Re: Error during import of domain certificate from Comodo: keytool error: java.lang.Exception: Failed to establish chain from reply

2015-04-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Fleur,

On 4/12/15 3:42 PM, Fleur Garage wrote:
 Chris,
 
 Yes, i have imported the root and intermediate certificates
 successfully (using the commands below) but import of the last
 certficate (domain cert) is failing with the chain error.
 
 A. Local self-signed cert generation keytool -genkey -alias tomcat
 -keyalg RSA -keysize 2048 -keystore hostname.keystore
 
 B. CSR generation keytool -certreq -keyalg RSA -alias tomcat -file
 hostname.csr -keystore hostname.keystore
 
 C. Sent CSR for signing and received 4 certificates from Comodo 
 AddTrustExternalCARoot.crt COMODORSAAddTrustCA.crt 
 COMODORSAOrganizationValidationSecureServerCA.crt hostname.crt
 
 D. Import Root certificate keytool -import -trustcacerts -alias
 AddTrustExternalCARoot -file AddTrustExternalCARoot.crt -keystore
 hostname.keystore
 
 E. Import Intermediate1 certificate keytool -import -trustcacerts
 -alias COMODORSAAddTrustCA -file COMODORSAAddTrustCA.crt -keystore
 hostname.keystore
 
 F. Import Intermediate2 certificate keytool -import -trustcacerts
 -alias COMODORSAOrganizationValidationSecureServerCA -file 
 COMODORSAOrganizationValidationSecureServerCA.crt -keystore 
 hostname.keystore
 
 All 3 certificates were successfully imported.
 
 G. Import of domain/server certificate failed keytool -import
 -trustcacerts -alias tomcat -file hostname.crt -keystore 
 hostname.keystore
 
 keytool error: java.lang.Exception: Failed to establish chain from
 reply

Try removing the trustcacerts argument:

$ keytool -import -alias tomcat -file hostname.crt -keystore
hostname.keystore

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVKycqAAoJEBzwKT+lPKRYilkP/0/gtAqiYLd3AVR+taq03rk3
hho/IHXdyzMhrqvKgttiCRvb53tB+HNkkk0le7R8xDVu9YNvpNFOKZ+qlar5fJQ1
togbQ1I8n0jekzrORE0Xlni6Kg2ssEjmYOtMBaBRh37Um2S8bX52qR85QiDA+B3K
PY6RXnOUn2ZuMaU8CZZqpiQEoSXbaYavKGlJY1Iy/mVU6rS12JL8N51Zkc9jLX1X
wnhrwbAbn4E9s57d04sC/JJKrd/+aojCtV5LfNPJseRrGPH9pKKrXYWiJmo/beBq
I2Qp5lR4vv/BrssMZ3NdnMIwEI+T/D1yU6L37VdHZvVS8nkBadIcZCktnypeqmji
8RClOGyCx/n+nOdq5LU+UghgM4jiRYiXZhUhO93QScPVxMTJbLAtxKe/uCKs4TLi
8xXkjHpyjxoJnCxqp6h/8XgQYbaw+JMoYCn2jI0im0RFOOKOxOrqbIu49+rBKOxs
qI/xlI+A3ySCO536xqZpB4RnA2THwVzo4JiNXI7pXpqClX2pHYA2dnCIloj/lJcS
nK59RWzG3tL4QgdbXPPm44RUBFtMovNWxDH23fFQEApBtfB/+G9gt9+hdHDrw2Gj
JgKKv7cdjJ3VuP40wyyu4odSL9/yf9Zf/q00Nu36dZ9YoX/iUPv/BzWR1T1XPLhj
9KBrQ57QoXIrHij5JPqX
=4SP4
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Error during import of domain certificate from Comodo: keytool error: java.lang.Exception: Failed to establish chain from reply

2015-04-12 Thread Fleur Garage
Chris,

Unfortunately, even without the trustcacerts argument, it is still giving
the same error.
keytool error: java.lang.Exception: Failed to establish chain from reply

Thank you.

On Sun, Apr 12, 2015 at 7:17 PM, Christopher Schultz 
ch...@christopherschultz.net wrote:

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA256

 Fleur,

 On 4/12/15 3:42 PM, Fleur Garage wrote:
  Chris,
 
  Yes, i have imported the root and intermediate certificates
  successfully (using the commands below) but import of the last
  certficate (domain cert) is failing with the chain error.
 
