Hi,
I'm having some fun and games getting Tomcat 5.0.19 to use a non-self signed
certificate. I've done the following:
1) Using Keytool, generated a new key pair using the genkey switch, into a new
keystore
2) Generated a CSR using the new keystore created above
3) Using OpenSSL, where I've created a certificate authority to sign my CSRs,
I've then generated a signed certificate valid for 365 days, signed by my root
authority
4) I've then imported the Root CA into the keystore created in 1
5) Then I've imported the new, signed certificate into the keystore from 1
6) I've then enabled by HTTPS connector in server.xml, with the keystore entry
pointing to the keystore from 1. I bounced Tomcat afterwards
I can then connect to Tomcat on port 8443 but when I examine the certificate it
is a self signed certificate that expired after 3 months. There is no evidence
of the signed certificate.
So far I have:
1) Removed the keystore file to check that Tomcat is picking up the correct
file. It is as I get loads of errors in the std.out file
2) Listed the contents of the keystore. I can see in the following order, the
root CA certificate, the generated keypair and then the signed certificate.
3) I made a copy of the keystore, changed the configuration to use the copy and
then fired Tomcat up again. I finally managed to shut Tomcat down again after a
large number of errors flooded the log file.
4) I've used the Keytool export and printcert switches to check that the signed
certificate in the keystore is the right one, and it is.
So, my question is, how is tomcat using a self signed SSL certificate, and
where could it be getting it from? Is there a way to force Tomcat to use a
certain certificate from a keystore?
I'm now very, very stuck and would appreciate some help. Are there any switches
I can use to get more information from Tomcat on what it is using, certificate
wise?
For reference, the connector config looks like this:
<Connector port="8443"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" debug="0" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="D:\db\certificates\keystore"
keystorePass="" />
My keystore:
D:\db\certificates>keytool -keystore keystore -list
Enter keystore password:
Keystore type: jks
Keystore provider: SUN
Your keystore contains 3 entries
rootca, Nov 9, 2004, trustedCertEntry,
Certificate fingerprint (MD5): 7B:CD:2C:5D:AE:79:8A:86:D5:70:25:56:3D:0D:D1:AC
mis1_key, Nov 9, 2004, keyEntry,
Certificate fingerprint (MD5): BB:6A:10:C7:1C:DC:A2:AE:BD:77:C3:6F:50:B6:50:C1
mis1_cert, Nov 9, 2004, trustedCertEntry,
Certificate fingerprint (MD5): 63:A4:57:A1:3E:B9:72:67:14:21:88:F3:3A:90:C5:5A
The certificate that should be used is the mis1_cert certificate. From the
printcert:
D:\db\certificates>keytool -keystore keystore -printcert -file test.crt -v
Owner: CN=mis1, OU=gmPrice, O=Deutsche Bank, L=London, ST=England, C=UK
Issuer: [EMAIL PROTECTED], CN=gmPrice, OU=Shared Technology, O=Deutsche Bank,
L=London, ST=England, C=UK
Serial number: 8
Valid from: Tue Nov 09 09:26:01 GMT 2004 until: Wed Nov 09 09:26:01 GMT 2005
Certificate fingerprints:
MD5: 63:A4:57:A1:3E:B9:72:67:14:21:88:F3:3A:90:C5:5A
SHA1: C7:AA:85:F7:7E:92:AC:E6:77:8B:44:F4:B2:7F:33:11:A7:DC:57:A3
Rob Cole
--
This e-mail may contain confidential and/or privileged information. If you are
not the intended recipient (or have received this e-mail in error) please
notify the sender immediately and destroy this e-mail. Any unauthorized
copying, disclosure or distribution of the material in this e-mail is strictly
forbidden.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
