You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2007/08/11 23:50:54 UTC
DO NOT REPLY [Bug 43094] New: - Allowing non-file based keystore and other providers
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43094>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43094
Summary: Allowing non-file based keystore and other providers
Product: Tomcat 6
Version: 6.0.13
Platform: Other
OS/Version: other
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
AssignedTo: tomcat-dev@jakarta.apache.org
ReportedBy: Bruno.Harbulot@manchester.ac.uk
Hello,
I would like to use the MacOSX Keychain store for providing my
certificates to Tomcat. Generally speaking, this can be done by loading the
KeyStore like this:
KeyStore keyStore = KeyStore.getInstance("KeychainStore","Apple");
keyStore.load(null, null);
In fact, it seems to work without specifying the "Apple" provider too.
However, similarly to PKCS11, this type does not require an input file.
The problem is that org.apache.tomcat.util.net.jsse.JSSESocketFactory
always tries to load a file, except when the type is PKCS11.
Not specifying a keystoreFile or truststoreFile parameter defaults to
trying to load ~/.keystore. I would like to suggest the following patch
which allows to specify an empty value, indicating the no file needs to
be loaded:
--- JSSESocketFactory.java.old 2007-08-11 22:58:24.000000000 +0200
+++ JSSESocketFactory.java 2007-08-11 23:24:53.000000000 +0200
@@ -307,7 +307,7 @@
InputStream istream = null;
try {
ks = KeyStore.getInstance(type);
- if(! "PKCS11".equalsIgnoreCase(type) ) {
+ if(! "".equalsIgnoreCase(path) ) {
File keyStoreFile = new File(path);
if (!keyStoreFile.isAbsolute()) {
keyStoreFile = new File(System.getProperty("catalina.base"),
This way, not having to load a file is not limited to PKCS11, but could be
used by other keystore types.
Using this patch, the following configuration works fine with keys and
certificates stored in the Apple Keychain (for some reason, the KeychainStore
requires a non-empty password; it seems to work whatever the password is,
since it may be asked interactively by the Keychain utility, depending on
how it is set up)
<Connector SSLEnabled="true" clientAuth="want"
keystoreFile="" keystorePass="-"
keystoreType="KeychainStore" maxThreads="150" port="8443"
keyAlias="myhost.mydomain.tld"
protocol="HTTP/1.1" scheme="https" secure="true" sslProtocol="TLS"
truststoreFile=""
truststorePass="-" truststoreType="KeychainStore" />
Regards,
Bruno.
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 43094] - Allowing non-file based keystore and other providers
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43094>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43094
fhanik@apache.org changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |ASSIGNED
------- Additional Comments From fhanik@apache.org 2007-08-13 10:26 -------
Thanks for the patch, I will review it and possible extend it to the NIO
connector as well
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
DO NOT REPLY [Bug 43094] - Allowing non-file based keystore and other providers
Posted by bu...@apache.org.
DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG�
RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT
<http://issues.apache.org/bugzilla/show_bug.cgi?id=43094>.
ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND�
INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43094
------- Additional Comments From Bruno.Harbulot@manchester.ac.uk 2007-08-11 15:01 -------
Created an attachment (id=20649)
--> (http://issues.apache.org/bugzilla/attachment.cgi?id=20649&action=view)
Patch for allowing to specify keystores providers and not to need a keystore
file
Another improvement to this might be to add a parameter for the provider to the
'getStore' method and pass it through 'keystoreProvider' and
truststoreProvider' attributes.
In my use case, it seems to work without specifying the provider, "Apple", but
I guess there might be cases where it could be useful, for other providers.
The configuration would look like this (I've tried it and it works -- it also
fails if I provide the wrong provider, quite logically):
<Connector SSLEnabled="true" clientAuth="want"
keystoreFile="" keystorePass="-" keystoreProvider="Apple"
keystoreType="KeychainStore" maxThreads="150" port="8443"
keyAlias="host.domain"
protocol="HTTP/1.1" scheme="https" secure="true" sslProtocol="TLS"
truststoreFile="" truststoreProvider="Apple"
truststorePass="-" truststoreType="KeychainStore" />
--
Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug, or are watching the assignee.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org