  A. Local self-signed cert generation keytool -genkey -alias tomcat
  -keyalg RSA -keysize 2048 -keystore hostname.keystore
 
  B. CSR generation keytool -certreq -keyalg RSA -alias tomcat -file
  hostname.csr -keystore hostname.keystore
 
  C. Sent CSR for signing and received 4 certificates from Comodo
  AddTrustExternalCARoot.crt COMODORSAAddTrustCA.crt
  COMODORSAOrganizationValidationSecureServerCA.crt hostname.crt
 
  D. Import Root certificate keytool -import -trustcacerts -alias
  AddTrustExternalCARoot -file AddTrustExternalCARoot.crt -keystore
  hostname.keystore
 
  E. Import Intermediate1 certificate keytool -import -trustcacerts
  -alias COMODORSAAddTrustCA -file COMODORSAAddTrustCA.crt -keystore
  hostname.keystore
 
  F. Import Intermediate2 certificate keytool -import -trustcacerts
  -alias COMODORSAOrganizationValidationSecureServerCA -file
  COMODORSAOrganizationValidationSecureServerCA.crt -keystore
  hostname.keystore
 
  All 3 certificates were successfully imported.
 
  G. Import of domain/server certificate failed keytool -import
  -trustcacerts -alias tomcat -file hostname.crt -keystore
  hostname.keystore
 
  keytool error: java.lang.Exception: Failed to establish chain from
  reply

 Try removing the trustcacerts argument:

 $ keytool -import -alias tomcat -file hostname.crt -keystore
 hostname.keystore

 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v2
 Comment: GPGTools - http://gpgtools.org

 iQIcBAEBCAAGBQJVKycqAAoJEBzwKT+lPKRYilkP/0/gtAqiYLd3AVR+taq03rk3
 hho/IHXdyzMhrqvKgttiCRvb53tB+HNkkk0le7R8xDVu9YNvpNFOKZ+qlar5fJQ1
 togbQ1I8n0jekzrORE0Xlni6Kg2ssEjmYOtMBaBRh37Um2S8bX52qR85QiDA+B3K
 PY6RXnOUn2ZuMaU8CZZqpiQEoSXbaYavKGlJY1Iy/mVU6rS12JL8N51Zkc9jLX1X
 wnhrwbAbn4E9s57d04sC/JJKrd/+aojCtV5LfNPJseRrGPH9pKKrXYWiJmo/beBq
 I2Qp5lR4vv/BrssMZ3NdnMIwEI+T/D1yU6L37VdHZvVS8nkBadIcZCktnypeqmji
 8RClOGyCx/n+nOdq5LU+UghgM4jiRYiXZhUhO93QScPVxMTJbLAtxKe/uCKs4TLi
 8xXkjHpyjxoJnCxqp6h/8XgQYbaw+JMoYCn2jI0im0RFOOKOxOrqbIu49+rBKOxs
 qI/xlI+A3ySCO536xqZpB4RnA2THwVzo4JiNXI7pXpqClX2pHYA2dnCIloj/lJcS
 nK59RWzG3tL4QgdbXPPm44RUBFtMovNWxDH23fFQEApBtfB/+G9gt9+hdHDrw2Gj
 JgKKv7cdjJ3VuP40wyyu4odSL9/yf9Zf/q00Nu36dZ9YoX/iUPv/BzWR1T1XPLhj
 9KBrQ57QoXIrHij5JPqX
 =4SP4
 -END PGP SIGNATURE-

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org




Re: SEVERE: All threads (200) are currently busy

2015-04-12 Thread Rainer Jung

Am 12.04.2015 um 02:20 schrieb HG:

Every once in a while we get the following (Tomcat 6)

Mar 31, 2015 7:24:32 PM org.apache.tomcat.util.threads.ThreadPool logFull
SEVERE: All threads (200) are currently busy, waiting. Increase
maxThreads (200) or check the servlet status

in the Catalina logs and server stops responding. The server is used
very lightly and number of concurrent users not anywhere near 200 (2-3
on a busy day)

The thread dump shows 199 of these:

