Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-18 Thread Mark Thomas
On 18/03/2010 04:26, Goo Sam Kong wrote: Hi Mark, Will apache.org correct the Tomcat documentation or fix the code? The docs are correct. This is already fixed in Tomcat 7 and has been proposed for Tomcat 6. Mark - To

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Mark Thomas
On 17/03/2010 00:49, Goo Sam Kong wrote: May I know how to set the SSL session timeout in Tomcat 5.5.16. I am running JDK 1.5.0 update 7 on RedHat Enterprise. 1. Upgrade to the latest 6.0.x 2. Read the docs: http://tomcat.apache.org/tomcat-6.0-doc/config/http.html Mark

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Thank you very much Mark, I will try it tomorrow. On 17 March 2010 16:40, Mark Thomas ma...@apache.org wrote: On 17/03/2010 00:49, Goo Sam Kong wrote: May I know how to set the SSL session timeout in Tomcat 5.5.16. I am running JDK 1.5.0 update 7 on RedHat Enterprise. 1. Upgrade to the

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Hi Mark, Thank you for the solution, it working for me now. I noticed there is a error in Tomcat documentation (http://tomcat.apache.org/tomcat-6.0-doc/config/http.html), the correct attribute for session cache timeout should be sessionCacheTimeout instead of sessionTimeout in HTTPS connector.

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Caldarale, Charles R
From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 I noticed there is a error in Tomcat documentation (http://tomcat.apache.org/tomcat-6.0-doc/config/http.html), the correct attribute for session cache timeout should

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Hi Chuck, OIC, so when the code will be fixed? On 18 March 2010 11:07, Caldarale, Charles R chuck.caldar...@unisys.com wrote: From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 I noticed there is a error in Tomcat documentation (http

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Caldarale, Charles R
From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 OIC, so when the code will be fixed? No idea - I'm not a committer. It will get more attention if you file a Bugzilla entry for it: http://issues.apache.org/bugzilla/enter_bug.cgi

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Caldarale, Charles R
From: Caldarale, Charles R [mailto:chuck.caldar...@unisys.com] Subject: RE: How to set SSL session timeout in Tomcat 5.5.16 No idea - I'm not a committer. It will get more attention if you file a Bugzilla entry for it: http://issues.apache.org/bugzilla/enter_bug.cgi?product=Tomcat%206

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-17 Thread Goo Sam Kong
Hi Mark, Will apache.org correct the Tomcat documentation or fix the code? Thank you. On 18 March 2010 11:16, Caldarale, Charles R chuck.caldar...@unisys.com wrote: From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 OIC, so when

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Caldarale, Charles R
From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: How to set SSL session timeout in Tomcat 5.5.16 May I know how to set the SSL session timeout in Tomcat 5.5.16. The session timeout value is independent of the session security, and set by the session-timeout value in the webapp's

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Goo Sam Kong
Hi Chuck, I am referring to invalidate SSL session. My application is using client certificate authentication, the XML-RPC client is using USB token as a keystore during SSL session, we want to force client to re-authenticate with my application on every XML-RPC request to prevent user remove the

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Caldarale, Charles R
From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 Can I invalidate the SSL session on server side? Look at the servlet API doc: http://tomcat.apache.org/tomcat-5.5-doc/servletapi/javax/servlet/http/HttpSession.html#invalidate() Again

Re: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Goo Sam Kong
how to do/configure to invalidate SSL session? Thank you. Regards, SamKong Goo On 17 March 2010 10:30, Caldarale, Charles R chuck.caldar...@unisys.com wrote: From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 Can I invalidate the SSL

RE: How to set SSL session timeout in Tomcat 5.5.16

2010-03-16 Thread Caldarale, Charles R
From: Goo Sam Kong [mailto:skgo...@gmail.com] Subject: Re: How to set SSL session timeout in Tomcat 5.5.16 I attempted that, that is HTTP Session not SSL session. Depending on how your webapp is configured, you may have two HttpSession objects - one protected, and one not. Make sure you're