure the <strong>Connector</strong> that is used
|
| 96 | for connections to web servers using the AJP protocol (such as the
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 97 | <code>mod_jk 1.2.x</code> connector for Apache 1.3), please refer to the
|
| 98 | <a href="ajp.html">AJP Connector</a> documentation.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 99 |
|
| 100 | <p>Each incoming request requires
|
| 101 | a thread for the duration of that request. If more simultaneous requests
|
| 102 | are received than can be handled by the currently available request
|
| 103 | processing threads, additional threads will be created up to the
|
| 104 | configured maximum (the value of the <code>maxThreads</code> attribute).
|
| 105 | If still more simultaneous requests are received, they are stacked up
|
| 106 | inside the server socket created by the <strong>Connector</strong>, up to
|
| 107 | the configured maximum (the value of the <code>acceptCount</code>
|
| 108 | attribute). Any further simultaneous requests will receive "connection
|
| 109 | refused" errors, until resources are available to process them.</p>
|
| 110 |
|
| 111 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Attributes"><strong>Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 112 |
|
| 113 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Common Attributes"><!--()--></a><a name="Common_Attributes"><strong>Common Attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| 114 |
|
| 115 | <p>All implementations of <strong>Connector</strong>
|
| 116 | support the following attributes:</p>
|
| 117 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 118 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">allowTrace</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 119 | <p>A boolean value which can be used to enable or disable the TRACE
|
| 120 | HTTP method. If not specified, this attribute is set to false.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 121 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">asyncTimeout</code></td><td align="left" valign="center">
|
| 122 | <p>The default timeout for asynchronous requests in milliseconds. If not
|
| 123 | specified, this attribute is set to 10000 (10 seconds).</p>
|
| 124 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">enableLookups</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 125 | <p>Set to <code>true</code> if you want calls to
|
| 126 | <code>request.getRemoteHost()</code> to perform DNS lookups in
|
| 127 | order to return the actual host name of the remote client. Set
|
| 128 | to <code>false</code> to skip the DNS lookup and return the IP
|
| 129 | address in String form instead (thereby improving performance).
|
| 130 | By default, DNS lookups are disabled.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 131 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxHeaderCount</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 132 | <p>The maximum number of headers in a request that are allowed by the
|
| 133 | container. A request that contains more headers than the specified limit
|
| 134 | will be rejected. A value of less than 0 means no limit.
|
| 135 | If not specified, a default of 100 is used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 136 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxParameterCount</code></td><td align="left" valign="center">
|
| 137 | <p>The maximum number of parameter and value pairs (GET plus POST) which
|
| 138 | will be automatically parsed by the container. Parameter and value pairs
|
| 139 | beyond this limit will be ignored. A value of less than 0 means no limit.
|
| 140 | If not specified, a default of 10000 is used. Note that
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 141 | <code>FailedRequestFilter</code> <a href="filter.html">filter</a> can be
|
| 142 | used to reject requests that hit the limit.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 143 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxPostSize</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 144 | <p>The maximum size in bytes of the POST which will be handled by
|
| 145 | the container FORM URL parameter parsing. The limit can be disabled by
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 146 | setting this attribute to a value less than zero. If not specified, this
|
| 147 | attribute is set to 2097152 (2 megabytes). Note that the
|
| 148 | <a href="filter.html#Failed_Request_Filter"><code>FailedRequestFilter</code></a>
|
| 149 | can be used to reject requests that exceed this limit.</p>
|
| 150 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxSavePostSize</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 151 | <p>The maximum size in bytes of the POST which will be saved/buffered by
|
| 152 | the container during FORM or CLIENT-CERT authentication. For both types
|
| 153 | of authentication, the POST will be saved/buffered before the user is
|
| 154 | authenticated. For CLIENT-CERT authentication, the POST is buffered for
|
| 155 | the duration of the SSL handshake and the buffer emptied when the request
|
| 156 | is processed. For FORM authentication the POST is saved whilst the user
|
| 157 | is re-directed to the login form and is retained until the user
|
| 158 | successfully authenticates or the session associated with the
|
| 159 | authentication request expires. The limit can be disabled by setting this
|
| 160 | attribute to -1. Setting the attribute to zero will disable the saving of
|
| 161 | POST data during authentication. If not specified, this attribute is set
|
| 162 | to 4096 (4 kilobytes).</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 163 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">parseBodyMethods</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 164 | <p>A comma-separated list of HTTP methods for which request
|
| 165 | bodies will be parsed for request parameters identically
|
| 166 | to POST. This is useful in RESTful applications that want to
|
| 167 | support POST-style semantics for PUT requests.
|
| 168 | Note that any setting other than <code>POST</code> causes Tomcat
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 169 | to behave in a way that goes against the intent of the servlet
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 170 | specification.
|
| 171 | The HTTP method TRACE is specifically forbidden here in accordance
|
| 172 | with the HTTP specification.
|
| 173 | The default is <code>POST</code></p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 174 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">port</code></strong></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 175 | <p>The TCP port number on which this <strong>Connector</strong>
|
| 176 | will create a server socket and await incoming connections. Your
|
| 177 | operating system will allow only one server application to listen
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 178 | to a particular port number on a particular IP address. If the special
|
| 179 | value of 0 (zero) is used, then Tomcat will select a free port at random
|
| 180 | to use for this connector. This is typically only useful in embedded and
|
| 181 | testing applications.</p>
|
| 182 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">protocol</code></td><td align="left" valign="center">
|
| 183 | <p>Sets the protocol to handle incoming traffic. The default value is
|
| 184 | <code>HTTP/1.1</code> which uses an auto-switching mechanism to select
|
| 185 | either a blocking Java based connector or an APR/native based connector.
|
| 186 | If the <code>PATH</code> (Windows) or <code>LD_LIBRARY_PATH</code> (on
|
| 187 | most unix systems) environment variables contain the Tomcat native
|
| 188 | library, the APR/native connector will be used. If the native library
|
| 189 | cannot be found, the blocking Java based connector will be used. Note
|
| 190 | that the APR/native connector has different settings for HTTPS than the
|
| 191 | Java connectors.<br>
|
| 192 | To use an explicit protocol rather than rely on the auto-switching
|
| 193 | mechanism described above, the following values may be used:<br>
|
| 194 | <code>org.apache.coyote.http11.Http11Protocol</code> -
|
| 195 | blocking Java connector<br>
|
| 196 | <code>org.apache.coyote.http11.Http11NioProtocol</code> -
|
| 197 | non blocking Java connector<br>
|
| 198 | <code>org.apache.coyote.http11.Http11AprProtocol</code> -
|
| 199 | the APR/native connector.<br>
|
| 200 | Custom implementations may also be used.<br>
|
| 201 | Take a look at our <a href="#Connector_Comparison">Connector
|
| 202 | Comparison</a> chart. The configuration for both Java connectors is
|
| 203 | identical, for http and https.<br>
|
| 204 | For more information on the APR connector and APR specific SSL settings
|
| 205 | please visit the <a href="../apr.html">APR documentation</a>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 206 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 207 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">proxyName</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 208 | <p>If this <strong>Connector</strong> is being used in a proxy
|
| 209 | configuration, configure this attribute to specify the server name
|
| 210 | to be returned for calls to <code>request.getServerName()</code>.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 211 | See <a href="#Proxy_Support">Proxy Support</a> for more
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 212 | information.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 213 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">proxyPort</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 214 | <p>If this <strong>Connector</strong> is being used in a proxy
|
| 215 | configuration, configure this attribute to specify the server port
|
| 216 | to be returned for calls to <code>request.getServerPort()</code>.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 217 | See <a href="#Proxy_Support">Proxy Support</a> for more
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 218 | information.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 219 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">redirectPort</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 220 | <p>If this <strong>Connector</strong> is supporting non-SSL
|
| 221 | requests, and a request is received for which a matching
|
| 222 | <code><security-constraint></code> requires SSL transport,
|
| 223 | Catalina will automatically redirect the request to the port
|
| 224 | number specified here.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 225 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">scheme</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 226 | <p>Set this attribute to the name of the protocol you wish to have
|
| 227 | returned by calls to <code>request.getScheme()</code>. For
|
| 228 | example, you would set this attribute to "<code>https</code>"
|
| 229 | for an SSL Connector. The default value is "<code>http</code>".
|
| 230 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 231 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">secure</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 232 | <p>Set this attribute to <code>true</code> if you wish to have
|
| 233 | calls to <code>request.isSecure()</code> to return <code>true</code>
|
| 234 | for requests received by this Connector. You would want this on an
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 235 | SSL Connector or a non SSL connector that is receiving data from a
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 236 | SSL accelerator, like a crypto card, a SSL appliance or even a webserver.
|
| 237 | The default value is <code>false</code>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 238 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">URIEncoding</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 239 | <p>This specifies the character encoding used to decode the URI bytes,
|
| 240 | after %xx decoding the URL. If not specified, ISO-8859-1 will be used.
