Mailing-List: contact tomcat-dev-help@jakarta.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Developers List" <tomcat-dev@jakarta.apache.org>
Received-SPF: pass (hermes.apache.org: local policy)
Message-ID: <41640717.4040001@fujitsu-siemens.com>
Date: Wed, 06 Oct 2004 16:54:15 +0200
From: jean-frederic clere <jfrederic.clere@fujitsu-siemens.com>
Reply-To: jfrederic.clere@fujitsu-siemens.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7b) Gecko/20040517
MIME-Version: 1.0
To: Tomcat Developers List <tomcat-dev@jakarta.apache.org>
Subject: Re: Problems with SSL_CLIENT_CERT_CHAIN_n from servlet
References: <CAEHKKCAEJPMMOFLOPGCKEKKCAAA.j.luna@certiver.com>
In-Reply-To: <CAEHKKCAEJPMMOFLOPGCKEKKCAAA.j.luna@certiver.com>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: quoted-printable

Jes=FAs Luna wrote:
> Hi everybody,
> Currently I'm developing a servlet that validates with our OCSP service=
 a
> user certificate received from Apache v1.3.29 (with mod_ssl v2.8.16 and=

> ajp13 workers), but the problem is that I need to extract some data abo=
ut
> the correspondent client certificate chain to build the OCSP request an=
d
> I've not been able to obtain this from Tomcat v4.1.30 (with mod_jk v1.2=
) all
> under Linux. I'm pretty sure that it's not a configuration problem beca=
use
> my servlet is already retrieving additional information from mod_jk (i.=
e.
> the client certificate, cipher, protocol and other SSL_ environment
> variables from Apache/mod_ssl).

What do have in httpd.conf?

>=20
> Anyway, in mod_jk I've tried the following directives:
> JkEnvVar SSL_CLIENT_CERT_CHAIN_0 SSL_CLIENT_CERT_CHAIN_0
> JkEnvVar SSL_CLIENT_CERT_CHAIN_1 SSL_CLIENT_CERT_CHAIN_1
> .
> .
> etc
>=20
> An then from my Java servlet:
> String chain0 =3D (String) request.getAttribute("SSL_CLIENT_CERT_CHAIN_=
0");
> // Also tried it like an X509Certificate object
> 							 // Variable chain0 appears equal to the string
> "SSL_CLIENT_CERT_CHAIN_0"
>=20
> X509Certificate[] cert
> =3D(X509Certificate[])request.getAttribute("javax.servlet.request.X509C=
ertific
> ate");
> 					// Only getting one certificate in the array, the correspondent to=
 the
> SSL client
> 					// No certificates from the chain
>=20
> Finally, I've been browsing trough some emails on this list that talk a=
bout
> performance issues with the cert chain extraction so I don=B4t know if =
this
> feature may be unavailable or something like this.
>=20
> Thank you in advance for your help, best regards
>=20
> _______________________
> Jesus Luna Garcia
> CertiVeR (U.E. Funded Project)
> j.luna@certiver.com
> http://www.certiver.com
>=20
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>=20
>=20


---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org