Adding CRL support to the Coyote Connector

[Bruce Keats <br...@gmail.com>]

After looking around and asking various people for help, it looks like
CRLs are not supported in tomcat 5.0.x.  There are some work arounds
but none are very appealing.  So rather than devote effort into the
work around, I would rather devote the effort in solving the problem
by adding CRL support into the Coyote Connector.

Are there any plans on adding CRL support in tomcat in the near
future?  Is anyone else looking into adding CRL support tomcat?

If not then I will probably take a stab at trying to implement CRL
support in the code.  Does anyone know why CRLs were not implemented
in the past?  Is there some fundamental issue that I am not aware of? 
It looks like Java supports CRLs in JRE 1.4.2 (don't know about
previous versions of java).

Any pointers to where to add CRL support in the code would be greatly
appreciated.  I am still trying to locate a good place in the code to
extract the certificates from the TLS connection them run them through
java.security.cert.X509CRL.  If the certificate presented is not valid
then the connection should be terminated.  I am also trying to find
the best place in the code to load the CRL.

Any help would be greatly appreciated.

Bruce

---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org

Re: Adding CRL support to the Coyote Connector

[Yoav Shapira <yo...@MIT.EDU>]

Howdy,

> Are there any plans on adding CRL support in tomcat in the near
> future?  Is anyone else looking into adding CRL support tomcat?

No to both.

> If not then I will probably take a stab at trying to implement CRL
> support in the code.  Does anyone know why CRLs were not implemented
> in the past?  Is there some fundamental issue that I am not aware of? 

Probably no fundamental technical issue, just the usual combination: lack of
demand from users and lack of interest on behalf of developers.

> Any help would be greatly appreciated.

I'm not an expert on CRLs, but whatever you can do in a Filter (as in
javax.servlet.Filter) as opposed to in the connector itself is good, because it
means you don't have to hack Tomcat and your solution is container-portable.

Yoav



---------------------------------------------------------------------
To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org

Re: Adding CRL support to the Coyote Connector

[Bill Barker <wb...@wilshire.com>]

----- Original Message ----- 
From: "Bruce Keats" <br...@gmail.com>
To: <to...@jakarta.apache.org>
Sent: Saturday, February 12, 2005 1:49 PM
Subject: Adding CRL support to the Coyote Connector


> After looking around and asking various people for help, it looks like
> CRLs are not supported in tomcat 5.0.x.  There are some work arounds
> but none are very appealing.  So rather than devote effort into the
> work around, I would rather devote the effort in solving the problem
> by adding CRL support into the Coyote Connector.
>
> Are there any plans on adding CRL support in tomcat in the near
> future?  Is anyone else looking into adding CRL support tomcat?
>

I've looked at it for TC 5.5 + JRE 1.5, but it hasn't itched enough to 
actually get around to implementing it ;-).  I'd be happy to review any 
patch you come up with however.

> If not then I will probably take a stab at trying to implement CRL
> support in the code.  Does anyone know why CRLs were not implemented
> in the past?  Is there some fundamental issue that I am not aware of?
> It looks like Java supports CRLs in JRE 1.4.2 (don't know about
> previous versions of java).
>

Prior to CertPathTrustManagerParameters in JRE 1.5, it's more work to pass 
the information to the TrustManager.

> Any pointers to where to add CRL support in the code would be greatly
> appreciated.  I am still trying to locate a good place in the code to
> extract the certificates from the TLS connection them run them through
> java.security.cert.X509CRL.  If the certificate presented is not valid
> then the connection should be terminated.  I am also trying to find
> the best place in the code to load the CRL.
>
Well, o.a.t.u.net.jsse.JSSE14SocketFactory would be the place to start, as 
the TrustManager is setup there.  I suppose that for JRE 1.4 Tomcat could 
also wrap the TrustManager like it does the KeyManager.

> Any help would be greatly appreciated.
>
> Bruce
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: tomcat-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: tomcat-dev-help@jakarta.apache.org
>
>
> 



This message is intended only for the use of the person(s) listed above as the intended recipient(s), and may contain information that is PRIVILEGED and CONFIDENTIAL.  If you are not an intended recipient, you may not read, copy, or distribute this message or any attachment. If you received this communication in error, please notify us immediately by e-mail and then delete all copies of this message and any attachments.

In addition you should be aware that ordinary (unencrypted) e-mail sent through the Internet is not secure. Do not send confidential or sensitive information, such as social security numbers, account numbers, personal identification numbers and passwords, to us via ordinary (unencrypted) e-mail.