You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by vivek aggarwal <vi...@yahoo.co.in> on 2012/10/20 08:22:56 UTC
SSl Query-- please help
Hello All,
I need to setup the SSL over my tomcat ,which i am able to do it by generating Self signed certificate using Keytool
But when i am redirecting the request form apache using "mod_jk "module its not working.
I am not sure how to make Apache & Tomcat work in SSL when using Mod_jk module as i need load balancing
Can someone please share the steps for doing ssl setup when apache is used along with Tomcat
Thanks
Vicky
Re: SSl Query-- please help
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Vicky,
On 10/24/12 11:37 AM, vicky007aggarwal@yahoo.co.in wrote:
> Thats really an extensive explanation Thanks for writing this
> christopher
I've updated the Wiki as well:
http://wiki.apache.org/tomcat/FAQ/Connectors#Q2
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlCINwQACgkQ9CaO5/Lv0PAebgCgpV7YLiEHIs0mywhX8Y9Ppy61
nVsAn2z2/Jt+idl5+TbWoJ5dYq3mr7pF
=MQ3M
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by vi...@yahoo.co.in.
Thats really an extensive explanation
Thanks for writing this christopher
Thanks,
Vicky
On Oct 24, 2012, at 7:04 PM, Christopher Schultz <ch...@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Vicky,
>
> On 10/23/12 11:43 PM, vicky007aggarwal@yahoo.co.in wrote:
>> Andre & Christopher thanks a lot for your time & help.
>>
>> One last query related to mod _jk & mod_proxy_balancer modules:-
>> among these two which one is preferred i mean which is more stable
>> & has good performance.? Any idea
>>
>> It will be great if you can share document link which talks about
>> there pros & cons
>
> I have been using mod_jk for a very long time and I saw (at the time)
> only one reason to make the switch to mod_proxy_ajp: it is bundled
> with Apache and so you (likely) don't have to build the module yourself.
>
> That said, simple configurations are *way* more simple in
> mod_proxy_ajp than with mod_jk, although the (somewhat) recent
> addition of JkWorkerProperty and JkMount "extensions" do help quite a bit.
>
> mod_proxy_ajp can also be trivially swapped-out with mod_proxy_http
> just by changing the URLs in your ProxyPass and ProxyPassReverse
> directives to say http:// (or https://) instead of ajp://. This might
> help you if you need to switch protocols for debugging purposes or if
> you suddenly need switch to HTTPS to secure the traffic without any
> external configuration (e.g. stunnel or VPN).
>
> mod_proxy also supports ProxyPassMatch which lets you use regular
> expressions in your URL mappings, which mod_jk's JkMount does not
> (though you *can* use <LocationMatch> along with SetHandler in order
> to achieve the same result, it's a cleaner configuration with mod_proxy).
>
> That said, I have found that mod_jk supports more complicated
> configurations where I have struggled to get mod_proxy_ajp to do the
> same. Specifically, overlapping URL spaces that must be mapped to
> separate workers. Technically speaking, I suppose you could use lots
> of ProxyPassMatch directives and/or have a complex regular expression
> to direct the various URLs, but again you end up with a rather messy
> configuration that way. Messy configurations are a maintenance risk as
> well as at risk of becoming "arcane knowledge" that nobody actually
> understands and so they are afraid to modify it for any reason.
>
> Generally, mod_jk will get fixed faster than mod_proxy_ajp due to its
> independent release cycle: the httpd folks might have a fix for a
> problem but it doesn't get released for a while due to testing of
> other components, etc. At this point, mod_proxy_ajp has (IMHO) reached
> a point of stability that this is less of an issue than it used to be.
>
> At this stage, there is no reason for me to move any of my projects
> from mod_jk to mod_proxy_ajp but if I were starting from scratch, I
> might choose mod_proxy_ajp solely due to its binary availability and
> simple configuration. If the configuration became complicated to the
> extent that switching to mod_jk were a good option, then I'd move.
>
> As for performance, I have no data on that one way or another. I would
> suspect that mod_jk has a slight performance advantage because it has
> been especially designed for the purpose rather than mod_proxy_ajp
> which must support the mod_proxy API and might have a bit more
> plumbing code to accomplish that. I would be surprised if you could
> detect any performance difference between the two if you were to test
> them both faithfully and with compatible configurations. If anyone has
> relative performance data between mod_jk and mod_proxy_ajp, I'd be
> happy to read it.
>
> Hope that helps,
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iEYEARECAAYFAlCH7nUACgkQ9CaO5/Lv0PA4tQCfRMxpTCX2Q1QVeKC0DhU0QaWQ
> unIAoINjyEaPMlFEVsXOFIOtXHIX+oZD
> =DXAt
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Vicky,
On 10/23/12 11:43 PM, vicky007aggarwal@yahoo.co.in wrote:
> Andre & Christopher thanks a lot for your time & help.
