You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Alston, Brian (US SSA)" <br...@baesystems.com> on 2009/06/02 15:03:18 UTC
Which Do I SSL - httpd or Tomcat?
Hello All
I have a clustered/load-balanced Apache httpd and Tomcat setup. I have one httpd front end that load balances for two Tomcat back ends. I now want to add SSL to the mix but I am confused. Do I add the SSL to the httpd server, to the two Tomcat servers, or to all of them?
Thank you for reading.
Have a good day
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Which Do I SSL - httpd or Tomcat?
Posted by Peter Crowther <Pe...@melandra.com>.
> From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
> I have a clustered/load-balanced Apache httpd and Tomcat
> setup. I have one httpd front end that load balances for two
> Tomcat back ends. I now want to add SSL to the mix but I am
> confused. Do I add the SSL to the httpd server, to the two
> Tomcat servers, or to all of them?
Unless you need secure communication between httpd and Tomcat (rare), keep the Tomcat comms unsecured and add SSL only to httpd.
- Peter
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Which Do I SSL - httpd or Tomcat?
Posted by Peter Crowther <Pe...@melandra.com>.
> From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
> Thank you for reading and replying. Can I assume from
> your reply that if I am not on a secure LAN that I should SSL
> httpd and both Tomcat servers?
SSL between httpd and Tomcat will protect the channel between httpd and Tomcat from eavesdropping and some tampering. How likely is someone to be able to intercept and/or tamper with the communication between your httpd and your Tomcat servers? If it's unlikely (for example, because the httpd <=> Tomcat communication is via a LAN that you reckon is "secure enough"), you probably have better targets for your security effort.
- Peter
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Which Do I SSL - httpd or Tomcat?
Posted by Serge Fonville <se...@gmail.com>.
Hi,
> Thank you for reading and replying. Can I assume from your reply that if I am not on a secure LAN that I should SSL httpd and both Tomcat servers?
It depends, is your tomcat accessible directly instead of through httpd?
HTH
Regards,
Serge Fonville
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Which Do I SSL - httpd or Tomcat?
Posted by André Warnier <aw...@ice-sa.com>.
Alston, Brian (US SSA) wrote:
>
> What I have is 3 virtual servers (VMWare -> Windows Server 2003). One server has Apache httpd v2.2.11 and two other servers running Apache Tomcat v6.0.18. The Tomcat servers are independently accessible from outside of the httpd server; so, I assume that I will need to place SSL on all three servers.
>
I think the question to ask is : do your Tomcat servers /have to be/
accessible directly, without going through httpd ?
If not, then it is possible to configure Tomcat so that it will /only/
accept connections from the IP address of your httpd server, and from
nowhere else.
The point is : using HTTPS is "expensive" (all communications have to be
encrypted, which has a cost). So if you can make it so that the http
<-> Tomcat connection is "private", you don't heve to use HTTPS between
them.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Which Do I SSL - httpd or Tomcat?
Posted by "Alston, Brian (US SSA)" <br...@baesystems.com>.
What I have is 3 virtual servers (VMWare -> Windows Server 2003). One server has Apache httpd v2.2.11 and two other servers running Apache Tomcat v6.0.18. The Tomcat servers are independently accessible from outside of the httpd server; so, I assume that I will need to place SSL on all three servers.
________________________________________
From: Martin Gainty [mgainty@hotmail.com]
Sent: Tuesday, June 02, 2009 10:27 AM
To: Tomcat Users List
Subject: RE: Which Do I SSL - httpd or Tomcat?
Brian
if you're running TC standalone (without Apache or any other webserver FE)
an excellent tutorial on implementing SSL in TC available to read at
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
Q:does outside world assume outside the uk?
Martin Gainty
______________________________________________
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité
Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung. Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le destinataire prévu, nous te demandons avec bonté que pour satisfaire informez l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est interdite. Ce message sert à l'information seulement et n'aura pas n'importe quel effet légalement obligatoire. Étant donné que les email peuvent facilement être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité pour le contenu fourni.