|
| 241 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 242 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">useBodyEncodingForURI</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 243 | <p>This specifies if the encoding specified in contentType should be used
|
| 244 | for URI query parameters, instead of using the URIEncoding. This
|
| 245 | setting is present for compatibility with Tomcat 4.1.x, where the
|
| 246 | encoding specified in the contentType, or explicitly set using
|
| 247 | Request.setCharacterEncoding method was also used for the parameters from
|
| 248 | the URL. The default value is <code>false</code>.
|
| 249 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 250 | <p><strong>Notes:</strong> 1) This setting is applied only to the
|
| 251 | query string of a request. Unlike <code>URIEncoding</code> it does not
|
| 252 | affect the path portion of a request URI. 2) If request character
|
| 253 | encoding is not known (is not provided by a browser and is not set by
|
| 254 | <code>SetCharacterEncodingFilter</code> or a similar filter using
|
| 255 | Request.setCharacterEncoding method), the default encoding is always
|
| 256 | "ISO-8859-1". The <code>URIEncoding</code> setting has no effect on
|
| 257 | this default.
|
| 258 | </p>
|
| 259 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">useIPVHosts</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 260 | <p>Set this attribute to <code>true</code> to cause Tomcat to use
|
| 261 | the IP address that the request was received on to determine the Host
|
| 262 | to send the request to. The default value is <code>false</code>.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 263 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">xpoweredBy</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 264 | <p>Set this attribute to <code>true</code> to cause Tomcat to advertise
|
| 265 | support for the Servlet specification using the header recommended in the
|
| 266 | specification. The default value is <code>false</code>.</p>
|
| 267 | </td></tr></table>
|
| 268 |
|
| 269 | </blockquote></td></tr></table>
|
| 270 |
|
| 271 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Standard Implementation"><!--()--></a><a name="Standard_Implementation"><strong>Standard Implementation</strong></a></font></td></tr><tr><td><blockquote>
|
| 272 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 273 | <p>The standard HTTP connectors (BIO, NIO and APR/native) all support the
|
| 274 | following attributes in addition to the common Connector attributes listed
|
| 275 | above.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 276 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 277 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">acceptCount</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 278 | <p>The maximum queue length for incoming connection requests when
|
| 279 | all possible request processing threads are in use. Any requests
|
| 280 | received when the queue is full will be refused. The default
|
| 281 | value is 100.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 282 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">acceptorThreadCount</code></td><td align="left" valign="center">
|
| 283 | <p>The number of threads to be used to accept connections. Increase this
|
| 284 | value on a multi CPU machine, although you would never really need more
|
| 285 | than <code>2</code>. Also, with a lot of non keep alive connections, you
|
| 286 | might want to increase this value as well. Default value is
|
| 287 | <code>1</code>.</p>
|
| 288 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">acceptorThreadPriority</code></td><td align="left" valign="center">
|
| 289 | <p>The priority of the acceptor threads. The threads used to accept
|
| 290 | new connections. The default value is <code>5</code> (the value of the
|
| 291 | <code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
|
| 292 | for the <code>java.lang.Thread</code> class for more details on what
|
| 293 | this priority means.</p>
|
| 294 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">address</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 295 | <p>For servers with more than one IP address, this attribute
|
| 296 | specifies which address will be used for listening on the specified
|
| 297 | port. By default, this port will be used on all IP addresses
|
| 298 | associated with the server.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 299 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">allowedTrailerHeaders</code></td><td align="left" valign="center">
|
| 300 | <p>By default Tomcat will ignore all trailer headers when processing
|
| 301 | chunked input. For a header to be processed, it must be added to this
|
| 302 | comma-separated list of header names.</p>
|
| 303 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">bindOnInit</code></td><td align="left" valign="center">
|
| 304 | <p>Controls when the socket used by the connector is bound. By default it
|
| 305 | is bound when the connector is initiated and unbound when the connector is
|
| 306 | destroyed. If set to <code>false</code>, the socket will be bound when the
|
| 307 | connector is started and unbound when it is stopped.</p>
|
| 308 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">compressibleMimeType</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 309 | <p>The value is a comma separated list of MIME types for which HTTP
|
| 310 | compression may be used.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 311 | The default value is
|
| 312 | <code>
|
| 313 | text/html,text/xml,text/plain,text/css,text/javascript,application/javascript
|
| 314 | </code>.
|
| 315 | </p>
|
| 316 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">compression</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 317 | <p>The <strong>Connector</strong> may use HTTP/1.1 GZIP compression in
|
| 318 | an attempt to save server bandwidth. The acceptable values for the
|
| 319 | parameter is "off" (disable compression), "on" (allow compression, which
|
| 320 | causes text data to be compressed), "force" (forces compression in all
|
| 321 | cases), or a numerical integer value (which is equivalent to "on", but
|
| 322 | specifies the minimum amount of data before the output is compressed). If
|
| 323 | the content-length is not known and compression is set to "on" or more
|
| 324 | aggressive, the output will also be compressed. If not specified, this
|
| 325 | attribute is set to "off".</p>
|
| 326 | <p><em>Note</em>: There is a tradeoff between using compression (saving
|
| 327 | your bandwidth) and using the sendfile feature (saving your CPU cycles).
|
| 328 | If the connector supports the sendfile feature, e.g. the NIO connector,
|
| 329 | using sendfile will take precedence over compression. The symptoms will
|
| 330 | be that static files greater that 48 Kb will be sent uncompressed.
|
| 331 | You can turn off sendfile by setting <code>useSendfile</code> attribute
|
| 332 | of the connector, as documented below, or change the sendfile usage
|
| 333 | threshold in the configuration of the
|
| 334 | <a href="../default-servlet.html">DefaultServlet</a> in the default
|
| 335 | <code>conf/web.xml</code> or in the <code>web.xml</code> of your web
|
| 336 | application.
|
| 337 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 338 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">compressionMinSize</code></td><td align="left" valign="center">
|
| 339 | <p>If <strong>compression</strong> is set to "on" then this attribute
|
| 340 | may be used to specify the minimum amount of data before the output is
|
| 341 | compressed. If not specified, this attribute is defaults to "2048".</p>
|
| 342 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">connectionLinger</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 343 | <p>The number of seconds during which the sockets used by this
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 344 | <strong>Connector</strong> will linger when they are closed. The default
|
| 345 | value is <code>-1</code> which disables socket linger.</p>
|
| 346 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">connectionTimeout</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 347 | <p>The number of milliseconds this <strong>Connector</strong> will wait,
|
| 348 | after accepting a connection, for the request URI line to be
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 349 | presented. Use a value of -1 to indicate no (i.e. infinite) timeout.
|
| 350 | The default value is 60000 (i.e. 60 seconds) but note that the standard
|
| 351 | server.xml that ships with Tomcat sets this to 20000 (i.e. 20 seconds).
|
| 352 | Unless <strong>disableUploadTimeout</strong> is set to <code>false</code>,
|
| 353 | this timeout will also be used when reading the request body (if any).</p>
|
| 354 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">connectionUploadTimeout</code></td><td align="left" valign="center">
|
| 355 | <p>Specifies the timeout, in milliseconds, to use while a data upload is
|
| 356 | in progress. This only takes effect if
|
| 357 | <strong>disableUploadTimeout</strong> is set to <code>false</code>.
|
| 358 | </p>
|
| 359 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">disableUploadTimeout</code></td><td align="left" valign="center">
|
| 360 | <p>This flag allows the servlet container to use a different, usually
|
| 361 | longer connection timeout during data upload. If not specified, this
|
| 362 | attribute is set to <code>true</code> which disables this longer timeout.
|
| 363 | </p>
|
| 364 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">executor</code></td><td align="left" valign="center">
|
| 365 | <p>A reference to the name in an <a href="executor.html">Executor</a>
|
| 366 | element. If this attribute is set, and the named executor exists, the
|
| 367 | connector will use the executor, and all the other thread attributes will
|
| 368 | be ignored. Note that if a shared executor is not specified for a
|
| 369 | connector then the connector will use a private, internal executor to
|
| 370 | provide the thread pool.</p>
|
| 371 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">executorTerminationTimeoutMillis</code></td><td align="left" valign="center">
|
| 372 | <p>The time that the private internal executor will wait for request
|
| 373 | processing threads to terminate before continuing with the process of
|
| 374 | stopping the connector. If not set, the default is <code>0</code> (zero)
|
| 375 | for the BIO connector and <code>5000</code> (5 seconds) for the NIO and
|
| 376 | APR/native connectors.</p>
|
| 377 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">keepAliveTimeout</code></td><td align="left" valign="center">
|
| 378 | <p>The number of milliseconds this <strong>Connector</strong> will wait
|
| 379 | for another HTTP request before closing the connection. The default value
|
| 380 | is to use the value that has been set for the
|
| 381 | <strong>connectionTimeout</strong> attribute.