>
> One last query related to mod _jk & mod_proxy_balancer modules:-
> among these two which one is preferred i mean which is more stable
> & has good performance.? Any idea
>
> It will be great if you can share document link which talks about
> there pros & cons
I have been using mod_jk for a very long time and I saw (at the time)
only one reason to make the switch to mod_proxy_ajp: it is bundled
with Apache and so you (likely) don't have to build the module yourself.
That said, simple configurations are *way* more simple in
mod_proxy_ajp than with mod_jk, although the (somewhat) recent
addition of JkWorkerProperty and JkMount "extensions" do help quite a bit.
mod_proxy_ajp can also be trivially swapped-out with mod_proxy_http
just by changing the URLs in your ProxyPass and ProxyPassReverse
directives to say http:// (or https://) instead of ajp://. This might
help you if you need to switch protocols for debugging purposes or if
you suddenly need switch to HTTPS to secure the traffic without any
external configuration (e.g. stunnel or VPN).
mod_proxy also supports ProxyPassMatch which lets you use regular
expressions in your URL mappings, which mod_jk's JkMount does not
(though you *can* use <LocationMatch> along with SetHandler in order
to achieve the same result, it's a cleaner configuration with mod_proxy).
That said, I have found that mod_jk supports more complicated
configurations where I have struggled to get mod_proxy_ajp to do the
same. Specifically, overlapping URL spaces that must be mapped to
separate workers. Technically speaking, I suppose you could use lots
of ProxyPassMatch directives and/or have a complex regular expression
to direct the various URLs, but again you end up with a rather messy
configuration that way. Messy configurations are a maintenance risk as
well as at risk of becoming "arcane knowledge" that nobody actually
understands and so they are afraid to modify it for any reason.
Generally, mod_jk will get fixed faster than mod_proxy_ajp due to its
independent release cycle: the httpd folks might have a fix for a
problem but it doesn't get released for a while due to testing of
other components, etc. At this point, mod_proxy_ajp has (IMHO) reached
a point of stability that this is less of an issue than it used to be.
At this stage, there is no reason for me to move any of my projects
from mod_jk to mod_proxy_ajp but if I were starting from scratch, I
might choose mod_proxy_ajp solely due to its binary availability and
simple configuration. If the configuration became complicated to the
extent that switching to mod_jk were a good option, then I'd move.
As for performance, I have no data on that one way or another. I would
suspect that mod_jk has a slight performance advantage because it has
been especially designed for the purpose rather than mod_proxy_ajp
which must support the mod_proxy API and might have a bit more
plumbing code to accomplish that. I would be surprised if you could
detect any performance difference between the two if you were to test
them both faithfully and with compatible configurations. If anyone has
relative performance data between mod_jk and mod_proxy_ajp, I'd be
happy to read it.
Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlCH7nUACgkQ9CaO5/Lv0PA4tQCfRMxpTCX2Q1QVeKC0DhU0QaWQ
unIAoINjyEaPMlFEVsXOFIOtXHIX+oZD
=DXAt
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by vi...@yahoo.co.in.
Andre & Christopher thanks a lot for your time & help.
One last query related to mod _jk & mod_proxy_balancer modules:- among these two which one is preferred i mean which is more stable & has good performance.? Any idea
It will be great if you can share document link which talks about there pros & cons
Thanks,
Vicky
On Oct 23, 2012, at 2:13 AM, Christopher Schultz <ch...@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> André,
>
> On 10/22/12 2:34 AM, André Warnier wrote:
>> vicky007aggarwal@yahoo.co.in wrote:
>>> All/Andre,
>>>
>>>
>>> """You could probably do this using mod_proxy_http instead of
>>> mod_jk (and a HTTPS Connector in Tomcat). But you should then
>>> also accept the overhead."""
>>>
>>> Queries :
>>>
>>> 1. Based on above comment does that mean i can use mod_proxy
>>> module in order to have ssl communication between apache &
>>> tomcat.???
>>
>> I think so, but you'd have to check that with the Apache
>> documentation.
>
> Yes, you can: just use an https:// URL instead of http:// in your
> ProxyPass/ProxyPassReverse directives.
>
>>> 2. Load balancing wont work using mod _proxy , correct ??
>>
>> Wrong. Look at the Apache documentation, mod_proxy_balancer
>
> +1
>
>>> 3. What overhead you're talking in setting up in setting up
>>> mod_proxy for ssl communication between apache & tomcat
>>
>> Setting it up is not the overhead problem. The overhead is because
>> :
>>
>> browser <- HTTPS -> Apache <- HTTPS -> Tomcat.
