You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2018/11/15 08:56:51 UTC
[Bug 62911] New: Add support for proxying ocsp requests via
ProxyHost and ProxyPort in TomcAt
https://bz.apache.org/bugzilla/show_bug.cgi?id=62911
Bug ID: 62911
Summary: Add support for proxying ocsp requests via ProxyHost
and ProxyPort in TomcAt
Product: Tomcat 7
Version: 7.0.70
Hardware: PC
OS: Linux
Status: NEW
Severity: enhancement
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: usmanov@ieml.ru
Target Milestone: ---
Please add support for specifying proxyHost and ProxyPort for ocsp requests in
Tomcat.
I have a webapp which runs on Tomcat 7.0.70 on RHEL 6.9 and Java 7 and using
APR/Tomcat native for SSL TLS.Tomcat sits behind proxy.
I can't get ocsp stapling working
I tried using proxyName and proxyPort in Connector in server xml hoping that
this will also proxify ocsp requests, in Tomcat but ssllabs test still shows
ocsp Stapling no for my server
Given the fact that most of the ocsp responders specified in SSL certificates
such as Comodo actually resolve to many changing IP addresses it becomes really
hard /impossible to specify any firewall rule to manually proxy ocsp requests
since these firewalls typically operate with IP addresses not hostnames.
Inability to specify proxy host/port nor specify a file from which the stapled
OCSP response could be taken makes OCSP unavailable in many corporate
environments where typically internet access is granted via proxy
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 62911] Add support for proxying ocsp requests via ProxyHost
and ProxyPort in TomcAt
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62911
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
The APR/native connector does not support OCSP stapling. This is being tracked
as under bug 56148
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 62911] Add support for proxying ocsp requests via ProxyHost
and ProxyPort in TomcAt
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62911
--- Comment #5 from Azat <us...@ieml.ru> ---
When I originally filed this enhancement request I thought that this was the
reason for ocsp not working with the tomcat and OpenSSL.But it turned out to be
an issue with tomcat native code needing changes as Mark pointed out in his
comment #7 on bug 56148. So I guess I just have to wait for it to be fixed.
Which actually brings another small question. If 56148 does NOT get fixed
before Tomcat 7 EOL date, do I have to file another bug against 8.5 branch or
tomcat native for the best chance of ocsp being available on Tomcat with
openssl ? I'm not rushing you guys just don't want 56148 being forgotten after
tomcat 7 EOL date in case it doesn't get fixed before that. Maybe Mark or
someone else can clarify me on that?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 62911] Add support for proxying ocsp requests via ProxyHost
and ProxyPort in TomcAt
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62911
--- Comment #2 from Azat <us...@ieml.ru> ---
Mark,any chance you can do this for upcoming 1.2.20 release?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 62911] Add support for proxying ocsp requests via ProxyHost
and ProxyPort in TomcAt
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62911
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Component|Connectors |Library
Version|7.0.70 |1.2.18
Product|Tomcat 7 |Tomcat Native
--- Comment #1 from Mark Thomas <ma...@apache.org> ---
Moving to correct project
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 62911] Add support for proxying ocsp requests via ProxyHost
and ProxyPort in TomcAt
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=62911
--- Comment #4 from Mark Thomas <ma...@apache.org> ---
I'll note at this point that the Connector attributes proxyHost and proxyPort
are NOT intended to provide proxy info for outgoing connections.
Those using a Java connector and a JRE that supports OCSP can configure the
OCSP requests to go via a proxy by using the standard Java system properties:
https://docs.oracle.com/javase/8/docs/api/java/net/doc-files/net-properties.html#Proxies
Those using APR/native will need to wait for this enhancement (and bug 56148)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org