Dear Wiki user, You have subscribed to a wiki page or wiki category on "Tomcat Wiki" for change notification.
The "AJP with stunnel" page has been changed by ChristopherSchultz: https://wiki.apache.org/tomcat/AJP%20with%20stunnel New page: = AJP over stunnel = stunnel is a little more complicated than a normal protocol because it can be used in a number of different ways. I'll give some contrived examples to see how you can set it up in different ways, depending upon the support for encryption of the underlying protocol. This wiki entry is intended to be a starter-guide and not a replacement for the fine [https://www.stunnel.org/docs.html|documentation provided by the stunnel team]. Let's say that you have an HTTPS server, but your client can't speak HTTPS for some reason. If you set up stunnel on the *client* side, you can connect locally to the stunnel server and have it establish a secure-connection to the remote server running HTTPS. Like this: {{{ client -> localhost:12345 (stunnel) stunnel -> remote_host:443 (httpd) }}} As far as the client is concerned, it's using HTTP to talk to localhost. But really it's talking to remove_host:443, so everyone is happy. (Yes, there are issues with URLs and redirects produced by the server, but that's out of scope for this discussion). Let's take another example: you have clients that are HTTPS-capable, but the service you are running can only support HTTP for some reason, and you want to secure it. Set up stunnel on the *server*, then have your remote clients connect to *it* and tunnel to localhost. Like this: {{{ client -> remote_host:443 (stunnel) stunnel localhost:8080 (httpd) }}} As far as the client is concerned, it's using HTTPS to communicate with remote_host:443, but really it's connecting to remote_host:8080. (Yes, there are some issues with URLs and redirects but that's out of scope for this discussion.) So what if the underling protocol doesn't support TLS at all? Well, then you have to set up stunnel on *both sides* of the tunnel, like this: {{{ client (mod_jk) -> localhost:12345 (stunnel) stunnel -> remote_host:12345 (stunnel) stunnel -> localhost:8009 (Tomcat) }}} The setup for stunnel looks like this for the client (on the web server): {{{ sslVersion = all options = NO_SSLv2 options = NO_SSLv3 client = yes [ajp13s] accept=localhost:8009 connect=remote_host:8010 }}} On the server, it looks like this: {{{ sslVersion = all options = NO_SSLv2 options = NO_SSLv3 client = no [ajp13s] accept=8010 connect=localhost:8009 }}} On the web server, set your worker's host to "localhost" and port to 8009. mod_jk will connect to localhost:8009 which stunnel will accept and forward over the network to remote_host:8010 which will be accepted by stunnel on the server and forwarded to localhost:8009 on the server. stunnel is great because it will auto-reconnect if the connection is dropped for some reason. Remember a few things with stunnel: 1. Depending upon the version, you might only be able to use TLSv1 (and not e.g. TLSv1.2) 2. stunnel generally ignores certificate issues, such as expiration, etc. You might want to configure it with a little more care than the default. '''THIS ALSO MEANS IT DOES NOT AUTHENTICATE THE SERVER BY DEFAULT'''. You could accidentally connect to a malicious server. This should be enough to get you started. Please refer to the official stunnel documentation for specifics. --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@tomcat.apache.org For additional commands, e-mail: dev-h...@tomcat.apache.org