>>
>> meaning : - the browser encrypts (you don't care) - Apache decrypts
>> (overhead, but unavoidable) - Apache encrypts (overhead,
>> avoidable) - Tomcat decrypts (overhead, avoidable)
>
> +1
>
> But, if you need to have a secure channel between httpd and Tomcat,
> then the encryption overhead is *not* avoidable. By using stunnel or a
> VPN, you can avoid needless TCP setup/teardown and repeated key
> exchanges, but the encryption obviously always needs to take place
> (and takes time).
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iEYEARECAAYFAlCFr/wACgkQ9CaO5/Lv0PBOCACfY8fxwoAdlVjqEMuPRnHK2C9n
> pWkAoLf+8gL5xK0roxI0TPfl9NanhLAF
> =PA4C
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
André,
On 10/22/12 2:34 AM, André Warnier wrote:
> vicky007aggarwal@yahoo.co.in wrote:
>> All/Andre,
>>
>>
>> """You could probably do this using mod_proxy_http instead of
>> mod_jk (and a HTTPS Connector in Tomcat). But you should then
>> also accept the overhead."""
>>
>> Queries :
>>
>> 1. Based on above comment does that mean i can use mod_proxy
>> module in order to have ssl communication between apache &
>> tomcat.???
>>
>
> I think so, but you'd have to check that with the Apache
> documentation.
Yes, you can: just use an https:// URL instead of http:// in your
ProxyPass/ProxyPassReverse directives.
>> 2. Load balancing wont work using mod _proxy , correct ??
>
> Wrong. Look at the Apache documentation, mod_proxy_balancer
+1
>> 3. What overhead you're talking in setting up in setting up
>> mod_proxy for ssl communication between apache & tomcat
>
> Setting it up is not the overhead problem. The overhead is because
> :
>
> browser <- HTTPS -> Apache <- HTTPS -> Tomcat.
>
> meaning : - the browser encrypts (you don't care) - Apache decrypts
> (overhead, but unavoidable) - Apache encrypts (overhead,
> avoidable) - Tomcat decrypts (overhead, avoidable)
+1
But, if you need to have a secure channel between httpd and Tomcat,
then the encryption overhead is *not* avoidable. By using stunnel or a
VPN, you can avoid needless TCP setup/teardown and repeated key
exchanges, but the encryption obviously always needs to take place
(and takes time).
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlCFr/wACgkQ9CaO5/Lv0PBOCACfY8fxwoAdlVjqEMuPRnHK2C9n
pWkAoLf+8gL5xK0roxI0TPfl9NanhLAF
=PA4C
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by André Warnier <aw...@ice-sa.com>.
vicky007aggarwal@yahoo.co.in wrote:
> All/Andre,
>
>
> """You could probably do this using mod_proxy_http instead of mod_jk (and a HTTPS Connector in Tomcat). But you should then also accept the overhead."""
>
> Queries :
>
> 1. Based on above comment does that mean i can use mod_proxy module in order to have ssl communication between apache & tomcat.???
>
I think so, but you'd have to check that with the Apache documentation.
> 2. Load balancing wont work using mod _proxy , correct ??
Wrong. Look at the Apache documentation, mod_proxy_balancer
>
> 3. What overhead you're talking in setting up in setting up mod_proxy for ssl communication between apache & tomcat
>
Setting it up is not the overhead problem. The overhead is because :
browser <- HTTPS -> Apache <- HTTPS -> Tomcat.
meaning :
- the browser encrypts (you don't care)
- Apache decrypts (overhead, but unavoidable)
- Apache encrypts (overhead, avoidable)
- Tomcat decrypts (overhead, avoidable)
and that is for every single request and response.
It's ok if you do not expect a lot of traffic. But since you are talking load-balancing,
you may expect a lot of traffic.
> Thanks,
> Vicky
>
>
> On Oct 22, 2012, at 1:30 AM, Christopher Schultz <ch...@christopherschultz.net> wrote:
>
>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: SHA1
>>
>> Vivek,
>>
>> On 10/20/12 2:22 AM, vivek aggarwal wrote:
>>> I need to setup the SSL over my tomcat ,which i am able to do it
>>> by generating Self signed certificate using Keytool
>> Good.
>>
>>> But when i am redirecting the request form apache using "mod_jk
>>> "module its not working.
>> What part doesn't work?
