Otdfbt

Multi tool use

What was the first story to feature the plot "the monsters were human all along"?

Understanding trademark infringements in a world where many dictionary words are trademarks?

Causes of bimodal distributions when bootstrapping a meta-analysis model

How can I roleplay a follower-type character when I as a player have a leader-type personality?

Should homeowners insurance cover the cost of the home?

Adding command shortcuts to bin

finding a solution for this recurrence relation

Copy previous line to current line from text file

Does it make sense for a function to return a rvalue reference

What are the advantages of luxury car brands like Acura/Lexus over their sibling non-luxury brands Honda/Toyota?

How to stop someone from registering domains that mimic more popular websites to abuse typos?

In Russian, how do you idiomatically express the idea of the figurative "overnight"?

Is there an idiom that support the idea that "inflation is bad"?

Why wasn't the Night King naked in S08E03?

60s/70s science fiction novel where a man (after years of trying) finally succeeds to make a coin levitate by sheer concentration

Word for Food that's Gone 'Bad', but is Still Edible?

Point of the Dothraki's attack in GoT S8E3?

How can internet speed be 10 times slower without a router than when using a router?

How to safely wipe a USB flash drive

Introducing Gladys, an intrepid globetrotter

Where are the "shires" in the UK?

Decoupling cap routing on a 4 layer PCB

SafeCracker #3 - We've Been Blocked

Has a commercial or military jet bi-plane ever been manufactured?

Verify client certificate CN in Tomcat(APR)

how to download the ssl certificate from a website?Apache not Forwarding Client x509 Certificate to Tomcat via mod_proxySSL certificate key permission - Tomcat APRInternet Explorer 8 - TLS Fatal Error Close Notify - Oracle HTTP - Server Apache 2.2.22.0Verify HASH value of certificateTomcat APR native librariesTomcat two way SSL with APR loses client certificate after a few requestsClient SSL certificate verify error in NginxCannot get SSL working on Tomcat8.5Configuring APR, OpenSSL, Tomcat Native Library, Java 1.8.0_171-b11 on Tomcat 8.5.32

.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;

0

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it).

What I'm trying to do is to lock a specific HTTPS connector down to users of a specific certificate. Adding client certificate verification is no issue, but I can't get it to validate against a specific Common name only.

I was perhaps a bit naïve and thought the mod_ssl attribute SSLRequire typically used in Apache Httpd would work, but that property is not recognized by the Tomcat implementation. (http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL%20Support points to some mod_ssl docs, but the Tomcat implementation does not seem to cover all aspects of mod_ssl).

I can get this to work by using the Java version of the connector instead of APR (losing some performance) and just add a trust store with that one certificate in it. However, using openssl without the SSLRequire expressions, I'm not sure how to do this with Tomcat7 (on Windows if that matters).

<Connector
 protocol="HTTP/1.1"
 port="443" maxThreads="150"
 scheme="https" secure="true" SSLEnabled="true"
 SSLCertificateFile="mycert.pem"
 SSLCertificateKeyFile="privkey.pem"
 SSLCACertificateFile="CABundle.pem"
 SSLVerifyClient="require" SSLProtocol="TLSv1" SSLRequire="(%SSL_CLIENT_S_DN_CN eq &quot;host.example.com&quot;)"/>

Can you suggest a way to make this work using Tomcat/APR/OpenSSL?

ssl tomcat openssl mod-ssl

share|improve this question

asked Apr 18 '13 at 15:29

Petter NordlanderPetter Nordlander

10315

add a comment | 

0

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it).

What I'm trying to do is to lock a specific HTTPS connector down to users of a specific certificate. Adding client certificate verification is no issue, but I can't get it to validate against a specific Common name only.

I was perhaps a bit naïve and thought the mod_ssl attribute SSLRequire typically used in Apache Httpd would work, but that property is not recognized by the Tomcat implementation. (http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL%20Support points to some mod_ssl docs, but the Tomcat implementation does not seem to cover all aspects of mod_ssl).

I can get this to work by using the Java version of the connector instead of APR (losing some performance) and just add a trust store with that one certificate in it. However, using openssl without the SSLRequire expressions, I'm not sure how to do this with Tomcat7 (on Windows if that matters).

<Connector
 protocol="HTTP/1.1"
 port="443" maxThreads="150"
 scheme="https" secure="true" SSLEnabled="true"
 SSLCertificateFile="mycert.pem"
 SSLCertificateKeyFile="privkey.pem"
 SSLCACertificateFile="CABundle.pem"
 SSLVerifyClient="require" SSLProtocol="TLSv1" SSLRequire="(%SSL_CLIENT_S_DN_CN eq &quot;host.example.com&quot;)"/>

Can you suggest a way to make this work using Tomcat/APR/OpenSSL?

ssl tomcat openssl mod-ssl

share|improve this question

asked Apr 18 '13 at 15:29

Petter NordlanderPetter Nordlander

10315

add a comment | 

I'm running a tomcat installation with the APR libraries installed (with the OpenSSL HTTPS stack that comes with it).

