You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2011/06/08 19:33:00 UTC
DO NOT REPLY [Bug 51342] New: Inconsistency in ssl-howto apr example
configuration
https://issues.apache.org/bugzilla/show_bug.cgi?id=51342
Bug #: 51342
Summary: Inconsistency in ssl-howto apr example configuration
Product: Tomcat 6
Version: 6.0.29
Platform: All
OS/Version: All
Status: NEW
Severity: minor
Priority: P2
Component: Documentation
AssignedTo: dev@tomcat.apache.org
ReportedBy: ivolation@gmail.com
Classification: Unclassified
When going through the SSL docs to use APR for native OpenSSL I found an
inconsistency in the docs.
in
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html#Edit_the_Tomcat_Configuration_File
it suggests that a correct connector in the server.xml should look like:
<-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->
<!--
<Connector
port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true"
SSLCertificateFile="/usr/local/ssl/server.crt"
SSLCertificateKeyFile="/usr/local/ssl/server.pem"
clientAuth="optional" SSLProtocol="TLSv1"/>
-->
this however didn't work and resulted in:
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property
'clientAuth' to 'true' did not find a matching property.
An actual working config can be found in
http://tomcat.apache.org/tomcat-6.0-doc/apr.html#HTTPS . I propose copying the
example section:
<Connector port="443" maxHttpHeaderSize="8192"
maxThreads="150"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
SSLEnabled="true"
SSLCertificateFile="${catalina.base}/conf/localhost.crt"
SSLCertificateKeyFile="${catalina.base}/conf/localhost.key" />
To replace the, what I believe to be false, example in the ssl-howto.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51342] Inconsistency in ssl-howto apr example
configuration
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51342
--- Comment #2 from Mark Thomas <ma...@apache.org> 2011-06-08 18:40:56 UTC ---
*** Bug 51343 has been marked as a duplicate of this bug. ***
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51342] Inconsistency in ssl-howto apr example
configuration
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51342
ivolation@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P2 |P4
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51342] Inconsistency in ssl-howto apr example
configuration
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51342
ivolation@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|INVALID |
--- Comment #4 from ivolation@gmail.com 2011-06-09 00:32:50 UTC ---
>> That example works for me once the file paths are fixed.
I have tested this on 6.0.29 and it definitely doesn't. Are you sure you are
using this with libnative APR? I know the property works with a JSSE connector,
but the patch is not changing the JSSE example but only the APR and that
certainly didn't work with 6.0.29.
>>Further, the configuration reported as erroneous and the error message are not consistent.
I am sorry seems I accidentally pasted the wrong log line. I have tested a hand
full of cases to make sure it is definitely the issue. The error code provided
still shows the existence of the issue, simply not with the correct matching
case.
I am fairly certain clientAuth is not a valid property when an SSL connector
via libnative with APR.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51342] Inconsistency in ssl-howto apr example
configuration
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51342
--- Comment #1 from ivolation@gmail.com 2011-06-08 17:38:14 UTC ---
Created attachment 27133
--> https://issues.apache.org/bugzilla/attachment.cgi?id=27133
patching docs/ssl-howto.xml to use same example as apr.xml tc6.0.x
I copied the example from the apr.xml and added SSLVerifyClient="optional" as
that seems a regularly used property.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51342] Inconsistency in ssl-howto apr example
configuration
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51342
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution| |INVALID
--- Comment #3 from Mark Thomas <ma...@apache.org> 2011-06-08 19:19:52 UTC ---
That example works for me once the file paths are fixed.
Further, the configuration reported as erroneous and the error message are not
consistent.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 51342] Inconsistency in ssl-howto apr example
configuration
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51342
ivolation@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |WORKSFORME
--- Comment #5 from ivolation@gmail.com 2011-06-09 00:42:51 UTC ---
as you say it works for you, I'd rather have it closed as WORKS FOR ME than
INVALID.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org