Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of epicwinter@hotmail.com
 designates 65.55.111.101 as permitted sender)
Message-ID: <BLU145-W5B92D578572BE5313D798C3B80@phx.gbl>
Content-Type: multipart/alternative;
	boundary="_e78b2388-58e8-4ed3-962f-6430920356f6_"
From: "epicwinter@hotmail.com" <epicwinter@hotmail.com>
To: <users@tomcat.apache.org>
Subject: RE: ssl connector
Date: Thu, 12 Feb 2009 21:09:15 -0800
Importance: Normal
In-Reply-To: 
 <0AAE5AB84B013E45A7B61CB66943C17215B77F59C0@USEA-EXCH7.na.uis.unisys.com>
References: 
 <BLU145-W452AB238B3C38414C867D8C3B80@phx.gbl><2fb267f80902121638j3be52f68pa87eef50de813583@mail.gmail.com>
 <BLU145-W241AB9809A8018D86F2CB5C3B80@phx.gbl>
 <0AAE5AB84B013E45A7B61CB66943C17215B77F59C0@USEA-EXCH7.na.uis.unisys.com>
MIME-Version: 1.0

--_e78b2388-58e8-4ed3-962f-6430920356f6_
Content-Type: text/plain; charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable


Thanks it makes sense now=2C i have made lots of progress.  But of course=
=2C like usual=2C  there are some complications.  The application I am deve=
loping uses tomcat on the back end and a swing client on the front with the=
 Spring HttpInvoker. =20

So first I got it working without apr.  After I set up the connector I chan=
ged it so when i ran my java client using this vm parameter
-Djavax.net.ssl.trustStore=3D"keystore.jks"=20

Everything worked.  So next=2C I moved on to APR.  I got apr properly compi=
led/installed.  Then I set up the connector like so:
<Connector protocol=3D"org.apache.coyote.http11.Http11AprProtocol"
           port=3D"8443" minSpareThreads=3D"5" maxSpareThreads=3D"75"
           enableLookups=3D"true" disableUploadTimeout=3D"true"=20
           acceptCount=3D"100"  maxThreads=3D"200"
           scheme=3D"https" secure=3D"true" SSLEnabled=3D"true"
    SSLCertificateFile=3D"certfile"
    SSLCertificateKeyFile=3D"key"
    SSLPassword=3D"password"
           clientAuth=3D"false" sslProtocol=3D"TLS"/

Tomcat starts and acknowledges that apr is working without a problem.  I th=
ought that with apr I could just run the client without the trustStore para=
meter set.  But i get this error:
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.Vali=
datorException: PKIX path building failed: sun.security.provider.certpath.S=
unCertPathBuilderException: unable to find valid certification path to requ=
ested target

So how do I tell the client about the cert?  I tried the trustStore=3D"path=
tocert" but that didn't work. =20

thanks
-ryan

> From: Chuck.Caldarale@unisys.com
> To: users@tomcat.apache.org
> Date: Thu=2C 12 Feb 2009 21:47:45 -0600
> Subject: RE: ssl connector
>=20
> > From: epicwinter@hotmail.com [mailto:epicwinter@hotmail.com]
> > Subject: RE: ssl connector
> >
> > So I don't understand the docs where they suggest
> > defining connectors with apr and without.
>=20
> APR is an additional=2C non-Java Tomcat component that utilizes code from=
 httpd for increased SSL performance.  It uses OpenSSL=2C not Java=2C for t=
he SSL negotiation and encryption=2C so there's no keystore file=2C and the=
 <Connector> configuration is very different from that for the standard or =
NIO options.  The drawback of APR is that you typically have to compile it =
from source for the specific platform you're running on (some binary downlo=
ads are available)=2C so it's not something for the casual or first-time To=
mcat administrator.
>=20
> The table at the bottom of this page:
> http://tomcat.apache.org/tomcat-6.0-doc/config/http.html
> gives you a comparison of the three forms of connector=3B pick just one f=
or your usage.
>=20
>  - Chuck
>=20
>=20
> THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY =
MATERIAL and is thus for use only by the intended recipient. If you receive=
d this in error=2C please contact the sender and delete the e-mail and its =
attachments from all computers.
>=20
> ---------------------------------------------------------------------
> To unsubscribe=2C e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands=2C e-mail: users-help@tomcat.apache.org
>=20

_________________________________________________________________
Windows Live=99: E-mail. Chat. Share. Get more ways to connect.=20
http://windowslive.com/online/hotmail?ocid=3DTXT_TAGLM_WL_HM_AE_Faster_0220=
09=

--_e78b2388-58e8-4ed3-962f-6430920356f6_--