Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of dmikusa@gopivotal.com
 designates 209.85.216.49 as permitted sender)
Content-Type: text/plain; charset=utf-8
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
Subject: Re: enable SSL for Tomcat
From: Daniel Mikusa <dmikusa@gopivotal.com>
In-Reply-To: 
 <C9980A592F21A14294A61F0640FEBAAE0EF582AF@045-SN2MPN2-052.045d.mgd.msft.net>
Date: Wed, 4 Dec 2013 08:14:40 -0500
Content-Transfer-Encoding: quoted-printable
Message-Id: <7940BC92-7D7F-4DAD-B2B3-2F2AA10FBF44@gopivotal.com>
References: 
 <C9980A592F21A14294A61F0640FEBAAE0EF58244@045-SN2MPN2-052.045d.mgd.msft.net>
 <529F182F.6070505@gmail.com>
 <C9980A592F21A14294A61F0640FEBAAE0EF582AF@045-SN2MPN2-052.045d.mgd.msft.net>
To: "Tomcat Users List" <users@tomcat.apache.org>

On Dec 4, 2013, at 7:40 AM, Sivakumar_Balaguru@contractor.amat.com =
wrote:

> Hi Ognjen,
>=20
> I have tried this as well.
>=20
> I have generated a new keystore. By default, keytool generates a =
keystore with a private key.

Good.  You're half way there.

>=20
> I have imported the trusted signed certificate to this keystore.

Huh?  Which signed certificate?  The one that you had generated using =
the MS tool?  If so, that's not going to work.  You need to generate a =
new CSR based on the keystore's private cert and get a new signed =
certificate from your CA.  Then import the new signed cert into your =
keystore.

Dan


>=20
> But Tomcat is using the unsigned key/certificate which has been =
generated by default with keytool.=20
>=20
> The domain is not trusting this certificate as it is private =
self-signed certificate not the trusted one and SSL is not accomplished.
>=20
> As an alternative, I have deleted the self-signed private key from the =
keystore so that the keystore contains only one certificate which is =
signed by the certified authority(Entrust).
>=20
> This couldn't help me in enabling SSL.
>=20
>=20
> Regards!!
> Siva Kumar Balaguru
> SME | Identity, Security Access and Messaging Services (ISAMS) | =
Applied Materials India Pvt. Ltd. | Chennai | India
> Mobile : +91-8438569069|Extn : 7002 | Tie Line: #9575 7002
>=20
> What is ISAMS?  Please see our site to learn more: isams.amat.com
> =20
> The content of this message is Applied Materials Confidential. If you =
are not the intended recipient and have received this message in error, =
any use or distribution is prohibited. Please notify me immediately by =
reply e-mail and delete this message from your computer system. Thank =
you=20
> ** Save a tree. Please don't print this e-mail unless needed.
>=20
> -----Original Message-----
> From: Ognjen Blagojevic [mailto:ognjen.d.blagojevic@gmail.com]=20
> Sent: Wednesday, December 04, 2013 5:25 PM
> To: Tomcat Users List
> Subject: Re: enable SSL for Tomcat
>=20
> Sivakumar,
>=20
> On 4.12.2013 12:11, Sivakumar_Balaguru@contractor.amat.com wrote:
>> I need to enable SSL for tomcat in a windows server 2008. I have=20
>> generated a certificate using the csr generated by this command:=20
>> certreq -new request.inf request.req
> (...)
>> I have imported this certificate to CACERTS using keytool and =
uncommented the connector configuration in servers.xml in APACHE conf =
folder.
>=20
> You used Microsoft tool (certreq) to generate the private key and CSR, =
and Java tool (keytool) to import the certificate into Java keystore.=20
> That is your problem.
>=20
> You need to, *either*:
>=20
> 1. Start from the beginning: Use Java keytool to generate private key =
in Java keystore, to create CSR, and to import certificate into that =
SAME Java keystore. You should not use "cacerts" file as you keystore, =
but other file for that purpose (e.g. c:\users\sivakumar\server.jks).
>=20
> 2. Reuse what you have so far: Find where certreq stored private key; =
export private key; import private key and certificate into PKCS =
keystore; convert PKCS keystore into new keystore in JKS format.
>=20
> You should consider which one is easier for you, and then we can help =
you along the way.
>=20
>=20
>> Connector port=3D"8443" =
protocol=3D"org.apache.coyote.http11.Http11NioProtocol" =
SSLEnabled=3D"true" keystoreFile=3D"C:\Program =
Files\Java\jre7\lib\security\CACERTS" keystorePass=3D"changeit" =
maxThreads=3D"300" scheme=3D"https" secure=3D"true" clientAuth=3D"false" =
sslProtocol=3D"TLS"
>=20
> Whatever you do, you will have to change keystoreFile attribute from=20=

> "C:\Program Files\Java\jre7\lib\security\CACERTS" to e.g.=20
> "c:\users\sivakumar\server.jks."
>=20
>=20
>> I didn't find any error on startup of Tomcat but still ssl is not =
enabled.
>=20
> That is strange. What you described would result in cacerts file=20
> containing server certificate without the private key. Therefore I =
would=20
> expect that Tomcat complains about inability to find the private key.
>=20
> Either way, cacerts file is not the right place to store server =
private=20
> key and certificate. That file should contain only certificates from=20=

> trusted CA.
>=20
> -Ognjen
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>=20
> =
=03B=EF=BF=BDKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKK=
KKKKKKKCB=EF=BF=BD=1B=EF=BF=BD=1D[=EF=BF=BD=EF=BF=BDX=EF=BF=BD=EF=BF=BD=DC=
=9AX=EF=BF=BDK=08=19K[XZ[=0E=EF=BF=BD=1D\=EF=BF=BD\=EF=BF=BD=EF=BF=BD][=EF=
=BF=BD=EF=BF=BDX=EF=BF=BD=EF=BF=BD=DC=9AX=EF=BF=BDP=1D=1B=EF=BF=BDX=EF=BF=BD=
]=0B=
=EF=BF=BD\=18X=EF=BF=BD=19K=EF=BF=BD=DC=99=EF=BF=BDB=EF=BF=BD=EF=BF=BD=DC=88=
=18Y=19=1A]=1A[=DB=98[=08=18=EF=BF=BD=EF=BF=BD[X[=EF=BF=BD=1C=EF=BF=BD=08=19=
K[XZ[=0E=EF=BF=BD=1D\=EF=BF=BD\=EF=BF=BD=EF=BF=BDZ=19[=1C=10=1D=1B=EF=BF=BD=
X=EF=BF=BD]=0B=EF=BF=BD\=18X=EF=BF=BD=19K=EF=BF=BD=DC=99=EF=BF=BDB=EF=BF=BD=


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org