|
| 382 | Use a value of -1 to indicate no (i.e. infinite) timeout.</p>
|
| 383 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxConnections</code></td><td align="left" valign="center">
|
| 384 | <p>The maximum number of connections that the server will accept and
|
| 385 | process at any given time. When this number has been reached, the server
|
| 386 | will accept, but not process, one further connection. This additional
|
| 387 | connection be blocked until the number of connections being processed
|
| 388 | falls below <strong>maxConnections</strong> at which point the server will
|
| 389 | start accepting and processing new connections again. Note that once the
|
| 390 | limit has been reached, the operating system may still accept connections
|
| 391 | based on the <code>acceptCount</code> setting. The default value varies by
|
| 392 | connector type. For BIO the default is the value of
|
| 393 | <strong>maxThreads</strong> unless an <a href="executor.html">Executor</a>
|
| 394 | is used in which case the default will be the value of maxThreads from the
|
| 395 | executor. For NIO the default is <code>10000</code>.
|
| 396 | For APR/native, the default is <code>8192</code>.</p>
|
| 397 | <p>Note that for APR/native on Windows, the configured value will be
|
| 398 | reduced to the highest multiple of 1024 that is less than or equal to
|
| 399 | maxConnections. This is done for performance reasons.<br>
|
| 400 | If set to a value of -1, the maxConnections feature is disabled
|
| 401 | and connections are not counted.</p>
|
| 402 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxCookieCount</code></td><td align="left" valign="center">
|
| 403 | <p>The maximum number of cookies that are permitted for a request. A value
|
| 404 | of less than zero means no limit. If not specified, a default value of 200
|
| 405 | will be used.</p>
|
| 406 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxExtensionSize</code></td><td align="left" valign="center">
|
| 407 | <p>Limits the total length of chunk extensions in chunked HTTP requests.
|
| 408 | If the value is <code>-1</code>, no limit will be imposed. If not
|
| 409 | specified, the default value of <code>8192</code> will be used.</p>
|
| 410 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxHttpHeaderSize</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 411 | <p>The maximum size of the request and response HTTP header, specified
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 412 | in bytes. If not specified, this attribute is set to 8192 (8 KB).</p>
|
| 413 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxKeepAliveRequests</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 414 | <p>The maximum number of HTTP requests which can be pipelined until
|
| 415 | the connection is closed by the server. Setting this attribute to 1 will
|
| 416 | disable HTTP/1.0 keep-alive, as well as HTTP/1.1 keep-alive and
|
| 417 | pipelining. Setting this to -1 will allow an unlimited amount of
|
| 418 | pipelined or keep-alive HTTP requests.
|
| 419 | If not specified, this attribute is set to 100.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 420 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxSwallowSize</code></td><td align="left" valign="center">
|
| 421 | <p>The maximum number of request body bytes (excluding transfer encoding
|
| 422 | overhead) that will be swallowed by Tomcat for an aborted upload. An
|
| 423 | aborted upload is when Tomcat knows that the request body is going to be
|
| 424 | ignored but the client still sends it. If Tomcat does not swallow the body
|
| 425 | the client is unlikely to see the response. If not specified the default
|
| 426 | of 2097152 (2 megabytes) will be used. A value of less than zero indicates
|
| 427 | that no limit should be enforced.</p>
|
| 428 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxThreads</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 429 | <p>The maximum number of request processing threads to be created
|
| 430 | by this <strong>Connector</strong>, which therefore determines the
|
| 431 | maximum number of simultaneous requests that can be handled. If
|
| 432 | not specified, this attribute is set to 200. If an executor is associated
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 433 | with this connector, this attribute is ignored as the connector will
|
| 434 | execute tasks using the executor rather than an internal thread pool. Note
|
| 435 | that if an executor is configured any value set for this attribute will be
|
| 436 | recorded correctly but it will be reported (e.g. via JMX) as
|
| 437 | <code>-1</code> to make clear that it is not used.</p>
|
| 438 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">maxTrailerSize</code></td><td align="left" valign="center">
|
| 439 | <p>Limits the total length of trailing headers in the last chunk of
|
| 440 | a chunked HTTP request. If the value is <code>-1</code>, no limit will be
|
| 441 | imposed. If not specified, the default value of <code>8192</code> will be
|
| 442 | used.</p>
|
| 443 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">minSpareThreads</code></td><td align="left" valign="center">
|
| 444 | <p>The minimum number of threads always kept running. If not specified,
|
| 445 | the default of <code>10</code> is used. If an executor is associated
|
| 446 | with this connector, this attribute is ignored as the connector will
|
| 447 | execute tasks using the executor rather than an internal thread pool. Note
|
| 448 | that if an executor is configured any value set for this attribute will be
|
| 449 | recorded correctly but it will be reported (e.g. via JMX) as
|
| 450 | <code>-1</code> to make clear that it is not used.</p>
|
| 451 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">noCompressionUserAgents</code></td><td align="left" valign="center">
|
| 452 | <p>The value is a regular expression (using <code>java.util.regex</code>)
|
| 453 | matching the <code>user-agent</code> header of HTTP clients for which
|
| 454 | compression should not be used,
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 455 | because these clients, although they do advertise support for the
|
| 456 | feature, have a broken implementation.
|
| 457 | The default value is an empty String (regexp matching disabled).</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 458 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">processorCache</code></td><td align="left" valign="center">
|
| 459 | <p>The protocol handler caches Processor objects to speed up performance.
|
| 460 | This setting dictates how many of these objects get cached.
|
| 461 | <code>-1</code> means unlimited, default is <code>200</code>. If not using
|
| 462 | Servlet 3.0 asynchronous processing, a good default is to use the same as
|
| 463 | the maxThreads setting. If using Servlet 3.0 asynchronous processing, a
|
| 464 | good default is to use the larger of maxThreads and the maximum number of
|
| 465 | expected concurrent requests (synchronous and asynchronous).</p>
|
| 466 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">restrictedUserAgents</code></td><td align="left" valign="center">
|
| 467 | <p>The value is a regular expression (using <code>java.util.regex</code>)
|
| 468 | matching the <code>user-agent</code> header of HTTP clients for which
|
| 469 | HTTP/1.1 or HTTP/1.0 keep alive should not be used, even if the clients
|
| 470 | advertise support for these features.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 471 | The default value is an empty String (regexp matching disabled).</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 472 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">server</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 473 | <p>Overrides the Server header for the http response. If set, the value
|
| 474 | for this attribute overrides the Tomcat default and any Server header set
|
| 475 | by a web application. If not set, any value specified by the application
|
| 476 | is used. If the application does not specify a value then
|
| 477 | <code>Apache-Coyote/1.1</code> is used. Unless you are paranoid, you won't
|
| 478 | need this feature.
|
| 479 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 480 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socketBuffer</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 481 | <p>The size (in bytes) of the buffer to be provided for socket
|
| 482 | output buffering. -1 can be specified to disable the use of a buffer.
|
| 483 | By default, a buffers of 9000 bytes will be used.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 484 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLEnabled</code></td><td align="left" valign="center">
|
| 485 | <p>Use this attribute to enable SSL traffic on a connector.
|
| 486 | To turn on SSL handshake/encryption/decryption on a connector
|
| 487 | set this value to <code>true</code>.
|
| 488 | The default value is <code>false</code>.
|
| 489 | When turning this value <code>true</code> you will want to set the
|
| 490 | <code>scheme</code> and the <code>secure</code> attributes as well
|
| 491 | to pass the correct <code>request.getScheme()</code> and
|
| 492 | <code>request.isSecure()</code> values to the servlets
|
| 493 | See <a href="#SSL_Support">SSL Support</a> for more information.
|
| 494 | </p>
|
| 495 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">tcpNoDelay</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 496 | <p>If set to <code>true</code>, the TCP_NO_DELAY option will be
|
| 497 | set on the server socket, which improves performance under most
|
| 498 | circumstances. This is set to <code>true</code> by default.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 499 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">threadPriority</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 500 | <p>The priority of the request processing threads within the JVM.
|
| 501 | The default value is <code>5</code> (the value of the
|
| 502 | <code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
|
| 503 | for the <code>java.lang.Thread</code> class for more details on what
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 504 | this priority means. If an executor is associated
|
| 505 | with this connector, this attribute is ignored as the connector will
|
| 506 | execute tasks using the executor rather than an internal thread pool. Note
|
| 507 | that if an executor is configured any value set for this attribute will be
|
| 508 | recorded correctly but it will be reported (e.g. via JMX) as
|
| 509 | <code>-1</code> to make clear that it is not used.</p>
|
| 510 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">upgradeAsyncWriteBufferSize</code></td><td align="left" valign="center">
|
| 511 | <p>The default size of the buffer to allocate to for asynchronous writes
|
| 512 | that can not be completed in a single operation, specified in bytes. Data that can't be
|
| 513 | written immediately will be stored in this buffer until it can be written.
