DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24563>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND INSERTED IN THE BUG DATABASE.
http://nagoya.apache.org/bugzilla/show_bug.cgi?id=24563 Problem with SSL authentication ------- Additional Comments From [EMAIL PROTECTED] 2003-11-11 19:37 ------- I have this working using J2SE 1.3.1_02, JSSE 1.0.3_01, JBoss 3.2.1, Tomcat 4.1.24, NT4 SP6a, MS Certificate Server, MS IE 6. The users were authenticated using a custom LoginModule (reasons explained below). It took quite a bit of trial and error to get working because, as you are finding, the error messages are not always the most helpful. I am going to assume that you can connect using https without authentication (ie https://localhost:8443/jmx-console works) I am also going to assume that you have imported the certificate(s) of the server(s) that issued your tomcat and client certificates using a command(s) similar to: keytool -import -alias CertServerName -file CertServerRootCert.cer -keystore c:\jdk1.3.1_02\jre\lib\security\cacerts -storepass changeit To keep things simple, I tried to use the UsersRolesLoginModule. However, this module always refuses null passwords. Certificates don't have passwords - hence the problem. I created my own login module that extended UsersRolesLoginModule and overrode the function that checked the password so it always returned true. The second problem was the user name to use in the user.properties and roles.properties files. Certificate authentication in standalone tomact uses the DN of the cert as the user name. Tomcat embedded in JBoss uses the certificate serial number appended to the DN of the cert issuer. Further the whitespace and equal signs in the DN must be escaped. This leads to users.properties of the form: nnnnnnnnnnnnnnnnnnn\ CN\=certserver,\ OU\=unit,\ O\=org,\ L\=city,\ ST\=state,\ C\=UK=dummypassword If you are still having difficulties I can provide you with more detail. --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
