You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by matt617 <ma...@jackbe.com> on 2009/05/04 03:27:22 UTC
Tomcat over AJP with Apache in front SSL Issues
when using apache 2.2, tomcat 5.5.20 on top of java 1.5.10+ using Apache with
Mod_SSL and Mod_Proxy to connect the Incoming http session through AJP to
Tomcat my browser repeatidly prompts me for a ceritficate. 3 times at the
beginning, then about 3 times every 10 minutes. does anyone know why? should
i be posting this in the apache user group? is it an apache issues or tomcat
issue?
--
View this message in context: http://www.nabble.com/Tomcat-over-AJP-with-Apache-in-front-SSL-Issues-tp23361836p23361836.html
Sent from the Tomcat - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat over AJP with Apache in front SSL Issues
Posted by Rainer Jung <ra...@kippdata.de>.
On 14.08.2009 06:53, matt617 wrote:
>
> I am using Apaches MOD SSL to do the certificate enforcement. It then uses
> the mod proxy to push the certificate info over AJP to my tomcat instance.
> tomcat does not have SSL enables at the container level but my application
> seems to pick up the certificate info jsut fine this way...
>
> yes i mean that the browser is prompting the user for their client
> certificate repeatedly, roughly once every 10 minutes, this is the problem i
> have been struggling with.
Hmmm, do your have the SSL session timeout in Apache set to 600 seconds?
It would indicate, that there's a problem with session renegotiation and
client certificates. Usually this should work.
Check the SSL session timeout to see, whether your 10 minutes could come
from the (and choose another value to verify, that the 10 minutes change
accordingly).
If this is true, I would first update to a recent version of Apache and
OpenSSL in order to rule out bugs there.
Another possibility could be a browser bug. Does it happen for varous
browsers, like MSIE and Firefox?
Regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat over AJP with Apache in front SSL Issues
Posted by matt617 <ma...@jackbe.com>.
I am using Apaches MOD SSL to do the certificate enforcement. It then uses
the mod proxy to push the certificate info over AJP to my tomcat instance.
tomcat does not have SSL enables at the container level but my application
seems to pick up the certificate info jsut fine this way...
yes i mean that the browser is prompting the user for their client
certificate repeatedly, roughly once every 10 minutes, this is the problem i
have been struggling with.
thanks!
matt
Rainer Jung-3 wrote:
>
> On 04.05.2009 03:27, matt617 wrote:
>> when using apache 2.2, tomcat 5.5.20 on top of java 1.5.10+ using Apache
>> with
>> Mod_SSL and Mod_Proxy to connect the Incoming http session through AJP to
>> Tomcat my browser repeatidly prompts me for a ceritficate. 3 times at the
>> beginning, then about 3 times every 10 minutes. does anyone know why?
>> should
>> i be posting this in the apache user group? is it an apache issues or
>> tomcat
>> issue?
>
> It depends on what component is doing the certificate check, the Apache
> web server or Tomcat? I assume by "prompts me for a certificate" you
> mean you are using client certificates and not simply some confirmation
> that the communication should proceed although the server certificate is
> insecure etc.
>
> Are you forcing client certificates by some mod_ssl configuration (then
> it's an Apache web server topic) or by some security constraint or
> similar in your web app or Tomcat?
>
> Regards,
>
> Rainer
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
>
--
View this message in context: http://www.nabble.com/Tomcat-over-AJP-with-Apache-in-front-SSL-Issues-tp23361836p24965802.html
Sent from the Tomcat - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Tomcat over AJP with Apache in front SSL Issues
Posted by Robin Wilson <rw...@kingsisle.com>.
We had a similar problem when our certificate was invalid. We updated our certificate and the problem went away. I suspect, if you are not using a valid certificate (from a real Certificate Authority - like VeriSign, or Thawte, etc.), you would need to install the certificate you used on the apache to make this go away (we do this in our test environment - using self-signed certificates). To install the certificate, you have to go through the browser's tools.
--
Robin D. Wilson
Director of Web Development
KingsIsle Entertainment, Inc.
WORK: 512-623-5913
CELL: 512-426-3929
www.KingsIsle.com
-----Original Message-----
From: Rainer Jung [mailto:rainer.jung@kippdata.de]
Sent: Monday, May 04, 2009 3:32 AM
To: Tomcat Users List
Subject: Re: Tomcat over AJP with Apache in front SSL Issues
On 04.05.2009 03:27, matt617 wrote:
> when using apache 2.2, tomcat 5.5.20 on top of java 1.5.10+ using Apache with
> Mod_SSL and Mod_Proxy to connect the Incoming http session through AJP to
> Tomcat my browser repeatidly prompts me for a ceritficate. 3 times at the
> beginning, then about 3 times every 10 minutes. does anyone know why? should
> i be posting this in the apache user group? is it an apache issues or tomcat
> issue?
It depends on what component is doing the certificate check, the Apache
web server or Tomcat? I assume by "prompts me for a certificate" you
mean you are using client certificates and not simply some confirmation
that the communication should proceed although the server certificate is
insecure etc.
Are you forcing client certificates by some mod_ssl configuration (then
it's an Apache web server topic) or by some security constraint or
similar in your web app or Tomcat?
Regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat over AJP with Apache in front SSL Issues
Posted by Rainer Jung <ra...@kippdata.de>.
On 04.05.2009 03:27, matt617 wrote:
> when using apache 2.2, tomcat 5.5.20 on top of java 1.5.10+ using Apache with
> Mod_SSL and Mod_Proxy to connect the Incoming http session through AJP to
> Tomcat my browser repeatidly prompts me for a ceritficate. 3 times at the
> beginning, then about 3 times every 10 minutes. does anyone know why? should
> i be posting this in the apache user group? is it an apache issues or tomcat
> issue?
It depends on what component is doing the certificate check, the Apache
web server or Tomcat? I assume by "prompts me for a certificate" you
mean you are using client certificates and not simply some confirmation
that the communication should proceed although the server certificate is
insecure etc.
Are you forcing client certificates by some mod_ssl configuration (then
it's an Apache web server topic) or by some security constraint or
similar in your web app or Tomcat?
Regards,
Rainer
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org