|
| 514 | If more data needs to be stored than space is available in the buffer than
|
| 515 | the size of the buffer will be increased for the duration of the write. If
|
| 516 | not specified the default value of 8192 will be used.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 517 | </td></tr></table>
|
| 518 |
|
| 519 | </blockquote></td></tr></table>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 520 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 521 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Java TCP socket attributes"><!--()--></a><a name="Java_TCP_socket_attributes"><strong>Java TCP socket attributes</strong></a></font></td></tr><tr><td><blockquote>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 522 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 523 | <p>The BIO and NIO implementation support the following Java TCP socket
|
| 524 | attributes in addition to the common Connector and HTTP attributes listed
|
| 525 | above.</p>
|
| 526 |
|
| 527 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">socket.rxBufSize</code></td><td align="left" valign="center">
|
| 528 | <p>(int)The socket receive buffer (SO_RCVBUF) size in bytes. JVM default
|
| 529 | used if not set.</p>
|
| 530 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.txBufSize</code></td><td align="left" valign="center">
|
| 531 | <p>(int)The socket send buffer (SO_SNDBUF) size in bytes. JVM default
|
| 532 | used if not set.</p>
|
| 533 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.tcpNoDelay</code></td><td align="left" valign="center">
|
| 534 | <p>(bool)This is equivalent to standard attribute
|
| 535 | <strong>tcpNoDelay</strong>.</p>
|
| 536 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.soKeepAlive</code></td><td align="left" valign="center">
|
| 537 | <p>(bool)Boolean value for the socket's keep alive setting
|
| 538 | (SO_KEEPALIVE). JVM default used if not set.</p>
|
| 539 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.ooBInline</code></td><td align="left" valign="center">
|
| 540 | <p>(bool)Boolean value for the socket OOBINLINE setting. JVM default
|
| 541 | used if not set.</p>
|
| 542 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.soReuseAddress</code></td><td align="left" valign="center">
|
| 543 | <p>(bool)Boolean value for the sockets reuse address option
|
| 544 | (SO_REUSEADDR). JVM default used if not set.</p>
|
| 545 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.soLingerOn</code></td><td align="left" valign="center">
|
| 546 | <p>(bool)Boolean value for the sockets so linger option (SO_LINGER).
|
| 547 | A value for the standard attribute <strong>connectionLinger</strong>
|
| 548 | that is >=0 is equivalent to setting this to <code>true</code>.
|
| 549 | A value for the standard attribute <strong>connectionLinger</strong>
|
| 550 | that is <0 is equivalent to setting this to <code>false</code>.
|
| 551 | Both this attribute and <code>soLingerTime</code> must be set else the
|
| 552 | JVM defaults will be used for both.</p>
|
| 553 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.soLingerTime</code></td><td align="left" valign="center">
|
| 554 | <p>(int)Value in seconds for the sockets so linger option (SO_LINGER).
|
| 555 | This is equivalent to standard attribute
|
| 556 | <strong>connectionLinger</strong>.
|
| 557 | Both this attribute and <code>soLingerOn</code> must be set else the
|
| 558 | JVM defaults will be used for both.</p>
|
| 559 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.soTimeout</code></td><td align="left" valign="center">
|
| 560 | <p>This is equivalent to standard attribute
|
| 561 | <strong>connectionTimeout</strong>.</p>
|
| 562 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.performanceConnectionTime</code></td><td align="left" valign="center">
|
| 563 | <p>(int)The first value for the performance settings. See
|
| 564 | <a href="http://docs.oracle.com/javase/6/docs/api/java/net/Socket.html#setPerformancePreferences(int,%20int,%20int)">Socket Performance Options</a>.
|
| 565 | All three performance attributes must be set else the JVM defaults will
|
| 566 | be used for all three.</p>
|
| 567 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.performanceLatency</code></td><td align="left" valign="center">
|
| 568 | <p>(int)The second value for the performance settings. See
|
| 569 | <a href="http://docs.oracle.com/javase/6/docs/api/java/net/Socket.html#setPerformancePreferences(int,%20int,%20int)">Socket Performance Options</a>.
|
| 570 | All three performance attributes must be set else the JVM defaults will
|
| 571 | be used for all three.</p>
|
| 572 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.performanceBandwidth</code></td><td align="left" valign="center">
|
| 573 | <p>(int)The third value for the performance settings. See
|
| 574 | <a href="http://docs.oracle.com/javase/6/docs/api/java/net/Socket.html#setPerformancePreferences(int,%20int,%20int)">Socket Performance Options</a>.
|
| 575 | All three performance attributes must be set else the JVM defaults will
|
| 576 | be used for all three.</p>
|
| 577 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.unlockTimeout</code></td><td align="left" valign="center">
|
| 578 | <p>(int) The timeout for a socket unlock. When a connector is stopped, it will try to release the acceptor thread by opening a connector to itself.
|
| 579 | The default value is <code>250</code> and the value is in milliseconds</p>
|
| 580 | </td></tr></table>
|
| 581 | </blockquote></td></tr></table>
|
| 582 |
|
| 583 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="BIO specific configuration"><!--()--></a><a name="BIO_specific_configuration"><strong>BIO specific configuration</strong></a></font></td></tr><tr><td><blockquote>
|
| 584 |
|
| 585 | <p>The following attributes are specific to the BIO connector.</p>
|
| 586 |
|
| 587 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">disableKeepAlivePercentage</code></td><td align="left" valign="center">
|
| 588 | <p>The percentage of processing threads that have to be in use before
|
| 589 | HTTP keep-alives are disabled to improve scalability. Values less than
|
| 590 | <code>0</code> will be changed to <code>0</code> and values greater than
|
| 591 | <code>100</code> will be changed to <code>100</code>. If not specified,
|
| 592 | the default value is <code>75</code>.</p>
|
| 593 | </td></tr></table>
|
| 594 |
|
| 595 | </blockquote></td></tr></table>
|
| 596 |
|
| 597 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="NIO specific configuration"><!--()--></a><a name="NIO_specific_configuration"><strong>NIO specific configuration</strong></a></font></td></tr><tr><td><blockquote>
|
| 598 |
|
| 599 | <p>The following attributes are specific to the NIO connector.</p>
|
| 600 |
|
| 601 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">pollerThreadCount</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 602 | <p>(int)The number of threads to be used to run for the polling events.
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 603 | Default value is <code>1</code> per processor up to and including version 7.0.27.
|
| 604 | Default value as of version 7.0.28 is <code>1</code> per processor but not more than 2.<br>
|
| 605 | When accepting a socket, the operating system holds a global lock. So the benefit of
|
| 606 | going above 2 threads diminishes rapidly. Having more than one thread is for
|
| 607 | system that need to accept connections very rapidly. However usually just
|
| 608 | increasing <code>acceptCount</code> will solve that problem.
|
| 609 | Increasing this value may also be beneficial when a large amount of send file
|
| 610 | operations are going on.
|
| 611 | </p>
|
| 612 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">pollerThreadPriority</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 613 | <p>(int)The priority of the poller threads.
|
| 614 | The default value is <code>5</code> (the value of the
|
| 615 | <code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
|
| 616 | for the <code>java.lang.Thread</code> class for more details on what
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 617 | this priority means.</p>
|
| 618 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">selectorTimeout</code></td><td align="left" valign="center">
|
| 619 | <p>(int)The time in milliseconds to timeout on a select() for the
|
| 620 | poller. This value is important, since connection clean up is done on
|
| 621 | the same thread, so do not set this value to an extremely high one. The
|
| 622 | default value is <code>1000</code> milliseconds.</p>
|
| 623 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">useComet</code></td><td align="left" valign="center">
|
| 624 | <p>(bool)Whether to allow comet servlets or not. Default value is
|
| 625 | <code>true</code>.</p>
|
| 626 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">useSendfile</code></td><td align="left" valign="center">
|
| 627 | <p>(bool)Use this attribute to enable or disable sendfile capability.
