tomcat-users mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Ognjen Blagojevic <ognjen.d.blagoje...@gmail.com>
Subject Re: Secure Tomcat With SSL
Date Mon, 28 Oct 2013 22:17:45 GMT
Chris,

On 28.10.2013 21:45, Chris Arnold wrote:
>> Let us first determine which connector do you have configured (BIO, NIO
>> or APR), because HTTPS configuration depends on connector type. Could
>> you send your server.xml with comments and sensitive information removed?
>
> <?xml version='1.0' encoding='utf-8'?>
> <!--

Please, remove comments next time, it will make it easier for us to read.


>      <Connector port="xxxxxx" URIEncoding="UTF-8" protocol="HTTP/1.1"
>                 connectionTimeout="20000"
>                 redirectPort="xxxxx" maxHttpHeaderSize="32768" />
...
>      <Connector port="xxxxx" URIEncoding="UTF-8" protocol="HTTP/1.1" SSLEnabled="true"
>                 maxThreads="150" scheme="https" secure="true"
>                 clientAuth="false" sslProtocol="TLS" maxHttpHeaderSize="32768" />
...
>      <Connector port="xxxxx" URIEncoding="UTF-8" protocol="AJP/1.3" redirectPort="xxxxx"
/>
>
>      <Connector port="xxxxx" URIEncoding="UTF-8" protocol="org.apache.coyote.http11.Http11Protocol"
SSLEnabled="true"
>                 maxThreads="150" scheme="https" keystoreFile="/opt/alfresco/alf_data/keystore/ssl.keystore"
keystorePass="kT9X6oe68t" keystoreType="JCEKS"
>   secure="true" connectionTimeout="240000" truststoreFile="/opt/alfresco/alf_data/keystore/ssl.truststore"
truststorePass="kT9X6oe68t" truststoreType="JCEKS"
>                 clientAuth="want" sslProtocol="TLS" allowUnsafeLegacyRenegotiation="true"
maxHttpHeaderSize="32768" />

Ok, so you have four connectors configured. First two of them have 
attribute protocol="HTTP/1.1", which means that it will automatically 
select between APR and BIO connector. APR will be selected if apropriate 
libarary is found on the system. If not, BIO connector will be selected.

Note that you dislosed your keystore passwords on public mailing list, 
so you may consider to change them.


> Here it is but you will see both being initialized:
> Oct 18, 2013 8:03:58 PM org.apache.coyote.AbstractProtocol init
> INFO: Initializing ProtocolHandler ["http-apr-8080"]

Ok, so APR library is found, and APR HTTP connector is initialized on 
port 8080.

Second (HTTPS APR auto select) connector probably fails to initialize 
since you didn't provide necessary files containing key and certificates.


> Oct 18, 2013 8:03:58 PM org.apache.coyote.AbstractProtocol init
> INFO: Initializing ProtocolHandler ["ajp-apr-8009"]

This is third connector in your configuration. It is used for 
communication between Apache httpd and Apache Tomcat. In case you don't 
use httpd, you may comment that one out.


> Oct 18, 2013 8:03:58 PM org.apache.coyote.AbstractProtocol init
> INFO: Initializing ProtocolHandler ["http-bio-8443"]

This is fourth connector from your configuration, and it is BIO 
connector, since attribute protocol is set to 
"org.apache.coyote.http11.Http11Protocol". It seems to be working fine.


Now you have two HTTPS connectors configured, APR (2nd in your 
configuration) and BIO (fourth in your configuration). APR fails to 
start. It is not clear from the information you provided so far are you 
trying to configure APR connector, but I will assume you do, since BIO 
connector looks configured already.

You will have to make sure that ports for APR and BIO connector differs.

Now, for APR connector, you don't need keystore, but seperate files for 
server key, server certificates, and intermediate certificates. Then add 
those attributes to APR connector:

   SSLCertificateFile="/home/tomcat/server.cert"
   SSLCertificateKeyFile="/home/tomcat/server.key"
   SSLCertificateChainFile="/home/tomcat/intermediates.pem"

When you get APR HTTPS connector up and running, to remove weak ciphers 
from OpenSSL default configuration, I strongly suggest that you also 
restrict cipher in use, using these two attiributes to connector 
configuration (*):

     SSLHonorCipherOrder="true"
 
SSLCipherSuite="EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA384:EECDH+ECDSA+SHA256:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+RC4:EECDH:EDH+aRSA:RC4:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS"

For more info on setting up APR HTTPS connector, please read:

 
https://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support_-_APR/Native

-Ognjen


(*) As recommeded by Ivan Ristic:

https://community.qualys.com/blogs/securitylabs/2013/08/05/configuring-apache-nginx-and-openssl-for-forward-secrecy#/?page=2

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org


Mime
View raw message