What I'm trying to do is to lock a specific HTTPS connector down to users of a specific certificate. Adding client certificate verification is no issue, but I can't get it to validate against a specific Common name only.

I was perhaps a bit naïve and thought the mod_ssl attribute SSLRequire typically used in Apache Httpd would work, but that property is not recognized by the Tomcat implementation. (http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL%20Support points to some mod_ssl docs, but the Tomcat implementation does not seem to cover all aspects of mod_ssl).

I can get this to work by using the Java version of the connector instead of APR (losing some performance) and just add a trust store with that one certificate in it. However, using openssl without the SSLRequire expressions, I'm not sure how to do this with Tomcat7 (on Windows if that matters).

<Connector
 protocol="HTTP/1.1"
 port="443" maxThreads="150"
 scheme="https" secure="true" SSLEnabled="true"
 SSLCertificateFile="mycert.pem"
 SSLCertificateKeyFile="privkey.pem"
 SSLCACertificateFile="CABundle.pem"
 SSLVerifyClient="require" SSLProtocol="TLSv1" SSLRequire="(%SSL_CLIENT_S_DN_CN eq &quot;host.example.com&quot;)"/>

Can you suggest a way to make this work using Tomcat/APR/OpenSSL?

ssl tomcat openssl mod-ssl

share|improve this question

asked Apr 18 '13 at 15:29

Petter NordlanderPetter Nordlander

10315

<Connector
 protocol="HTTP/1.1"
 port="443" maxThreads="150"
 scheme="https" secure="true" SSLEnabled="true"
 SSLCertificateFile="mycert.pem"
 SSLCertificateKeyFile="privkey.pem"
 SSLCACertificateFile="CABundle.pem"
 SSLVerifyClient="require" SSLProtocol="TLSv1" SSLRequire="(%SSL_CLIENT_S_DN_CN eq &quot;host.example.com&quot;)"/>

share|improve this question

asked Apr 18 '13 at 15:29

Petter NordlanderPetter Nordlander

10315

share|improve this question

asked Apr 18 '13 at 15:29

Petter NordlanderPetter Nordlander

10315

asked Apr 18 '13 at 15:29

Petter NordlanderPetter Nordlander

10315

asked Apr 18 '13 at 15:29

Petter NordlanderPetter Nordlander

10315

1 Answer
1

active

oldest

votes

0

The above excerpt is from sever.xml file, right? I have a question, why are you not using your cacerts keystore in whichever JVM/JDK you are using? You're using this to grant https access to your application running on tomcat, right?

I'm surprised PEM format certs worked in TOMCAT. I have always had to convert PEM certs to DER format and then use it in TOMCAT.

I would suggest:

1. Create cert in your keystore /your/path/to/java/jre/lib/security/cacerts by using keytool binary that comes with your java installation. It is provided for you to put your java app on SSL.

OR

1. if you already have your CACERT.PEM, convert it to DER using openssl:

openssl x509 -inform PEM -in CACERT.PEM -outform DER -out CACERT.DER

2. use keytool to import the cert into your keystore.




3. edit server.xml and the way you go.

share|improve this answer

answered Apr 19 '13 at 3:56

Nikolas SakicNikolas Sakic

45728

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  PEM should be fine, tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html uses pem in the example configuration. The question is not about how to import CA certs (this is working ok), but how to lock down the HTTPS connection to one single trusted client certificate.
  
  – Petter Nordlander
  Apr 19 '13 at 5:41
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Is there no option for client-side cert in Connector element? We now there is clientAuth="true", using truststore: truststoreFile, truststorePass, and truststoreType. I haven't tested it yet but client certs go in the trustore keystore if clientAuth is set to true.
  
  – Nikolas Sakic
  Apr 20 '13 at 18:39
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I guess so. Those types does, however, not work with the APR connector. That would mean I would have to sacrifice performance, which is, unfortunately, not an option
  
  – Petter Nordlander
  Apr 20 '13 at 20:06
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How much performance are we talking about here? Have you done any sort of testing?
  
  – Nikolas Sakic
  Apr 21 '13 at 3:11
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes I have done. It's not really relevant, as I state in the question - I can get this working using the java connector (JSSE). My question is how to do it using the APR/openssl module.
  
  – Petter Nordlander
  Apr 21 '13 at 8:40
  

  
  
  
  

 | 
show 1 more comment

Your Answer

StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);

StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);

else
createEditor();

);

function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);



);

draft saved

draft discarded

Sign up or log in

StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);

Sign up using Google

Sign up using Facebook

Sign up using Email and Password

Post as a guest

Name

Email

Required, but never shown

StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f500629%2fverify-client-certificate-cn-in-tomcatapr%23new-answer', 'question_page');

);

Post as a guest

Name

Email

Required, but never shown

0

The above excerpt is from sever.xml file, right? I have a question, why are you not using your cacerts keystore in whichever JVM/JDK you are using? You're using this to grant https access to your application running on tomcat, right?

I'm surprised PEM format certs worked in TOMCAT. I have always had to convert PEM certs to DER format and then use it in TOMCAT.