TP-Processor200 daemon prio=10 tid=0x2b513c31b000 nid=0x1c44
runnable [0x2b514a9a7000]
java.lang.Thread.State: RUNNABLE
 at java.net.SocketInputStream.socketRead0(Native Method)
 at java.net.SocketInputStream.read(SocketInputStream.java:129)
 at java.io.BufferedInputStream.fill(BufferedInputStream.java:218)
 at java.io.BufferedInputStream.read1(BufferedInputStream.java:258)
 at java.io.BufferedInputStream.read(BufferedInputStream.java:317)
 - locked 0x0007873208a0 (a java.io.BufferedInputStream)
 at org.apache.jk.common.ChannelSocket.read(ChannelSocket.java:628)
 at org.apache.jk.common.ChannelSocket.receive(ChannelSocket.java:566)
 at
org.apache.jk.common.ChannelSocket.processConnection(ChannelSocket.java:693)

 at
org.apache.jk.common.ChannelSocket$SocketConnection.runIt(ChannelSocket.java:898)

 at
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)

 at java.lang.Thread.run(Thread.java:662)

and one of

TP-Processor4 daemon prio=10 tid=0x2b513c21a000 nid=0x7470 in
Object.wait() [0x2b513552]
java.lang.Thread.State: WAITING (on object monitor)
 at java.lang.Object.wait(Native Method)
 - waiting on 0x000784a7a208 (a
org.apache.tomcat.util.threads.ThreadPool)
 at java.lang.Object.wait(Object.java:485)
 at
org.apache.tomcat.util.threads.ThreadPool.findControlRunnable(ThreadPool.java:339)

 - locked 0x000784a7a208 (a
org.apache.tomcat.util.threads.ThreadPool)
 at
org.apache.tomcat.util.threads.ThreadPool.runIt(ThreadPool.java:314)
 at
org.apache.jk.common.ChannelSocket.acceptConnections(ChannelSocket.java:676)

 at
org.apache.jk.common.ChannelSocket$SocketAcceptor.runIt(ChannelSocket.java:879)

 at
org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:690)

 at java.lang.Thread.run(Thread.java:662)

Can anybody figure out why it complaints about busy threads when they
are clearly not?


The first 199 are connected to a fronting web server and wait for 
requests on their connections.


You are using a blocking connector implementation. That means each web 
server to Tomcat connection needs on eexclusive thread to handle it. It 
does not matter whether the connection already has an in-flight request 
on it or is completely idle. The thread is exclusively working for this 
single connection. Once your Tomcat has as manyconnections open in 
parallel as your thread pool size (or n-1), it can not accept any more 
connections and will log the observed message.


Your can choose a mix of the following optimizations:

- increase your thread pool size

- configure Tomcat and for web server (Apache/mod_jk, 
Apache/mod_proxy_ajp, ...) to shut down idle connections more 
aggressively to free Tomcat threads
  - lower idle connection timeout (Tomcat keep alive timeout and e.g. 
mod_jk connection_pool_timeout)
  - lower the number of connections, that will be kept alive even if 
they are idle for a long time (mod_jk connectiopn_pool_min_size)


- switch to a non blocking connector implementation like NIO. There the 
threads are not blocked during the time the connections are idle. Idle 
connections are monitored by (few, e.g. 1) poller threads and only 
connections with in-flight requests need a normal thread pool thread.


- Make sure your web servers are not oversized in terms of their own 
capability on how many connections in parallel they will provide


Regards,

Rainer

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Error during import of domain certificate from Comodo: keytool error: java.lang.Exception: Failed to establish chain from reply

2015-04-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Fleur,

On 4/10/15 10:40 PM, Fleur Garage wrote:
 I am trying to enable SSL on Apache Tomcat/7.0.32.  Have generated
 a local self-signed cert and CSR and have sent the .csr for
 signing. I have received 4 certificates back from Comodo: 
 AddTrustExternalCARoot.crt, COMODORSAAddTrustCA.crt, 
 COMODORSAOrganizationValidationSecureServerCA.crt and my
 server/domain certificate.
 
 Import of Root CA and both Intermediate certificates to my keystore
 was successful.  I received the message Certificate was added to
 keystore for each of them.
 
 But, when I tried to import the server/domain certificate, I am
 getting the Failed to establish chain from reply. *keytool -import
 -trustcacerts -alias tomcat -file domain.crt -keystore 
 mykeystore*
 
 Note that the alias (tomcat) I used here is the same alias I used
 to generate the csr. Does anyone have an idea on how to resolve
 this issue?