> From: brian.alston@baesystems.com
> To: users@tomcat.apache.org
> Date: Tue, 2 Jun 2009 10:15:47 -0400
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> All
>
> Well ... I believe I have my answer. Thank you all very much for reading and replying.
>
> Have a good day
> ________________________________________
> From: Zeeshan Ahmad [zahmad@i2cinc.com]
> Sent: Tuesday, June 02, 2009 10:05 AM
> To: 'Tomcat Users List'
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> if your tomcats are accessible from out side world then, you have to add ssl
> on Tomcats as well otherwise its ok and there should be some security (e.g
> Firewall) on the network level, thanks.
>
> Best Regards,
> Zeeshan Ahmad.
> Associate Manager SCM.
>
> P Save a tree...pls don't print this e-mail unless necessary
>
> -----Original Message-----
> From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
> Sent: Tuesday, June 02, 2009 7:25 PM
> To: Tomcat Users List
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> Hi,
>
> Thank you for reading and replying. Can I assume from your reply that if
> I am not on a secure LAN that I should SSL httpd and both Tomcat servers?
>
> Thank You
>
> ________________________________________
> From: Zeeshan Ahmad [zahmad@i2cinc.com]
> Sent: Tuesday, June 02, 2009 9:15 AM
> To: 'Tomcat Users List'
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> Hello,
>
> If your web and application servers are on a secure LAN then this would be
> better technique if you will add SSL on httpd rather then on all of them,
> your communication will be over ssl from the client to web server and vice
> versa.
>
> Best Regards,
> Zeeshan Ahmad.
>
> P Save a tree...pls don't print this e-mail unless necessary
>
> -----Original Message-----
> From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
> Sent: Tuesday, June 02, 2009 7:03 PM
> To: users@tomcat.apache.org
> Subject: Which Do I SSL - httpd or Tomcat?
>
> Hello All
>
> I have a clustered/load-balanced Apache httpd and Tomcat setup. I have
> one httpd front end that load balances for two Tomcat back ends. I now want
> to add SSL to the mix but I am confused. Do I add the SSL to the httpd
> server, to the two Tomcat servers, or to all of them?
>
> Thank you for reading.
>
> Have a good day
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
_________________________________________________________________
Lauren found her dream laptop. Find the PC that’s right for you.
http://www.microsoft.com/windows/choosepc/?ocid=ftp_val_wl_290
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Which Do I SSL - httpd or Tomcat?
Posted by Martin Gainty <mg...@hotmail.com>.
Brian
if you're running TC standalone (without Apache or any other webserver FE)
an excellent tutorial on implementing SSL in TC available to read at
http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html
Q:does outside world assume outside the uk?
Martin Gainty
______________________________________________
Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité
Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene Empfaenger sein, so bitten wir hoeflich um eine Mitteilung. Jede unbefugte Weiterleitung oder Fertigung einer Kopie ist unzulaessig. Diese Nachricht dient lediglich dem Austausch von Informationen und entfaltet keine rechtliche Bindungswirkung. Aufgrund der leichten Manipulierbarkeit von E-Mails koennen wir keine Haftung fuer den Inhalt uebernehmen.
Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas le destinataire prévu, nous te demandons avec bonté que pour satisfaire informez l'expéditeur. N'importe quelle diffusion non autorisée ou la copie de ceci est interdite. Ce message sert à l'information seulement et n'aura pas n'importe quel effet légalement obligatoire. Étant donné que les email peuvent facilement être sujets à la manipulation, nous ne pouvons accepter aucune responsabilité pour le contenu fourni.
> From: brian.alston@baesystems.com
> To: users@tomcat.apache.org
> Date: Tue, 2 Jun 2009 10:15:47 -0400
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> All
>
> Well ... I believe I have my answer. Thank you all very much for reading and replying.
>
> Have a good day
> ________________________________________
> From: Zeeshan Ahmad [zahmad@i2cinc.com]
> Sent: Tuesday, June 02, 2009 10:05 AM
> To: 'Tomcat Users List'
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> if your tomcats are accessible from out side world then, you have to add ssl
> on Tomcats as well otherwise its ok and there should be some security (e.g
> Firewall) on the network level, thanks.
