You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "O'Hagan, Shaun" <so...@tanning.com> on 2000/09/29 11:48:33 UTC
IE4 SSL -> Tomcat 4 (clientAuth=true)
Hi,
I'm new to the world of security and am having problems configuring IE4 to
talk to Tomcat 4 in the way I think it should.
I've created an entry in the keystore as per the instructions in server.xml
$ keytool -genkey -alias tomcat -keyalg RSA
I verified it was in the keystore via
$ keytool -list
I stopped and started tomcat and used IE5.5 to talk to
https://localhost:8443. I received a warning dialog that warned me about
this site so I accepted the offer to save the certificate sent to me. This
certificate now lives in the trusted root certificate section when viewing
tools->internet->content->certificates. I can now connect to tomcat using
SSL and display the index page.
However (again forgive my lack of in depth understanding) I want to
configure my security so that tomcat validates the client rather than the
client validating the server. I therefore changed the server.xml option for
clientAuth to be true and reattempted my connection. It now fails with a
page cannot be displayed error. In the catalina log file I get the
following exception :
2000-09-29 10:05:33 HttpProcessor[8443][3] process.parse
javax.net.ssl.SSLException: null cert chain
at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
at
com.sun.net.ssl.internal.ssl.ServerHandshaker.a([DashoPro-V1.2-120198])
at
com.sun.net.ssl.internal.ssl.ServerHandshaker.processMessage([DashoPro-V1.2-
120198])
at
com.sun.net.ssl.internal.ssl.Handshaker.process_record([DashoPro-V1.2-120198
])
at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
at
com.sun.net.ssl.internal.ssl.AppInputStream.read([DashoPro-V1.2-120198])
at java.io.BufferedInputStream.fill(BufferedInputStream.java:186)
at java.io.BufferedInputStream.read(BufferedInputStream.java:204)
at
org.apache.catalina.connector.http.HttpProcessor.read(HttpProcessor.java:865
)
at
org.apache.catalina.connector.http.HttpProcessor.parseRequest(HttpProcessor.
java:608)
at
org.apache.catalina.connector.http.HttpProcessor.process(HttpProcessor.java:
756)
at
org.apache.catalina.connector.http.HttpProcessor.run(HttpProcessor.java:904)
at java.lang.Thread.run(Thread.java:484)
This I assume is because IE5.5 is not correctly sending the certificate.
What am I doing wrong ???
Any help accepted.
Regards,
Shaun O'Hagan
Tanning Technology Europe.
Re: IE4 SSL -> Tomcat 4 (clientAuth=true)
Posted by "Craig R. McClanahan" <Cr...@eng.sun.com>.
See below.
"O'Hagan, Shaun" wrote:
> Hi,
> I'm new to the world of security and am having problems configuring IE4 to
> talk to Tomcat 4 in the way I think it should.
>
> I've created an entry in the keystore as per the instructions in server.xml
> $ keytool -genkey -alias tomcat -keyalg RSA
>
> I verified it was in the keystore via
> $ keytool -list
>
> I stopped and started tomcat and used IE5.5 to talk to
> https://localhost:8443. I received a warning dialog that warned me about
> this site so I accepted the offer to save the certificate sent to me. This
> certificate now lives in the trusted root certificate section when viewing
> tools->internet->content->certificates. I can now connect to tomcat using
> SSL and display the index page.
>
> However (again forgive my lack of in depth understanding) I want to
> configure my security so that tomcat validates the client rather than the
> client validating the server. I therefore changed the server.xml option for
> clientAuth to be true and reattempted my connection. It now fails with a
> page cannot be displayed error. In the catalina log file I get the
> following exception :
>
> 2000-09-29 10:05:33 HttpProcessor[8443][3] process.parse
> javax.net.ssl.SSLException: null cert chain
> at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
> at
> com.sun.net.ssl.internal.ssl.ServerHandshaker.a([DashoPro-V1.2-120198])
> at
> com.sun.net.ssl.internal.ssl.ServerHandshaker.processMessage([DashoPro-V1.2-
> 120198])
> at
> com.sun.net.ssl.internal.ssl.Handshaker.process_record([DashoPro-V1.2-120198
> ])
> at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
> at
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])
> at
> com.sun.net.ssl.internal.ssl.AppInputStream.read([DashoPro-V1.2-120198])
> at java.io.BufferedInputStream.fill(BufferedInputStream.java:186)
> at java.io.BufferedInputStream.read(BufferedInputStream.java:204)
> at
> org.apache.catalina.connector.http.HttpProcessor.read(HttpProcessor.java:865
> )
> at
> org.apache.catalina.connector.http.HttpProcessor.parseRequest(HttpProcessor.
> java:608)
> at
> org.apache.catalina.connector.http.HttpProcessor.process(HttpProcessor.java:
> 756)
> at
> org.apache.catalina.connector.http.HttpProcessor.run(HttpProcessor.java:904)
> at java.lang.Thread.run(Thread.java:484)
>
> This I assume is because IE5.5 is not correctly sending the certificate.
>
> What am I doing wrong ???
>
> Any help accepted.
>
The stack trace is an ugly way for Tomcat 4.0 to respond (which will be fixed),
but the key issue is that you need to go acquire a *client* certificate from
some certificate authority (Verisign has free 30-day trial certificates in the
US, not sure about Europe), and install it in your browser. What's happening is
that Tomcat is asking your browser to upload it's certificates, but you don't
have installed so it is not able to validate you.
>
> Regards,
>
> Shaun O'Hagan
>
> Tanning Technology Europe.
Craig McClanahan
--
====================
See you at ApacheCon Europe <http://www.apachecon.com>!
Session VS01 (23-Oct 13h00-17h00): Sun Technical Briefing
Session T06 (24-Oct 14h00-15h00): Migrating Apache JServ
Applications to Tomcat