I would suggest:

1. Create cert in your keystore /your/path/to/java/jre/lib/security/cacerts by using keytool binary that comes with your java installation. It is provided for you to put your java app on SSL.

OR

1. if you already have your CACERT.PEM, convert it to DER using openssl:

openssl x509 -inform PEM -in CACERT.PEM -outform DER -out CACERT.DER

2. use keytool to import the cert into your keystore.




3. edit server.xml and the way you go.

share|improve this answer

answered Apr 19 '13 at 3:56

Nikolas SakicNikolas Sakic

45728

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  PEM should be fine, tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html uses pem in the example configuration. The question is not about how to import CA certs (this is working ok), but how to lock down the HTTPS connection to one single trusted client certificate.
  
  – Petter Nordlander
  Apr 19 '13 at 5:41
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Is there no option for client-side cert in Connector element? We now there is clientAuth="true", using truststore: truststoreFile, truststorePass, and truststoreType. I haven't tested it yet but client certs go in the trustore keystore if clientAuth is set to true.
  
  – Nikolas Sakic
  Apr 20 '13 at 18:39
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I guess so. Those types does, however, not work with the APR connector. That would mean I would have to sacrifice performance, which is, unfortunately, not an option
  
  – Petter Nordlander
  Apr 20 '13 at 20:06
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How much performance are we talking about here? Have you done any sort of testing?
  
  – Nikolas Sakic
  Apr 21 '13 at 3:11
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes I have done. It's not really relevant, as I state in the question - I can get this working using the java connector (JSSE). My question is how to do it using the APR/openssl module.
  
  – Petter Nordlander
  Apr 21 '13 at 8:40
  

  
  
  
  

 | 
show 1 more comment

0

The above excerpt is from sever.xml file, right? I have a question, why are you not using your cacerts keystore in whichever JVM/JDK you are using? You're using this to grant https access to your application running on tomcat, right?

I'm surprised PEM format certs worked in TOMCAT. I have always had to convert PEM certs to DER format and then use it in TOMCAT.

I would suggest:

1. Create cert in your keystore /your/path/to/java/jre/lib/security/cacerts by using keytool binary that comes with your java installation. It is provided for you to put your java app on SSL.

OR

1. if you already have your CACERT.PEM, convert it to DER using openssl:

openssl x509 -inform PEM -in CACERT.PEM -outform DER -out CACERT.DER

2. use keytool to import the cert into your keystore.




3. edit server.xml and the way you go.

share|improve this answer

answered Apr 19 '13 at 3:56

Nikolas SakicNikolas Sakic

45728

• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  PEM should be fine, tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html uses pem in the example configuration. The question is not about how to import CA certs (this is working ok), but how to lock down the HTTPS connection to one single trusted client certificate.
  
  – Petter Nordlander
  Apr 19 '13 at 5:41
  
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Is there no option for client-side cert in Connector element? We now there is clientAuth="true", using truststore: truststoreFile, truststorePass, and truststoreType. I haven't tested it yet but client certs go in the trustore keystore if clientAuth is set to true.
  
  – Nikolas Sakic
  Apr 20 '13 at 18:39
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  I guess so. Those types does, however, not work with the APR connector. That would mean I would have to sacrifice performance, which is, unfortunately, not an option
  
  – Petter Nordlander
  Apr 20 '13 at 20:06
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  How much performance are we talking about here? Have you done any sort of testing?
  
  – Nikolas Sakic
  Apr 21 '13 at 3:11
  

  
  
  
  


• 
  
  
  

  
  

  
  
  
  
  
  

  
  
  Yes I have done. It's not really relevant, as I state in the question - I can get this working using the java connector (JSSE). My question is how to do it using the APR/openssl module.
  
  – Petter Nordlander
  Apr 21 '13 at 8:40
  

  
  
  
  

 | 
show 1 more comment

The above excerpt is from sever.xml file, right? I have a question, why are you not using your cacerts keystore in whichever JVM/JDK you are using? You're using this to grant https access to your application running on tomcat, right?

I'm surprised PEM format certs worked in TOMCAT. I have always had to convert PEM certs to DER format and then use it in TOMCAT.

I would suggest:

1. Create cert in your keystore /your/path/to/java/jre/lib/security/cacerts by using keytool binary that comes with your java installation. It is provided for you to put your java app on SSL.

OR

1. if you already have your CACERT.PEM, convert it to DER using openssl:

openssl x509 -inform PEM -in CACERT.PEM -outform DER -out CACERT.DER

2. use keytool to import the cert into your keystore.




3. edit server.xml and the way you go.

share|improve this answer

answered Apr 19 '13 at 3:56

Nikolas SakicNikolas Sakic

45728

share|improve this answer

answered Apr 19 '13 at 3:56

Nikolas SakicNikolas Sakic

45728

answered Apr 19 '13 at 3:56

Nikolas SakicNikolas Sakic

45728

answered Apr 19 '13 at 3:56

Nikolas SakicNikolas Sakic

45728