|
| 628 | The default value is <code>true</code>.</p>
|
| 629 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.directBuffer</code></td><td align="left" valign="center">
|
| 630 | <p>(bool)Boolean value, whether to use direct ByteBuffers or java mapped
|
| 631 | ByteBuffers. If <code>true</code> then
|
| 632 | <code>java.nio.ByteBuffer.allocateDirect()</code> is used to allocate
|
| 633 | the buffers, if <code>false</code> then
|
| 634 | <code>java.nio.ByteBuffer.allocate()</code> is used. The default value
|
| 635 | is <code>false</code>.<br>
|
| 636 | When you are using direct buffers, make sure you allocate the
|
| 637 | appropriate amount of memory for the direct memory space. On Sun's JDK
|
| 638 | that would be something like <code>-XX:MaxDirectMemorySize=256m</code>.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 639 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 640 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.appReadBufSize</code></td><td align="left" valign="center">
|
| 641 | <p>(int)Each connection that is opened up in Tomcat get associated with
|
| 642 | a read ByteBuffer. This attribute controls the size of this buffer. By
|
| 643 | default this read buffer is sized at <code>8192</code> bytes. For lower
|
| 644 | concurrency, you can increase this to buffer more data. For an extreme
|
| 645 | amount of keep alive connections, decrease this number or increase your
|
| 646 | heap size.</p>
|
| 647 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.appWriteBufSize</code></td><td align="left" valign="center">
|
| 648 | <p>(int)Each connection that is opened up in Tomcat get associated with
|
| 649 | a write ByteBuffer. This attribute controls the size of this buffer. By
|
| 650 | default this write buffer is sized at <code>8192</code> bytes. For low
|
| 651 | concurrency you can increase this to buffer more response data. For an
|
| 652 | extreme amount of keep alive connections, decrease this number or
|
| 653 | increase your heap size.<br>
|
| 654 | The default value here is pretty low, you should up it if you are not
|
| 655 | dealing with tens of thousands concurrent connections.</p>
|
| 656 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.bufferPool</code></td><td align="left" valign="center">
|
| 657 | <p>(int)The NIO connector uses a class called NioChannel that holds
|
| 658 | elements linked to a socket. To reduce garbage collection, the NIO
|
| 659 | connector caches these channel objects. This value specifies the size of
|
| 660 | this cache. The default value is <code>500</code>, and represents that
|
| 661 | the cache will hold 500 NioChannel objects. Other values are
|
| 662 | <code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
|
| 663 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.bufferPoolSize</code></td><td align="left" valign="center">
|
| 664 | <p>(int)The NioChannel pool can also be size based, not used object
|
| 665 | based. The size is calculated as follows:<br>
|
| 666 | NioChannel
|
| 667 | <code>buffer size = read buffer size + write buffer size</code><br>
|
| 668 | SecureNioChannel <code>buffer size = application read buffer size +
|
| 669 | application write buffer size + network read buffer size +
|
| 670 | network write buffer size</code><br>
|
| 671 | The value is in bytes, the default value is <code>1024*1024*100</code>
|
| 672 | (100MB).</p>
|
| 673 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.processorCache</code></td><td align="left" valign="center">
|
| 674 | <p>(int)Tomcat will cache SocketProcessor objects to reduce garbage
|
| 675 | collection. The integer value specifies how many objects to keep in the
|
| 676 | cache at most. The default is <code>500</code>. Other values are
|
| 677 | <code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
|
| 678 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.keyCache</code></td><td align="left" valign="center">
|
| 679 | <p>(int)Tomcat will cache KeyAttachment objects to reduce garbage
|
| 680 | collection. The integer value specifies how many objects to keep in the
|
| 681 | cache at most. The default is <code>500</code>. Other values are
|
| 682 | <code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
|
| 683 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">socket.eventCache</code></td><td align="left" valign="center">
|
| 684 | <p>(int)Tomcat will cache PollerEvent objects to reduce garbage
|
| 685 | collection. The integer value specifies how many objects to keep in the
|
| 686 | cache at most. The default is <code>500</code>. Other values are
|
| 687 | <code>-1</code> for unlimited cache and <code>0</code> for no cache.</p>
|
| 688 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">selectorPool.maxSelectors</code></td><td align="left" valign="center">
|
| 689 | <p>(int)The max selectors to be used in the pool, to reduce selector
|
| 690 | contention. Use this option when the command line
|
| 691 | <code>org.apache.tomcat.util.net.NioSelectorShared</code> value is set
|
| 692 | to false. Default value is <code>200</code>.</p>
|
| 693 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">selectorPool.maxSpareSelectors</code></td><td align="left" valign="center">
|
| 694 | <p>(int)The max spare selectors to be used in the pool, to reduce
|
| 695 | selector contention. When a selector is returned to the pool, the system
|
| 696 | can decide to keep it or let it be GC'd. Use this option when the
|
| 697 | command line <code>org.apache.tomcat.util.net.NioSelectorShared</code>
|
| 698 | value is set to false. Default value is <code>-1</code> (unlimited).</p>
|
| 699 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">command-line-options</code></td><td align="left" valign="center">
|
| 700 | <p>The following command line options are available for the NIO
|
| 701 | connector:<br>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 702 | <code>-Dorg.apache.tomcat.util.net.NioSelectorShared=true|false</code>
|
| 703 | - default is <code>true</code>. Set this value to <code>false</code> if you wish to
|
| 704 | use a selector for each thread. When you set it to <code>false</code>, you can
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 705 | control the size of the pool of selectors by using the
|
| 706 | <strong>selectorPool.maxSelectors</strong> attribute.</p>
|
| 707 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">oomParachute</code></td><td align="left" valign="center">
|
| 708 | <p>(int)The NIO connector implements an OutOfMemoryError strategy called
|
| 709 | parachute. It holds a chunk of data as a byte array. In case of an OOM,
|
| 710 | this chunk of data is released and the error is reported. This will give
|
| 711 | the VM enough room to clean up. The <code>oomParachute</code> represents
|
| 712 | the size in bytes of the parachute(the byte array). The default value is
|
| 713 | <code>1024*1024</code>(1MB). Please note, this only works for OOM errors
|
| 714 | regarding the Java Heap space, and there is absolutely no guarantee
|
| 715 | that you will be able to recover at all. If you have an OOM outside of
|
| 716 | the Java Heap, then this parachute trick will not help.
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 717 | </p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 718 | </td></tr></table>
|
| 719 | </blockquote></td></tr></table>
|
| 720 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 721 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="APR/native specific configuration"><!--()--></a><a name="APR/native_specific_configuration"><strong>APR/native specific configuration</strong></a></font></td></tr><tr><td><blockquote>
|
| 722 |
|
| 723 | <p>The following attributes are specific to the APR/native connector.</p>
|
| 724 |
|
| 725 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">deferAccept</code></td><td align="left" valign="center">
|
| 726 | <p>Sets the <code>TCP_DEFER_ACCEPT</code> flag on the listening socket
|
| 727 | for this connector. The default value is <code>true</code> where
|
| 728 | <code>TCP_DEFER_ACCEPT</code> is supported by the operating system,
|
| 729 | otherwise it is <code>false</code>.</p>
|
| 730 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">pollerSize</code></td><td align="left" valign="center">
|
| 731 | <p>Amount of sockets that the poller responsible for polling kept alive
|
| 732 | connections can hold at a given time. Extra connections will be closed
|
| 733 | right away. The default value is 8192, corresponding to 8192 keep-alive
|
| 734 | connections. This is a synonym for maxConnections.</p>
|
| 735 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">pollTime</code></td><td align="left" valign="center">
|
| 736 | <p>Duration of a poll call in microseconds. Lowering this value will
|
| 737 | slightly decrease latency of connections being kept alive in some cases,
|
| 738 | but will use more CPU as more poll calls are being made. The default
|
| 739 | value is 2000 (2ms).</p>
|
| 740 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sendfileSize</code></td><td align="left" valign="center">
|
| 741 | <p>Amount of sockets that the poller responsible for sending static
|
| 742 | files asynchronously can hold at a given time. Extra connections will be
|
| 743 | closed right away without any data being sent (resulting in a zero
|
| 744 | length file on the client side). Note that in most cases, sendfile is a
|
| 745 | call that will return right away (being taken care of "synchronously" by
|
| 746 | the kernel), and the sendfile poller will not be used, so the amount of
|
| 747 | static files which can be sent concurrently is much larger than the
|
| 748 | specified amount. The default value is 1024.</p>
|
| 749 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">threadPriority</code></td><td align="left" valign="center">
|
| 750 | <p>(int)The priority of the acceptor and poller threads.
|
| 751 | The default value is <code>5</code> (the value of the
|
| 752 | <code>java.lang.Thread.NORM_PRIORITY</code> constant). See the JavaDoc
|
| 753 | for the <code>java.lang.Thread</code> class for more details on what
|
| 754 | this priority means.</p>
|
| 755 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">useComet</code></td><td align="left" valign="center">
|
| 756 | <p>(bool)Whether to allow comet servlets or not. Default value is
|
| 757 | <code>true</code>.</p>
|
| 758 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">useSendfile</code></td><td align="left" valign="center">
|
| 759 | <p>(bool)Use this attribute to enable or disable sendfile capability.
|
| 760 | The default value is <code>true</code>.</p>
|
| 761 | </td></tr></table>
|
| 762 |
|
| 763 | </blockquote></td></tr></table>
|
| 764 |
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 765 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Nested Components"><!--()--></a><a name="Nested_Components"><strong>Nested Components</strong></a></font></td></tr><tr><td><blockquote>
|
| 766 |
|
| 767 | <p>None at this time.</p>
|
| 768 |
|
| 769 | </blockquote></td></tr></table><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Special Features"><!--()--></a><a name="Special_Features"><strong>Special Features</strong></a></font></td></tr><tr><td><blockquote>
|
| 770 |
|
| 771 |
|
| 772 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="HTTP/1.1 and HTTP/1.0 Support"><!--()--></a><a name="HTTP/1.1_and_HTTP/1.0_Support"><strong>HTTP/1.1 and HTTP/1.0 Support</strong></a></font></td></tr><tr><td><blockquote>
|
| 773 |
|
| 774 | <p>This <strong>Connector</strong> supports all of the required features
|
| 775 | of the HTTP/1.1 protocol, as described in RFC 2616, including persistent
|
| 776 | connections, pipelining, expectations and chunked encoding. If the client
|
| 777 | (typically a browser) supports only HTTP/1.0, the
|
| 778 | <strong>Connector</strong> will gracefully fall back to supporting this
|
| 779 | protocol as well. No special configuration is required to enable this
|
| 780 | support. The <strong>Connector</strong> also supports HTTP/1.0
|
| 781 | keep-alive.</p>
|
| 782 |
|
| 783 | <p>RFC 2616 requires that HTTP servers always begin their responses with
|
| 784 | the highest HTTP version that they claim to support. Therefore, this
|
| 785 | <strong>Connector</strong> will always return <code>HTTP/1.1</code> at
|
| 786 | the beginning of its responses.</p>
|
| 787 |
|
| 788 | </blockquote></td></tr></table>
|
| 789 |
|
| 790 |
|
| 791 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Proxy Support"><!--()--></a><a name="Proxy_Support"><strong>Proxy Support</strong></a></font></td></tr><tr><td><blockquote>
|
| 792 |
|
| 793 | <p>The <code>proxyName</code> and <code>proxyPort</code> attributes can
|
| 794 | be used when Tomcat is run behind a proxy server. These attributes
|
| 795 | modify the values returned to web applications that call the
|
| 796 | <code>request.getServerName()</code> and <code>request.getServerPort()</code>
|
| 797 | methods, which are often used to construct absolute URLs for redirects.
