tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
Subject Cannot authenticate client with Tomcat 5.0.28
Date Mon, 29 Jan 2007 09:00:39 GMT
Hi everyone,

I work for a municipality we need to implement a service that can log users(from a browser)
by electronic identity card.
I've installed a card reader, and created https connector for tomcat 5.5 that way:

	<Connector port="7443" 
	               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
	               enableLookups="false" disableUploadTimeout="true"
	               acceptCount="100" debug="99" scheme="https" secure="true"
	               clientAuth="true" sslProtocol="TLS"
	               keystorePass="*****" keystoreType="JKS"
	               	       truststorePass="*****" truststoreType="JKS" />

For server authentication, I've created a self-signed certificate using java tool keytool:
keytool -genkey -v -alias tomcat -keyalg RSA -validity 3650 -keystore mypath\tomcat.jks

because i don't need to obtain a trusted certificate from a certification authority.
The problem is for the client.
When I insert a smartcard, the card reader software installs a card certificate in Internet
Explorer and in Firefox. This certificate is at the "bottom" of a chain of 3 certificates,
so I downloaded via web the chain of certificates, then installed the chain in both browsers,
then added the root CA certificate to the repository truststore of the server:
keytool -import -v -file pathToCer\root.cer  -keystore mypath\tomcat.jks -trustcacerts
this, as instructions found in Internet, should be enough for tomcat to recognize the client
But when trying to access https://myservername:7443
i get "Error estabilishing an ecrypted connection Error code: -12222" whit Firefox, Explorer
instead prompts me asking for pin of the card(this is necessary i think to use private key
in the card) then "Cannot display page"(or something similar, i've installed browser in a
non-english language)

I tested the server trying to replace browser certificate with another self-signed certificate,
then importing it in the truststore and it works well.
So i think it's a problem of how client certificate is stored in the truststore file.
I also tried to import all certificates in the truststore(the client card certificate, the
intermediate cert., the root cert.) but it doesn't work.

Can anybody help me?I'm sure i did something wrong importing certificates but i can't understand


Passa a Infostrada. ADSL e Telefono senza limiti e senza canone Telecom

To start a new topic, e-mail:
To unsubscribe, e-mail:
For additional commands, e-mail:

View raw message