You'll need to import the root and intermediate certificates from the
CA first, which it sounds like you did. Just to confirm, you did
something like this:

 $ keytool -import -alias [Authority.CA] -trustcacerts -file
[authority's CA cert] -keystore ${HOSTNAME}.jks

 $ keytool -import -alias [Authority.intermediate] -trustcacerts -file
[authority's intermediate cert] -keystore ${HOSTNAME}.jks

(you may have to do this more than once if you have multiple
intermediate certificates)

 $ keytool -import -alias ${HOSTNAME} -file ${HOSTNAME}.crt -keystore
${HOSTNAME}.jks

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVKpWlAAoJEBzwKT+lPKRY7nYP/2n6RGUUNcS6TndwIVqxmYBw
PRJoc30j4+radbnCjHRS1xzbFl3NZZE4JchLjllArTC37oPE91WvtQQzk7WiDE4U
MXweBmHFI9fbQ4Vhk88d1PVkctwu67dxSwUAZWepb5aF1BY97yWRAUP5kvqWlMez
fWweRXE9So90BIIw9MCktn0v/y2LN1B1j0Vx3SrfnCFbZjDobmULIfeDeD03yjgt
kfVxq3HJkVUmREoTikmQNgV/5TbEpUooj4nqopq30ALdRjikJxLsWcAkfwTt1Weh
cBQ0rnWZY4UopdLV/iXM6MrMvMkr59siY0LDibYkzqLYXIZlsyg36zrauXFosLmW
Ppl4iTxi9eUWl5HQaV5hhbySSHGQQPeXtJGrdgSuNy4mFShQWrWlBpEVrhVocJYn
IIdX4B3b6oTRFhfJaEbc+CZ1manrp1jv3MPxdtfDy2e548DKTH6wrKgf2S22QCxj
fLTYmd2mu4F2zqA3UOkC/epoJdpFhuIMZzKhopnUGPtyUoFJB5x6aEZhddRxjPQ+
PIbjc5ttH9R9z663/bxoaqse8YbZTX9bJqerxtQ+RV/WDO5roVz3XRuZNB9ln983
MRtp8DknIr5TWwhm0DUbB1gYC9TcNRcAi5p1JDNRw3JVGzcr6IHgL2DhQX1Lw3+H
zxEpdJ6DJElRONcuK42/
=1/Pn
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: SSLCertificateKeyFile directive question

2015-04-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

John,

On 4/10/15 5:04 PM, John Beaulaurier -X (jbeaulau - ADVANCED NETWORK
INFORMATION INC at Cisco) wrote:
 I need to configure SSL in Tomcat 7.0.39, but am staled at the 
 SSLCertificateKeyFile directive.

You should upgrade Tomcat if at all possible. There are known,
advertised security problems with a version that old.

http://tomcat.apache.org/security-7.html

 I have been given by our info security team two trusted CA 
 certificates, root and intermediate, with our large company being 
 the CA, to use for ldap over ssl with APR in order to use OpenSSL.

Are you trying to configure TLS for the Tomcat server to accept
requests, or so that you can connect to your LDAP server securely? If
the former, you want to configure your Connector appropriately and
make sure to use the APR-based connector. If the latter, I don't think
you can choose an OpenSSL-based client to use for making outgoing LDAP
connections.

 In the Tomcat docs is the directive SSLCertificateKeyFile stating
 it must point to the private key. We are using keystore, and when I
 try to export the private key the end result is that it cannot
 export the key due to it being a trusted certificate
 KeyStoreException: TrustedCertEntry not supported. How to obtain
 the key? Is there another method, or does the CA need to supply it
 to me?

It sounds like you are trying to connect to a secure LDAP server and
you just want to configure the trust store.

You're getting confused between the two above cases I asked about. The
documentation you are looking for is here:
http://tomcat.apache.org/tomcat-7.0-doc/realm-howto.html#JNDIRealm

Unfortunately, the docs look a little thin for the JNDIRealm, and I
think it doesn't tell you what to do about ldaps:// connections.
Checking the Javadoc for that class, there don't appear to be any
settings you can put on the connector to handle the trust store, so I
suspect JNDIRealm will use the JVM's default trust store which is I
think just the one that ships with the JVM. So if you need to trust
some other CA (i.e. not a public one), then you'll need to set the
javax.net.ssl.trustStore system property to point to your own trust
store which contains the lowest certificate you are willing to
completely trust. You may choose to trust the whole CA or maybe just
the leaf certificate for the LDAP server (which might be slightly more
appropriate/safe for your purpoases).