|
| 798 | Without configuring these attributes, the values returned would reflect
|
| 799 | the server name and port on which the connection from the proxy server
|
| 800 | was received, rather than the server name and port to whom the client
|
| 801 | directed the original request.</p>
|
| 802 |
|
| 803 | <p>For more information, see the
|
| 804 | <a href="../proxy-howto.html">Proxy Support HOW-TO</a>.</p>
|
| 805 |
|
| 806 | </blockquote></td></tr></table>
|
| 807 |
|
| 808 |
|
| 809 |
|
| 810 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Support"><!--()--></a><a name="SSL_Support"><strong>SSL Support</strong></a></font></td></tr><tr><td><blockquote>
|
| 811 |
|
| 812 | <p>You can enable SSL support for a particular instance of this
|
| 813 | <strong>Connector</strong> by setting the <code>SSLEnabled</code> attribute to
|
| 814 | <code>true</code>.</p>
|
| 815 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 816 | <p>You will also need to set the <code>scheme</code> and <code>secure</code>
|
| 817 | attributes to the values <code>https</code> and <code>true</code>
|
| 818 | respectively, to pass correct information to the servlets.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 819 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 820 | <p>The BIO and NIO connectors use the JSSE SSL whereas the APR/native
|
| 821 | connector uses OpenSSL. Therefore, in addition to using different attributes
|
| 822 | to configure SSL, the APR/native connector also requires keys and certificates
|
| 823 | to be provided in a different format.</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 824 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 825 | <p>For more information, see the
|
| 826 | <a href="../ssl-howto.html">SSL Configuration HOW-TO</a>.</p>
|
| 827 |
|
| 828 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Support - BIO and NIO"><!--()--></a><a name="SSL_Support_-_BIO_and_NIO"><strong>SSL Support - BIO and NIO</strong></a></font></td></tr><tr><td><blockquote>
|
| 829 |
|
| 830 | <p>The BIO and NIO connectors use the following attributes to configure SSL:
|
| 831 | </p>
|
| 832 |
|
| 833 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">algorithm</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 834 | <p>The certificate encoding algorithm to be used. This defaults to
|
| 835 | <code>KeyManagerFactory.getDefaultAlgorithm()</code> which returns
|
| 836 | <code>SunX509</code> for Sun JVMs. IBM JVMs return
|
| 837 | <code>IbmX509</code>. For other vendors, consult the JVM
|
| 838 | documentation for the default value.</p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 839 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">allowUnsafeLegacyRenegotiation</code></td><td align="left" valign="center">
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 840 | <p>Is unsafe legacy TLS renegotiation allowed which is likely to expose
|
| 841 | users to CVE-2009-3555, a man-in-the-middle vulnerability in the TLS
|
| 842 | protocol that allows an attacker to inject arbitrary data into the user's
|
| 843 | request. If not specified, a default of <code>false</code> is used. This
|
| 844 | attribute only has an effect if the JVM does not support RFC 5746 as
|
| 845 | indicated by the presence of the pseudo-ciphersuite
|
| 846 | TLS_EMPTY_RENEGOTIATION_INFO_SCSV. This is available JRE/JDK 6 update 22
|
| 847 | onwards. Where RFC 5746 is supported the renegotiation - including support
|
| 848 | for unsafe legacy renegotiation - is controlled by the JVM configuration.
|
| 849 | </p>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 850 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">useServerCipherSuitesOrder</code></td><td align="left" valign="center">
|
| 851 | <p>
|
| 852 | Set to <code>true</code> to enforce the server's cipher order
|
| 853 | (from the <code>ciphers</code> setting). Set to <code>false</code>
|
| 854 | to choose the first acceptable cipher suite presented by the client.
|
| 855 | <b>Use of this feature requires Java 8 or later.</b>
|
| 856 | Default is <i>undefined</i>, leaving the choice up to the JSSE
|
| 857 | implementation.
|
| 858 | </p>
|
| 859 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">ciphers</code></td><td align="left" valign="center">
|
| 860 | <p>The comma separated list of encryption ciphers to support for HTTPS
|
| 861 | connections. If specified, only the ciphers that are listed and supported
|
| 862 | by the SSL implementation will be used. By default, the default ciphers
|
| 863 | for the JVM will be used less those considered to be insecure. Note that
|
| 864 | with older JVMs this will result in a very limited set of ciphers being
|
| 865 | available by default. The ciphers are specified using the JSSE cipher
|
| 866 | naming convention. The special value of <code>ALL</code> will enable all
|
| 867 | supported ciphers. This will include many that are not secure.
|
| 868 | <code>ALL</code> is intended for testing purposes only.</p>
|
| 869 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">clientAuth</code></td><td align="left" valign="center">
|
| 870 | <p>Set to <code>true</code> if you want the SSL stack to require a
|
| 871 | valid certificate chain from the client before accepting a connection.
|
| 872 | Set to <code>want</code> if you want the SSL stack to request a client
|
| 873 | Certificate, but not fail if one isn't presented. A <code>false</code>
|
| 874 | value (which is the default) will not require a certificate chain
|
| 875 | unless the client requests a resource protected by a security
|
| 876 | constraint that uses <code>CLIENT-CERT</code> authentication.</p>
|
| 877 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">clientCertProvider</code></td><td align="left" valign="center">
|
| 878 | <p>When client certificate information is presented in a form other than
|
| 879 | instances of <code>java.security.cert.X509Certificate</code> it needs to
|
| 880 | be converted before it can be used and this property controls which JSSE
|
| 881 | provider is used to perform the conversion. For example it is used with
|
| 882 | the <a href="ajp.html">AJP connectors</a>, the HTTP APR connector and
|
| 883 | with the <a href="valve.html#SSL_Authenticator_Valve">
|
| 884 | org.apache.catalina.valves.SSLValve</a>. If not specified, the default
|
| 885 | provider will be used.</p>
|
| 886 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">crlFile</code></td><td align="left" valign="center">
|
| 887 | <p>The certificate revocation list to be used to verify client
|
| 888 | certificates. If not defined, client certificates will not be checked
|
| 889 | against a certificate revocation list. The file may be specified using a
|
| 890 | URL, an absolute path or a relative (to CATALINA_BASE) path.</p>
|
| 891 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">keyAlias</code></td><td align="left" valign="center">
|
| 892 | <p>The alias used for the server key and certificate in the keystore. If
|
| 893 | not specified, the first key read from the keystore will be used. The
|
| 894 | order in which keys are read from the keystore is implementation
|
| 895 | dependent. It may not be the case that keys are read from the keystore in
|
| 896 | the same order as they were added. If more than one key is present in the
|
| 897 | keystore it is strongly recommended that a keyAlias is configured to
|
| 898 | ensure that the correct key is used.</p>
|
| 899 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">keyPass</code></td><td align="left" valign="center">
|
| 900 | <p>The password used to access the server certificate from the
|
| 901 | specified keystore file. The default value is "<code>changeit</code>".
|
| 902 | </p>
|
| 903 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">keystoreFile</code></td><td align="left" valign="center">
|
| 904 | <p>The pathname of the keystore file where you have stored the
|
| 905 | server certificate to be loaded. By default, the pathname is
|
| 906 | the file "<code>.keystore</code>" in the operating system home
|
| 907 | directory of the user that is running Tomcat. If your
|
| 908 | <code>keystoreType</code> doesn't need a file use <code>""</code>
|
| 909 | (empty string) for this parameter. The file may be specified using a
|
| 910 | URL, an absolute path or a relative (to CATALINA_BASE) path.</p>
|
| 911 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">keystorePass</code></td><td align="left" valign="center">
|
| 912 | <p>The password used to access the specified keystore file. The default
|
| 913 | value is the value of the <code>keyPass</code> attribute.
|
| 914 | </p>
|
| 915 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">keystoreProvider</code></td><td align="left" valign="center">
|
| 916 | <p>The name of the keystore provider to be used for the server
|
| 917 | certificate. If not specified, the list of registered providers is
|
| 918 | traversed in preference order and the first provider that supports the
|
| 919 | <code>keystoreType</code> is used.
|
| 920 | </p>
|
| 921 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">keystoreType</code></td><td align="left" valign="center">
|
| 922 | <p>The type of keystore file to be used for the server certificate.
