keytool -genkey -v -alias tomcat -keyalg RSA -keystore D:\tomcat.keystore -validity 36500
keytool -genkey -v -alias mykey -keyalg RSA -storetype PKCS12 -keystore D:\mykey.p12
keytool -export -alias mykey -keystore D:\mykey.p12 -storetype PKCS12 -storepass zengjin -rfc -file D:\mykey.cer
keytool -import -v -file D:\mykey.cer -keystore D:\tomcat.keystore
keytool -list -keystore D:\tomcat.keystore
keytool -keystore D:\tomcat.keystore -export -alias tomcat -file D:\tomcat.cer
in tomcat conf server.xml ==>
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
SSLEnabled="true" maxThreads="150" scheme="https"
secure="true" clientAuth="true" sslProtocol="TLS"
keystoreFile="D:\\tomcat.keystore" keystorePass="zengjin"
truststoreFile="D:\\tomcat.keystore" truststorePass="zengjin" />
原文：http://www.cnblogs.com/zengjin93/p/5344782.html