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVKpftAAoJEBzwKT+lPKRYGB4P/RyabJxRypA7etPsVWXm5OD1
R9NS+DadHTj/2K43zik4tT9ZE5dUU8N3f/6EXbhjMQcnKT5fg8Kx1jzqtee0gGAG
+zaZCiLm8UeoyVyST+aQovatgIzwwUyxIUlgH54W8MRXTFPb2cKydSlwsD9/q+i4
zpZluHTL1lMCQezQhB0/4VR7TBim7yMIxhnZGlwmQKDwJYNFkUIMf9qF9jvn/HP0
ZzCAW1FB5TbgppfOSXvLI7blDYCb+DqYecFAtzJmkQHY8ioUF3Q0bdGfYQV9jELi
m9KndsZeBGrpEBROQOOQJTXl+8LSc6SicHaHFTKNH6ZiIp2hVTqfJHGxvI9E67u6
VJdtxBUwhWzxCYu40fmBonlUBBsvJKZMkYisVF5hhXnxc5H8bCxOPcghqXlnXLMM
9KQiNxRhJwqocpBgwPf/mcyAmFSraLRMAqt7XTTPtc+6RgfN0r1FBcHQjyOuFYZS
cQ5N+GqwA8TVZ0+eB8z0iK87629KrDgFPih7LhOIHsLSX7MBRgnpq7T5BKByNane
UOC9i7aK9ekbAVusDHjhXgR/3SoSr3tz0fjY1Y3iTrEhhYLiix9pxv2wpWlvvQtG
HQK2jAKJrljMMyd5iVFGhWmfxujVFDnlENLY1IaNgRYQ218g1L2NJVMuEX7PPvA9
WM3V0X7Zw9LdINC9XbdS
=C/fB
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Error during import of domain certificate from Comodo: keytool error: java.lang.Exception: Failed to establish chain from reply

2015-04-12 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Fleur,

On 4/12/15 11:56 AM, Christopher Schultz wrote:
 Fleur,
 
 On 4/10/15 10:40 PM, Fleur Garage wrote:
 I am trying to enable SSL on Apache Tomcat/7.0.32.

Oh, and you should definitely upgrade your Tomcat. There are known and
published vulnerabilities between that version and the latest (7.0.61):

http://tomcat.apache.org/security-7.html

- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v2
Comment: GPGTools - http://gpgtools.org

iQIcBAEBCAAGBQJVKpgtAAoJEBzwKT+lPKRYr4sP/ifUt5MjBGVq0rYQvowWkfau
sVss9rV+2vFvpYYi2Ye4wlvcSxAUBSG91JpxYi9tADnXZ78tTMc6zeiwnfUCGEp4
16na3yF+qAUKYBXi4D7Cqn9dmufu/WJzeR3K7oTPkjqFrlhF/KvZUIAwZqnkuGst
yzBIA0V9iRoZG9bCWOkhOMDZ4/FfQNWuc5fHNyjMj1rJ+6QQMMmZoSrQDvjnPgtW
8zK5fOmSc/v5MchdSDHpBV/hOLiOqzGWEYWbgHcq9pUGjxV46ngdCy+QGMfccCUu
yAG1G3EhBStlz0bnjKcDWieuDZ2iz7VOI0FmLOmgIsvXZzEbylcsJ/pQD8GVj0cu
RutDyCHU15Fg1vngcjD8+402uOLSxkONhKC3v7QWG8LRIqj8cRr11YWRP0mo+iEt
aqlF+fdImE7qchz5i3oF+YH6fys5z3r48wO6Hy5GanxcFN+wjGeJZ48gKcsgRX/l
DrmvuNfQn2ERY0KbfJkV8rN8oeBUijr30cWILAzEoECRyulmT3PcRMPoIMHqqAB+
TspKAu/ZA7ueob96in3C74F8peXJStHsv00X1MCY7xSBGaxb3Ly+4kdhRUXD5bpb
lLHC8mWmf8twqwsmxiStt4J5wdXI43d8lMC+luemzmdd8CWLgkxJHF6KCv2X2Beu
yK+GeFf9e2OV1vE97e64
=EnDX
-END PGP SIGNATURE-

-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org



Re: Error during import of domain certificate from Comodo: keytool error: java.lang.Exception: Failed to establish chain from reply

2015-04-12 Thread Fleur Garage
Chris,

Yes, i have imported the root and intermediate certificates successfully
(using the commands below) but import of the last certficate (domain cert)
is failing with the chain error.

