HI! I think I have configured Tomcat correctly with a server certificate and the accompanying CA cert in a single PKCS#12 file.
CAS ticketing fully works with PHP example apps even when accessing them over different server names (which did not work without HTTPS as designed). Also a test with openssl s_client shows that everything seems perfect with cert validation and Tomcat is sending the full cert chain including the CA cert. But I still get this message when accessing the services manager through https://cas-server.stroeder.local:8443/mycas/services/ -------------------------- snip -------------------------- Authorization Failure You are not authorized to use this application for the following reason: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target. -------------------------- snip -------------------------- I tried to dig the mailing list archives but I did not find anything helpful how to track this down further. Does anybody can give me a hint? Maybe something's wrong with the cert extensions for Java? Mozilla and OpenSSL accept these. Ciao, Michael. ------------------- server.xml (lines wrapped) ------------------- <Server port="8005" shutdown="SHUTDOWN"> <GlobalNamingResources> <!-- Used by Manager webapp --> <Resource name="UserDatabase" auth="Container" type="org.apache.catalina.UserDatabase" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory" pathname="conf/tomcat-users.xml" /> </GlobalNamingResources> <Service name="Catalina"> <!-- Define a SSL HTTP/1.1 Connector on port 443 --> <Connector port="8443" maxHttpHeaderSize="8192" maxThreads="100" minSpareThreads="3" maxSpareThreads="10" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreType="PKCS12" keystoreFile="/etc/tomcat5.5/cas-server.stroeder.local.p12" keystorePass="1234" truststoreType="PKCS12" truststoreFile="/etc/tomcat5.5/cas-server.stroeder.local.p12" truststorePass="1234" /> <Engine name="Catalina" defaultHost="cas-server.stroeder.local"> <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" /> <Host name="cas-server.stroeder.local" appBase="webapps" unpackWARs="true" autoDeploy="true" /> </Engine> </Service> </Server> ------------------- text ouput of server cert ------------------- Certificate: Data: Version: 3 (0x2) Serial Number: 2 (0x2) Signature Algorithm: sha1WithRSAEncryption Issuer: C=DE, L=Leverkusen, O=stroeder.com, OU=ITS, CN=Server CA No. 1 Validity Not Before: Mar 6 11:56:36 2008 GMT Not After : Mar 6 11:56:36 2009 GMT Subject: C=DE, L=Karlsruhe, O=stroeder.com, OU=ITS, CN=cas-server.stroeder.local Subject Public Key Info: Public Key Algorithm: rsaEncryption RSA Public Key: (1024 bit) Modulus (1024 bit): 00:ba:7f:ba:f5:fe:fd:92:21:7e:20:10:73:88:e5: [..binary garbage snipped..] 1c:85:ed:9c:a3:63:36:b1:41 Exponent: 65537 (0x10001) X509v3 extensions: X509v3 Extended Key Usage: TLS Web Server Authentication, TLS Web Client Authentication X509v3 CRL Distribution Points: URI:http://localhost/pyca/get-cert.py/Root/crl.crl Netscape Comment: This certificate is solely used for SSL-enabled servers. Netscape Cert Type: SSL Server Signature Algorithm: sha1WithRSAEncryption 0e:53:61:7b:90:0c:80:f4:b5:9d:12:6b:94:6b:f6:74:93:84: [..even more binary garbage snipped..] d0:4f:e5:51 _______________________________________________ Yale CAS mailing list [email protected] http://tp.its.yale.edu/mailman/listinfo/cas