|
| 923 | If not specified, the default value is "<code>JKS</code>".</p>
|
| 924 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sessionCacheSize</code></td><td align="left" valign="center">
|
| 925 | <p>The number of SSL sessions to maintain in the session cache. Use 0 to
|
| 926 | specify an unlimited cache size. If not specified, a default of 0 is
|
| 927 | used.</p>
|
| 928 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sessionTimeout</code></td><td align="left" valign="center">
|
| 929 | <p>The time, in seconds, after the creation of an SSL session that it will
|
| 930 | timeout. Use 0 to specify an unlimited timeout. If not specified, a
|
| 931 | default of 86400 (24 hours) is used.</p>
|
| 932 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sslEnabledProtocols</code></td><td align="left" valign="center">
|
| 933 | <p>The comma separated list of SSL protocols to support for HTTPS
|
| 934 | connections. If specified, only the protocols that are listed and
|
| 935 | supported by the SSL implementation will be enabled. If not specified,
|
| 936 | the JVM default (excluding SSLv2 and SSLv3 if the JVM enables either or
|
| 937 | both of them by default) is used. The permitted values may be obtained from the
|
| 938 | JVM documentation for the allowed values for
|
| 939 | <code>SSLSocket.setEnabledProtocols()</code> e.g.
|
| 940 | <a href="http://docs.oracle.com/javase/6/docs/technotes/guides/security/StandardNames.html#jssenames">
|
| 941 | Oracle Java 6</a> and
|
| 942 | <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#jssenames">
|
| 943 | Oracle Java 7</a>. Note: There is overlap between this attribute and
|
| 944 | <code>sslProtocol</code>.</p>
|
| 945 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sslImplementationName</code></td><td align="left" valign="center">
|
| 946 | <p>The class name of the SSL implementation to use. If not specified, the
|
| 947 | default of <code>org.apache.tomcat.util.net.jsse.JSSEImplementation</code>
|
| 948 | will be used which wraps JVM's default JSSE provider. Note that the
|
| 949 | JVM can be configured to use a different JSSE provider as the default.</p>
|
| 950 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">sslProtocol</code></td><td align="left" valign="center">
|
| 951 | <p>The SSL protocol(s) to use (a single value may enable multiple
|
| 952 | protocols - see the JVM documentation for details). If not specified, the
|
| 953 | default is <code>TLS</code>. The permitted values may be obtained from the
|
| 954 | JVM documentation for the allowed values for algorithm when creating an
|
| 955 | <code>SSLContext</code> instance e.g.
|
| 956 | <a href="http://docs.oracle.com/javase/6/docs/technotes/guides/security/StandardNames.html#SSLContext">
|
| 957 | Oracle Java 6</a> and
|
| 958 | <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#SSLContext">
|
| 959 | Oracle Java 7</a>. Note: There is overlap between this attribute and
|
| 960 | <code>sslEnabledProtocols</code>.</p>
|
| 961 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">trustManagerClassName</code></td><td align="left" valign="center">
|
| 962 | <p>The name of a custom trust manager class to use to validate client
|
| 963 | certificates. The class must have a zero argument constructor and must
|
| 964 | also implement <code>javax.net.ssl.X509TrustManager</code>. If this
|
| 965 | attribute is set, the trust store attributes may be ignored.
|
| 966 | </p>
|
| 967 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">trustMaxCertLength</code></td><td align="left" valign="center">
|
| 968 | <p>The maximum number of intermediate certificates that will be allowed
|
| 969 | when validating client certificates. If not specified, the default value
|
| 970 | of 5 will be used.</p>
|
| 971 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">truststoreAlgorithm</code></td><td align="left" valign="center">
|
| 972 | <p>The algorithm to use for truststore. If not specified, the default
|
| 973 | value returned by
|
| 974 | <code>javax.net.ssl.TrustManagerFactory.getDefaultAlgorithm()</code> is
|
| 975 | used.</p>
|
| 976 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">truststoreFile</code></td><td align="left" valign="center">
|
| 977 | <p>The trust store file to use to validate client certificates. The
|
| 978 | default is the value of the <code>javax.net.ssl.trustStore</code> system
|
| 979 | property. If neither this attribute nor the default system property is
|
| 980 | set, no trust store will be configured. The file may be specified using a
|
| 981 | URL, an absolute path or a relative (to CATALINA_BASE) path.</p>
|
| 982 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">truststorePass</code></td><td align="left" valign="center">
|
| 983 | <p>The password to access the trust store. The default is the value of the
|
| 984 | <code>javax.net.ssl.trustStorePassword</code> system property. If that
|
| 985 | property is null, no trust store password will be configured. If an
|
| 986 | invalid trust store password is specified, a warning will be logged and an
|
| 987 | attempt will be made to access the trust store without a password which
|
| 988 | will skip validation of the trust store contents.</p>
|
| 989 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">truststoreProvider</code></td><td align="left" valign="center">
|
| 990 | <p>The name of the truststore provider to be used for the server
|
| 991 | certificate. The default is the value of the
|
| 992 | <code>javax.net.ssl.trustStoreProvider</code> system property. If
|
| 993 | that property is null, the value of <code>keystoreProvider</code> is used
|
| 994 | as the default. If neither this attribute, the default system property nor
|
| 995 | <code>keystoreProvider</code>is set, the list of registered providers is
|
| 996 | traversed in preference order and the first provider that supports the
|
| 997 | <code>truststoreType</code> is used.
|
| 998 | </p>
|
| 999 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">truststoreType</code></td><td align="left" valign="center">
|
| 1000 | <p>The type of key store used for the trust store. The default is the
|
| 1001 | value of the <code>javax.net.ssl.trustStoreType</code> system property. If
|
| 1002 | that property is null, the value of <code>keystoreType</code> is used as
|
| 1003 | the default.</p>
|
| 1004 | </td></tr></table>
|
| 1005 |
|
| 1006 | </blockquote></td></tr></table>
|
| 1007 |
|
| 1008 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="SSL Support - APR/Native"><!--()--></a><a name="SSL_Support_-_APR/Native"><strong>SSL Support - APR/Native</strong></a></font></td></tr><tr><td><blockquote>
|
| 1009 |
|
| 1010 | <p>When APR/native is enabled, the HTTPS connector will use a socket poller
|
| 1011 | for keep-alive, increasing scalability of the server. It also uses OpenSSL,
|
| 1012 | which may be more optimized than JSSE depending on the processor being used,
|
| 1013 | and can be complemented with many commercial accelerator components. Unlike
|
| 1014 | the HTTP connector, the HTTPS connector cannot use sendfile to optimize static
|
| 1015 | file processing.</p>
|
| 1016 |
|
| 1017 | <p>The HTTPS APR/native connector has the same attributes than the HTTP
|
| 1018 | APR/native connector, but adds OpenSSL specific ones. For the full details on
|
| 1019 | using OpenSSL, please refer to OpenSSL documentations and the many books
|
| 1020 | available for it (see the <a href="http://www.openssl.org">Official OpenSSL
|
| 1021 | website</a>). The SSL specific attributes for the APR/native connector are:
|
| 1022 | </p>
|
| 1023 |
|
| 1024 | <table border="1" cellpadding="5"><tr><th width="15%" bgcolor="#023264"><font color="#ffffff">Attribute</font></th><th width="85%" bgcolor="#023264"><font color="#ffffff">Description</font></th></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCACertificateFile</code></td><td align="left" valign="center">
|
| 1025 | <p>See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatefile">
|
| 1026 | the mod_ssl documentation</a>.</p>
|
| 1027 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCACertificatePath</code></td><td align="left" valign="center">
|
| 1028 | <p>See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcacertificatepath">
|
| 1029 | the mod_ssl documentation</a>.</p>
|
| 1030 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCARevocationFile</code></td><td align="left" valign="center">
|
| 1031 | <p>See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcarevocationfile">
|
| 1032 | the mod_ssl documentation</a>.</p>
|
| 1033 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCARevocationPath</code></td><td align="left" valign="center">
|
| 1034 | <p>See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcarevocationpath">
|
| 1035 | the mod_ssl documentation</a>.</p>
|
| 1036 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCertificateChainFile</code></td><td align="left" valign="center">
|
| 1037 | <p>See <a href="http://httpd.apache.org/docs/2.2/mod/mod_ssl.html#sslcertificatechainfile">
|
| 1038 | the mod_ssl documentation</a>.</p>
|
| 1039 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCACertificateFile</code></td><td align="left" valign="center">
|
| 1040 | <p>Name of the file that contains the concatenated certificates for the
|
| 1041 | trusted certificate authorities. The format is PEM-encoded.</p>
|
| 1042 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCACertificatePath</code></td><td align="left" valign="center">
|
| 1043 | <p>Name of the directory that contains the certificates for the trusted
|
| 1044 | certificate authorities. The format is PEM-encoded.</p>
|
| 1045 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCARevocationFile</code></td><td align="left" valign="center">
|
| 1046 | <p>Name of the file that contains the concatenated certificate revocation
|
| 1047 | lists for the certificate authorities. The format is PEM-encoded.</p>
|
| 1048 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCARevocationPath</code></td><td align="left" valign="center">
|
| 1049 | <p>Name of the directory that contains the certificate revocation lists
|
| 1050 | for the certificate authorities. The format is PEM-encoded.</p>
|
| 1051 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCertificateChainFile</code></td><td align="left" valign="center">
|
| 1052 | <p>Name of the file that contains concatenated certifcates for the
|
| 1053 | certificate authorities which form the certifcate chain for the server
|
| 1054 | certificate. The format is PEM-encoded.</p>
|
| 1055 | </td></tr><tr><td align="left" valign="center"><strong><code class="attributeName">SSLCertificateFile</code></strong></td><td align="left" valign="center">
|
| 1056 | <p>Name of the file that contains the server certificate. The format is
|
| 1057 | PEM-encoded.</p>
|
| 1058 | <p>In addition to the certificate, the file can also contain as optional
|
| 1059 | elements DH parameters and/or an EC curve name for ephemeral keys, as
|
| 1060 | generated by <code>openssl dhparam</code> and <code>openssl ecparam</code>,
|
| 1061 | respectively. The output of the respective OpenSSL command can simply
|
| 1062 | be concatenated to the certificate file. This feature needs APR/native
|
| 1063 | version 1.1.34 or later.</p>
|
| 1064 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCertificateKeyFile</code></td><td align="left" valign="center">
|
| 1065 | <p>Name of the file that contains the server private key. The format is
|
| 1066 | PEM-encoded. The default value is the value of "SSLCertificateFile" and in
|
| 1067 | this case both certificate and private key have to be in this file (NOT
|
| 1068 | RECOMMENDED).</p>
|
| 1069 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLCipherSuite</code></td><td align="left" valign="center">
|
| 1070 | <p>Ciphers which may be used for communicating with clients. The default
|
| 1071 | is "HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA". See the OpenSSL
|
| 1072 | documentation for details of the cipher configuration options.</p>
|
| 1073 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLDisableCompression</code></td><td align="left" valign="center">
|
| 1074 | <p>Disables compression if set to <code>true</code> and OpenSSL supports
|
| 1075 | disabling compression. Default is <code>false</code> which inherits the
|
| 1076 | default compression setting in OpenSSL.</p>
|
| 1077 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLHonorCipherOrder</code></td><td align="left" valign="center">
|
| 1078 | <p>Set to <code>true</code> to enforce the server's cipher order
|
| 1079 | (from the <code>SSLCipherSuite</code> setting) instead of allowing
|
| 1080 | the client to choose the cipher (which is the default).</p>
|
| 1081 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLPassword</code></td><td align="left" valign="center">
|
| 1082 | <p>Pass phrase for the encrypted private key. If "SSLPassword" is not
|
| 1083 | provided, the callback function should prompt for the pass phrase.</p>
|
| 1084 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLProtocol</code></td><td align="left" valign="center">
|
| 1085 | <p>The names of the protocols to support when communicating with clients.