A. Local self-signed cert generation
keytool -genkey -alias tomcat -keyalg RSA -keysize 2048 -keystore
hostname.keystore

B. CSR generation
keytool -certreq -keyalg RSA -alias tomcat -file hostname.csr -keystore
hostname.keystore

C. Sent CSR for signing and received 4 certificates from Comodo
AddTrustExternalCARoot.crt
COMODORSAAddTrustCA.crt
COMODORSAOrganizationValidationSecureServerCA.crt
hostname.crt

D. Import Root certificate
keytool -import -trustcacerts -alias AddTrustExternalCARoot -file
AddTrustExternalCARoot.crt -keystore hostname.keystore

E. Import Intermediate1 certificate
keytool -import -trustcacerts -alias COMODORSAAddTrustCA -file
COMODORSAAddTrustCA.crt -keystore hostname.keystore

F. Import Intermediate2 certificate
keytool -import -trustcacerts -alias
COMODORSAOrganizationValidationSecureServerCA -file
COMODORSAOrganizationValidationSecureServerCA.crt -keystore
hostname.keystore

All 3 certificates were successfully imported.

G. Import of domain/server certificate failed
keytool -import -trustcacerts -alias tomcat -file hostname.crt -keystore
hostname.keystore

keytool error: java.lang.Exception: Failed to establish chain from reply


Am I doing something wrong here?
Thank you.

On Sun, Apr 12, 2015 at 9:07 AM, Christopher Schultz 
ch...@christopherschultz.net wrote:

 -BEGIN PGP SIGNED MESSAGE-
 Hash: SHA256

 Fleur,

 On 4/12/15 11:56 AM, Christopher Schultz wrote:
  Fleur,
 
  On 4/10/15 10:40 PM, Fleur Garage wrote:
  I am trying to enable SSL on Apache Tomcat/7.0.32.

 Oh, and you should definitely upgrade your Tomcat. There are known and
 published vulnerabilities between that version and the latest (7.0.61):

 http://tomcat.apache.org/security-7.html

 - -chris
 -BEGIN PGP SIGNATURE-
 Version: GnuPG v2
 Comment: GPGTools - http://gpgtools.org

 iQIcBAEBCAAGBQJVKpgtAAoJEBzwKT+lPKRYr4sP/ifUt5MjBGVq0rYQvowWkfau
 sVss9rV+2vFvpYYi2Ye4wlvcSxAUBSG91JpxYi9tADnXZ78tTMc6zeiwnfUCGEp4
 16na3yF+qAUKYBXi4D7Cqn9dmufu/WJzeR3K7oTPkjqFrlhF/KvZUIAwZqnkuGst
 yzBIA0V9iRoZG9bCWOkhOMDZ4/FfQNWuc5fHNyjMj1rJ+6QQMMmZoSrQDvjnPgtW
 8zK5fOmSc/v5MchdSDHpBV/hOLiOqzGWEYWbgHcq9pUGjxV46ngdCy+QGMfccCUu
 yAG1G3EhBStlz0bnjKcDWieuDZ2iz7VOI0FmLOmgIsvXZzEbylcsJ/pQD8GVj0cu
 RutDyCHU15Fg1vngcjD8+402uOLSxkONhKC3v7QWG8LRIqj8cRr11YWRP0mo+iEt
 aqlF+fdImE7qchz5i3oF+YH6fys5z3r48wO6Hy5GanxcFN+wjGeJZ48gKcsgRX/l
 DrmvuNfQn2ERY0KbfJkV8rN8oeBUijr30cWILAzEoECRyulmT3PcRMPoIMHqqAB+
 TspKAu/ZA7ueob96in3C74F8peXJStHsv00X1MCY7xSBGaxb3Ly+4kdhRUXD5bpb
 lLHC8mWmf8twqwsmxiStt4J5wdXI43d8lMC+luemzmdd8CWLgkxJHF6KCv2X2Beu
 yK+GeFf9e2OV1vE97e64
 =EnDX
 -END PGP SIGNATURE-

 -
 To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
 For additional commands, e-mail: users-h...@tomcat.apache.org