Re: Tomcat on Windows : new keystore possibilities

[david w]

I understand, but am not looking for troubleshooting but trying to raise 
awareness of the new sunmscapi capabilities.
I'm testing using the private key in the windows machine store to simplify tls 
implementation.
For this it requires local admin rights but I am also looking how to not need 
this...

David Wooffindin

From: Bill Stewart 
Sent: Monday, April 8, 2024 5:36:47 PM
To: Tomcat Users List 
Subject: Re: Tomcat on Windows : new keystore possibilities

On Mon, Apr 8, 2024 at 8:27 AM david w wrote:

If you can share a way for this to not be necessary, I'm all ears...
>

I can read computer certificates from non-privileged accounts on Windows.
(How would a user application such as a browser work otherwise?)

I'm not sure what's different on your system or why you think a privileged
account is required.

In any case, this would not be a Tomcat-specific issue but rather some kind
of configuration issue. (What I am saying is that troubleshooting this
issue on your machine is really outside the scope of this specific mailing
list.)

I would repeat my recommendation not to run a web server of any kind
(Tomcat or otherwise) using a privileged account.

Bill

Re: Tomcat on Windows : new keystore possibilities

[david w]

If you can share a way for this to not be necessary, I'm all ears...

David Wooffindin

From: Bill Stewart 
Sent: Monday, April 8, 2024 4:22:37 PM
To: Tomcat Users List 
Subject: Re: Tomcat on Windows : new keystore possibilities

On Mon, Apr 8, 2024 at 3:49 AM david w wrote:

The account running the Tomcat Windows Service needs local Administrator
> rights to be able to refernce these certificate stores.
>

Fortunately, this statement is not correct.

I would definitely not recommend running the Tomcat service using a
privileged account.

Bill

Tomcat on Windows : new keystore possibilities

[david w]

Hello
Referring to the documentation on Apache Tomcat 9 Configuration Reference 
(9.0.87) - The HTTP 
Connector
 keystore types, i wanted to get mentioned that a new set of possibilities is 
available with newer java builds, when using Tomcat in a Windows environment.


As mentioned on the OpenJDK bug tracker: 
https://bugs.openjdk.org/browse/JDK-8286790


The Windows KeyStore support in the SunMSCAPI provider has been expanded to 
include access to the local machine location. The new keystore types are:



Windows-MY-LOCALMACHINE

Windows-ROOT-LOCALMACHINE



The following keystore types were also added, allowing developers to make it 
clear they map to the current user:

 Windows-MY-CURRENTUSER (same as "Windows-MY")

Windows-ROOT-CURRENTUSER (same as "Windows-ROOT")


Alongside other configurations possible on the server side, web certificates 
can be automatically published, renewed and managed with a company's internal 
Active Directory CA. The account running the Tomcat Windows Service needs local 
Administrator rights to be able to refernce these certificate stores.

With this enabled, and setting the server.xml Connector like shown below can 
make certificate management a lot easier.



the use of a predefined Environment Variable for the system name, possible when 
using also this setting  in catalina.properties:
#GPO Managed restricted file: TESTING
#allow_System ENVVar Usage
org.apache.tomcat.util.digester.PROPERTY_SOURCE=org.apache.tomcat.util.digester.Digester$EnvironmentPropertySource

 makes it easier to maintain a common server.xml file through tools like GPO.

Could it be useful to somehow document this, as it does make our WIndows admin 
life easier!!

Re: How to Install Tomcat 5.5 Administration Web Application

[David W. Brown]

Hello Nissam, I am having the same problem with the Tomcat Admin. However, I am 
using the JDBC Realm (MySQL) instead of the tomcat-users.xml. Please advise, 
David.

On 26/Apr/2006 06:39 nissam wrote ..
 
 Hi
Add a user like below.
user username=nisam password=nisam roles=standard,manager,admin/
Remove the cache and restart tomcat. The admin application should be
 working.
 rgds
 nissam
 --
 View this message in context: 
 http://www.nabble.com/How-to-Install-Tomcat-5.5-Administration-Web-Application-t1368054.html#a4099700
 Sent from the Tomcat - User forum at Nabble.com.
 
 
 -
 To unsubscribe, e-mail: [EMAIL PROTECTED]
 For additional commands, e-mail: [EMAIL PROTECTED]
David Brown
IT/Systems
USM-I KBR-Central
APO AE 09316


-
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]