>
> Best Regards,
> Zeeshan Ahmad.
> Associate Manager SCM.
>
> P Save a tree...pls don't print this e-mail unless necessary
>
> -----Original Message-----
> From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
> Sent: Tuesday, June 02, 2009 7:25 PM
> To: Tomcat Users List
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> Hi,
>
> Thank you for reading and replying. Can I assume from your reply that if
> I am not on a secure LAN that I should SSL httpd and both Tomcat servers?
>
> Thank You
>
> ________________________________________
> From: Zeeshan Ahmad [zahmad@i2cinc.com]
> Sent: Tuesday, June 02, 2009 9:15 AM
> To: 'Tomcat Users List'
> Subject: RE: Which Do I SSL - httpd or Tomcat?
>
> Hello,
>
> If your web and application servers are on a secure LAN then this would be
> better technique if you will add SSL on httpd rather then on all of them,
> your communication will be over ssl from the client to web server and vice
> versa.
>
> Best Regards,
> Zeeshan Ahmad.
>
> P Save a tree...pls don't print this e-mail unless necessary
>
> -----Original Message-----
> From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
> Sent: Tuesday, June 02, 2009 7:03 PM
> To: users@tomcat.apache.org
> Subject: Which Do I SSL - httpd or Tomcat?
>
> Hello All
>
> I have a clustered/load-balanced Apache httpd and Tomcat setup. I have
> one httpd front end that load balances for two Tomcat back ends. I now want
> to add SSL to the mix but I am confused. Do I add the SSL to the httpd
> server, to the two Tomcat servers, or to all of them?
>
> Thank you for reading.
>
> Have a good day
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
_________________________________________________________________
Lauren found her dream laptop. Find the PC that’s right for you.
http://www.microsoft.com/windows/choosepc/?ocid=ftp_val_wl_290
RE: Which Do I SSL - httpd or Tomcat?
Posted by "Alston, Brian (US SSA)" <br...@baesystems.com>.
All
Well ... I believe I have my answer. Thank you all very much for reading and replying.
Have a good day
________________________________________
From: Zeeshan Ahmad [zahmad@i2cinc.com]
Sent: Tuesday, June 02, 2009 10:05 AM
To: 'Tomcat Users List'
Subject: RE: Which Do I SSL - httpd or Tomcat?
if your tomcats are accessible from out side world then, you have to add ssl
on Tomcats as well otherwise its ok and there should be some security (e.g
Firewall) on the network level, thanks.
Best Regards,
Zeeshan Ahmad.
Associate Manager SCM.
P Save a tree...pls don't print this e-mail unless necessary
-----Original Message-----
From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
Sent: Tuesday, June 02, 2009 7:25 PM
To: Tomcat Users List
Subject: RE: Which Do I SSL - httpd or Tomcat?
Hi,
Thank you for reading and replying. Can I assume from your reply that if
I am not on a secure LAN that I should SSL httpd and both Tomcat servers?
Thank You
________________________________________
From: Zeeshan Ahmad [zahmad@i2cinc.com]
Sent: Tuesday, June 02, 2009 9:15 AM
To: 'Tomcat Users List'
Subject: RE: Which Do I SSL - httpd or Tomcat?
Hello,
If your web and application servers are on a secure LAN then this would be
better technique if you will add SSL on httpd rather then on all of them,
your communication will be over ssl from the client to web server and vice
versa.
Best Regards,
Zeeshan Ahmad.
P Save a tree...pls don't print this e-mail unless necessary
-----Original Message-----
From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
Sent: Tuesday, June 02, 2009 7:03 PM
To: users@tomcat.apache.org
Subject: Which Do I SSL - httpd or Tomcat?
Hello All
I have a clustered/load-balanced Apache httpd and Tomcat setup. I have
one httpd front end that load balances for two Tomcat back ends. I now want
to add SSL to the mix but I am confused. Do I add the SSL to the httpd
server, to the two Tomcat servers, or to all of them?
Thank you for reading.
Have a good day
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Which Do I SSL - httpd or Tomcat?
