Re: Fwd: Advice please for Tomcat 8.5.53-dev with log4j2

2020-03-19 Thread Brian Burch
On 18/3/20 5:54 pm, Luis Rodríguez Fernández wrote: Grande Brian, congrats! Sorry, I've just read your message, a bit late to the party: time ago I had cooked a tomcat9 container + log4j2 with a sample spring-boot app deployed. You can have a look here [1] Thanks very much, Luis. Although

Re: Weird error with certificate chain (JSSE security, with a JKS, in 7.0.93)

2020-03-19 Thread James H. H. Lampert
On 3/19/20 12:26 PM, Christopher Schultz wrote: In case(2) can you show us what certificates are present in your keystore? Something like: $ keytool -verbose -list -keystore server.jks Dear Mr. Schultz, et al: Actually, at least with the version of keytool I have, it would be more like:

Re: Tomcat 7.0.100 upgrade issues

2020-03-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 RK, On 3/19/20 13:11, RK Ashburn wrote: > Please let me know the release date for 7.0.103 The vote passed a few hours ago. I would expect the release announcement in the next 24 hours or so. - -chris > On Tue, Mar 17, 2020 at 6:01 PM Martin

Re: Weird error with certificate chain (JSSE security, with a JKS, in 7.0.93)

2020-03-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 James, On 3/19/20 12:24, James H. H. Lampert wrote: > We maintain a bunch of Tomcat 7 servers for various customers, all > using JSSE security, with a JKS. > > All of them show a complete certificate chain when accessed from a > browser. Some (if

Re: AJP Connector issue

2020-03-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 André, On 3/19/20 10:57, André Warnier (tomcat/perl) wrote: > For example : - if all your pairs of httpd server/tomcat server are > running on the same host, then you do not really have a security > issue, and adding a secret will not really bring

Re: AJP Connector issue

2020-03-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Florian, On 3/19/20 07:43, Fritze, Florian wrote: > since the Tomcat release with the Ghostcat security fix (Tomcat > 8.5.51) me as an admin have the problem using the > https://httpd.apache.org/docs/2.4/mod/mod_proxy_ajp.html module to > connect

Re: How to pass the --enable-preview parameter when using JSVC?

2020-03-19 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Ken, On 3/18/20 16:25, ken edward wrote: > Hello, > > When I deploy my war it produces the below error message, telling > me to pass the "--enable-preview". I can add the > "--enable-preview" to my tomcat start.sh script dev environment to >

Re: Tomcat 7.0.100 upgrade issues

2020-03-19 Thread RK Ashburn
Please let me know the release date for 7.0.103 Thank you On Tue, Mar 17, 2020 at 6:01 PM Martin Grigorov wrote: > Hi, > > On Tue, Mar 17, 2020 at 6:34 PM RK Ashburn > wrote: > > > Hi Tomcat 7 team, > > We have been using tomcat 7.0.99 and now we upgraded to 7.0.100 and our > web > >

Weird error with certificate chain (JSSE security, with a JKS, in 7.0.93)

2020-03-19 Thread James H. H. Lampert
We maintain a bunch of Tomcat 7 servers for various customers, all using JSSE security, with a JKS. All of them show a complete certificate chain when accessed from a browser. Some (if TLSv1.2 is not enabled, and especially those running on boxes that don't have Java 7 or Java 8) get

Re: I wish I could forward all requests completely to another server.

2020-03-19 Thread tomcat/perl
On 19.03.2020 04:18, HeeGu Lee wrote: I was tasked with writing a web application that needs to forward a http request to each server after checking certain headers. Of course I can use a library like apache http client to reconstruct and send the data. But if you think about it, this is a very

Re: AJP Connector issue

2020-03-19 Thread tomcat/perl
On 19.03.2020 12:43, Fritze, Florian wrote: Dear Tomcat users, since the Tomcat release with the Ghostcat security fix (Tomcat 8.5.51) me as an admin have the problem using the https://httpd.apache.org/docs/2.4/mod/mod_proxy_ajp.html module to connect the Apache HTTPD with the Tomcat running

AJP Connector issue

2020-03-19 Thread Fritze, Florian
Dear Tomcat users, since the Tomcat release with the Ghostcat security fix (Tomcat 8.5.51) me as an admin have the problem using the https://httpd.apache.org/docs/2.4/mod/mod_proxy_ajp.html module to connect the Apache HTTPD with the Tomcat running on localhost. The attribute secretRequired