|
| 1086 | This should be a list of any combination of the following:
|
| 1087 | </p>
|
| 1088 | <ul><li>SSLv2</li><li>SSLv3</li><li>TLSv1</li>
|
| 1089 | <li>TLSv1.1</li><li>TLSv1.2</li><li>all</li></ul>
|
| 1090 | <p>Each token in the list can be prefixed with a plus sign ("+")
|
| 1091 | or a minus sign ("-"). A plus sign adds the protocol, a minus sign
|
| 1092 | removes it form the current list. The list is built starting from
|
| 1093 | an empty list.</p>
|
| 1094 | <p>The token <code>all</code> is an alias for
|
| 1095 | <code>TLSv1+TLSv1.1+TLSv1.2</code>.</p>
|
| 1096 | <p>If more than one protocol is specified for an OpenSSL
|
| 1097 | based secure connector it will always support <code>SSLv2Hello</code>. If a
|
| 1098 | single protocol is specified it will not support
|
| 1099 | <code>SSLv2Hello</code>.</p>
|
| 1100 | <p>Note that <code>SSLv2</code> and <code>SSLv3</code> are inherently
|
| 1101 | unsafe.</p>
|
| 1102 | <p>If not specified, the default value of <code>all</code> will be
|
| 1103 | used.</p>
|
| 1104 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLVerifyClient</code></td><td align="left" valign="center">
|
| 1105 | <p>Ask client for certificate. The default is "none", meaning the client
|
| 1106 | will not have the opportunity to submit a certificate. Other acceptable
|
| 1107 | values include "optional", "require" and "optionalNoCA".</p>
|
| 1108 | </td></tr><tr><td align="left" valign="center"><code class="attributeName">SSLVerifyDepth</code></td><td align="left" valign="center">
|
| 1109 | <p>Maximum verification depth for client certificates. The default is
|
| 1110 | "10".</p>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1111 | </td></tr></table>
|
| 1112 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1113 | </blockquote></td></tr></table>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1114 |
|
| 1115 | </blockquote></td></tr></table>
|
| 1116 | <table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#828DA6"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="Connector Comparison"><!--()--></a><a name="Connector_Comparison"><strong>Connector Comparison</strong></a></font></td></tr><tr><td><blockquote>
|
| 1117 |
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1118 | <p>Below is a small chart that shows how the connectors differ.</p>
|
| 1119 | <div class="codeBox"><pre><code>
|
| 1120 | Java Blocking Connector Java Non Blocking Connector APR/native Connector
|
| 1121 | BIO NIO APR
|
| 1122 | Classname Http11Protocol Http11NioProtocol Http11AprProtocol
|
| 1123 | Tomcat Version 3.x onwards 6.x onwards 5.5.x onwards
|
| 1124 | Support Polling NO YES YES
|
| 1125 | Polling Size N/A maxConnections maxConnections
|
| 1126 | Read Request Headers Blocking Non Blocking Blocking
|
| 1127 | Read Request Body Blocking Blocking Blocking
|
| 1128 | Write Response Blocking Blocking Blocking
|
| 1129 | Wait for next Request Blocking Non Blocking Non Blocking
|
| 1130 | SSL Support Java SSL Java SSL OpenSSL
|
| 1131 | SSL Handshake Blocking Non blocking Blocking
|
| 1132 | Max Connections maxConnections maxConnections maxConnections
|
| 1133 |
|
| 1134 |
|
| 1135 | </code></pre></div>
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1136 |
|
| 1137 | </blockquote></td></tr></table>
|
| 刘洪青 | 6266f99 | 2017-05-15 21:21:03 +0800 | [diff] [blame^] | 1138 | </blockquote></td></tr></table></td></tr><tr class="noPrint"><td width="20%" valign="top" nowrap class="noPrint"></td><td width="80%" valign="top" align="left"><table border="0" cellspacing="0" cellpadding="2"><tr><td bgcolor="#525D76"><font color="#ffffff" face="arial,helvetica.sanserif"><a name="comments_section" id="comments_section"><strong>Comments</strong></a></font></td></tr><tr><td><blockquote><p class="notice"><strong>Notice: </strong>This comments section collects your suggestions
|
| 1139 | on improving documentation for Apache Tomcat.<br><br>
|
| 1140 | If you have trouble and need help, read
|
| 1141 | <a href="http://tomcat.apache.org/findhelp.html">Find Help</a> page
|
| 1142 | and ask your question on the tomcat-users
|
| 1143 | <a href="http://tomcat.apache.org/lists.html">mailing list</a>.
|
| 1144 | Do not ask such questions here. This is not a Q&A section.<br><br>
|
| 1145 | The Apache Comments System is explained <a href="../comments.html">here</a>.
|
| 1146 | Comments may be removed by our moderators if they are either
|
| 1147 | implemented or considered invalid/off-topic.</p><script type="text/javascript"><!--//--><![CDATA[//><!--
|
| 1148 | var comments_shortname = 'tomcat';
|
| 1149 | var comments_identifier = 'http://tomcat.apache.org/tomcat-7.0-doc/config/http.html';
|
| 1150 | (function(w, d) {
|
| 1151 | if (w.location.hostname.toLowerCase() == "tomcat.apache.org") {
|
| 1152 | d.write('<div id="comments_thread"><\/div>');
|
| 1153 | var s = d.createElement('script');
|
| 1154 | s.type = 'text/javascript';
|
| 1155 | s.async = true;
|
| 1156 | s.src = 'https://comments.apache.org/show_comments.lua?site=' + comments_shortname + '&page=' + comments_identifier;
|
| 1157 | (d.getElementsByTagName('head')[0] || d.getElementsByTagName('body')[0]).appendChild(s);
|
| 1158 | }
|
| 1159 | else {
|
| 1160 | d.write('<div id="comments_thread"><strong>Comments are disabled for this page at the moment.<\/strong><\/div>');
|
| 1161 | }
|
| 1162 | })(window, document);
|
| 1163 | //--><!]]></script></blockquote></td></tr></table></td></tr><!--FOOTER SEPARATOR--><tr><td colspan="2"><hr noshade size="1"></td></tr><!--PAGE FOOTER--><tr><td colspan="2"><div align="center"><font color="#525D76" size="-1"><em>
|
| 1164 | Copyright © 1999-2017, Apache Software Foundation
|
| Hongqing Liu | fd5ee81 | 2014-05-10 16:32:51 +0800 | [diff] [blame] | 1165 | </em></font></div></td></tr></table></body></html> |