Posted by Zeeshan Ahmad <za...@i2cinc.com>.
if your tomcats are accessible from out side world then, you have to add ssl
on Tomcats as well otherwise its ok and there should be some security (e.g
Firewall) on the network level, thanks.
Best Regards,
Zeeshan Ahmad.
Associate Manager SCM.
P Save a tree...pls don't print this e-mail unless necessary
-----Original Message-----
From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
Sent: Tuesday, June 02, 2009 7:25 PM
To: Tomcat Users List
Subject: RE: Which Do I SSL - httpd or Tomcat?
Hi,
Thank you for reading and replying. Can I assume from your reply that if
I am not on a secure LAN that I should SSL httpd and both Tomcat servers?
Thank You
________________________________________
From: Zeeshan Ahmad [zahmad@i2cinc.com]
Sent: Tuesday, June 02, 2009 9:15 AM
To: 'Tomcat Users List'
Subject: RE: Which Do I SSL - httpd or Tomcat?
Hello,
If your web and application servers are on a secure LAN then this would be
better technique if you will add SSL on httpd rather then on all of them,
your communication will be over ssl from the client to web server and vice
versa.
Best Regards,
Zeeshan Ahmad.
P Save a tree...pls don't print this e-mail unless necessary
-----Original Message-----
From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
Sent: Tuesday, June 02, 2009 7:03 PM
To: users@tomcat.apache.org
Subject: Which Do I SSL - httpd or Tomcat?
Hello All
I have a clustered/load-balanced Apache httpd and Tomcat setup. I have
one httpd front end that load balances for two Tomcat back ends. I now want
to add SSL to the mix but I am confused. Do I add the SSL to the httpd
server, to the two Tomcat servers, or to all of them?
Thank you for reading.
Have a good day
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Which Do I SSL - httpd or Tomcat?
Posted by "Alston, Brian (US SSA)" <br...@baesystems.com>.
Hi,
Thank you for reading and replying. Can I assume from your reply that if I am not on a secure LAN that I should SSL httpd and both Tomcat servers?
Thank You
________________________________________
From: Zeeshan Ahmad [zahmad@i2cinc.com]
Sent: Tuesday, June 02, 2009 9:15 AM
To: 'Tomcat Users List'
Subject: RE: Which Do I SSL - httpd or Tomcat?
Hello,
If your web and application servers are on a secure LAN then this would be
better technique if you will add SSL on httpd rather then on all of them,
your communication will be over ssl from the client to web server and vice
versa.
Best Regards,
Zeeshan Ahmad.
P Save a tree...pls don't print this e-mail unless necessary
-----Original Message-----
From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
Sent: Tuesday, June 02, 2009 7:03 PM
To: users@tomcat.apache.org
Subject: Which Do I SSL - httpd or Tomcat?
Hello All
I have a clustered/load-balanced Apache httpd and Tomcat setup. I have
one httpd front end that load balances for two Tomcat back ends. I now want
to add SSL to the mix but I am confused. Do I add the SSL to the httpd
server, to the two Tomcat servers, or to all of them?
Thank you for reading.
Have a good day
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Which Do I SSL - httpd or Tomcat?
Posted by Zeeshan Ahmad <za...@i2cinc.com>.
Hello,
If your web and application servers are on a secure LAN then this would be
better technique if you will add SSL on httpd rather then on all of them,
your communication will be over ssl from the client to web server and vice
versa.
Best Regards,
Zeeshan Ahmad.
P Save a tree...pls don't print this e-mail unless necessary
-----Original Message-----
From: Alston, Brian (US SSA) [mailto:brian.alston@baesystems.com]
Sent: Tuesday, June 02, 2009 7:03 PM
To: users@tomcat.apache.org
Subject: Which Do I SSL - httpd or Tomcat?
Hello All
I have a clustered/load-balanced Apache httpd and Tomcat setup. I have
one httpd front end that load balances for two Tomcat back ends. I now want
to add SSL to the mix but I am confused. Do I add the SSL to the httpd
server, to the two Tomcat servers, or to all of them?
Thank you for reading.
Have a good day
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org