>>
>>> I am not sure how to make Apache & Tomcat work in SSL when using
>>> Mod_jk module as i need load balancing
>> mod_jk does not support SSL communication between httpd <-> Tomcat:
>> you'll have to terminate SSL at the httpd level. If you want to
>> encrypt the traffic between httpd and Tomcat, you'll need to use a
>> VPN, ssh tunnel or stunnel (which is just an automated ssh tunnel).
>>
>>> Can someone please share the steps for doing ssl setup when apache
>>> is used along with Tomcat
>> Have you been able to get httpd working with SSL? Once you do that,
>> everything else should be straightforward (not that getting httpd
>> working with SSL is at all difficult).
>>
>> Just be aware that httpd doesn't use Java keystores, so you'll need to
>> create your keys and certificates using 'openssl' from the
>> command-line instead of working with 'keytool'.
>>
>> - -chris
>> -----BEGIN PGP SIGNATURE-----
>> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
>> Comment: GPGTools - http://gpgtools.org
>> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>>
>> iEYEARECAAYFAlCEVHMACgkQ9CaO5/Lv0PAlIACeIxE9lgHiZaDpiPszUFBD5hiF
>> lNIAn2MseZynznuQ94/6xitYHJZb05lb
>> =PUqf
>> -----END PGP SIGNATURE-----
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by vi...@yahoo.co.in.
All/Andre,
"""You could probably do this using mod_proxy_http instead of mod_jk (and a HTTPS Connector in Tomcat). But you should then also accept the overhead."""
Queries :
1. Based on above comment does that mean i can use mod_proxy module in order to have ssl communication between apache & tomcat.???
2. Load balancing wont work using mod _proxy , correct ??
3. What overhead you're talking in setting up in setting up mod_proxy for ssl communication between apache & tomcat
Thanks,
Vicky
On Oct 22, 2012, at 1:30 AM, Christopher Schultz <ch...@christopherschultz.net> wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Vivek,
>
> On 10/20/12 2:22 AM, vivek aggarwal wrote:
>> I need to setup the SSL over my tomcat ,which i am able to do it
>> by generating Self signed certificate using Keytool
>
> Good.
>
>> But when i am redirecting the request form apache using "mod_jk
>> "module its not working.
>
> What part doesn't work?
>
>> I am not sure how to make Apache & Tomcat work in SSL when using
>> Mod_jk module as i need load balancing
>
> mod_jk does not support SSL communication between httpd <-> Tomcat:
> you'll have to terminate SSL at the httpd level. If you want to
> encrypt the traffic between httpd and Tomcat, you'll need to use a
> VPN, ssh tunnel or stunnel (which is just an automated ssh tunnel).
>
>> Can someone please share the steps for doing ssl setup when apache
>> is used along with Tomcat
>
> Have you been able to get httpd working with SSL? Once you do that,
> everything else should be straightforward (not that getting httpd
> working with SSL is at all difficult).
>
> Just be aware that httpd doesn't use Java keystores, so you'll need to
> create your keys and certificates using 'openssl' from the
> command-line instead of working with 'keytool'.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
>
> iEYEARECAAYFAlCEVHMACgkQ9CaO5/Lv0PAlIACeIxE9lgHiZaDpiPszUFBD5hiF
> lNIAn2MseZynznuQ94/6xitYHJZb05lb
> =PUqf
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Vivek,
On 10/20/12 2:22 AM, vivek aggarwal wrote:
> I need to setup the SSL over my tomcat ,which i am able to do it
> by generating Self signed certificate using Keytool
Good.
> But when i am redirecting the request form apache using "mod_jk
> "module its not working.
What part doesn't work?
> I am not sure how to make Apache & Tomcat work in SSL when using
> Mod_jk module as i need load balancing
mod_jk does not support SSL communication between httpd <-> Tomcat:
you'll have to terminate SSL at the httpd level. If you want to
encrypt the traffic between httpd and Tomcat, you'll need to use a
VPN, ssh tunnel or stunnel (which is just an automated ssh tunnel).
> Can someone please share the steps for doing ssl setup when apache
> is used along with Tomcat
Have you been able to get httpd working with SSL? Once you do that,
everything else should be straightforward (not that getting httpd
working with SSL is at all difficult).
Just be aware that httpd doesn't use Java keystores, so you'll need to
create your keys and certificates using 'openssl' from the
command-line instead of working with 'keytool'.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlCEVHMACgkQ9CaO5/Lv0PAlIACeIxE9lgHiZaDpiPszUFBD5hiF
lNIAn2MseZynznuQ94/6xitYHJZb05lb
=PUqf
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by André Warnier <aw...@ice-sa.com>.
Aladin Dajani wrote:
> Hello,
> Terminating SSL at the Apache level assumes all tomcat servers behind
> Apache are on a secure, externally inaccessible, network.
My response assumed that, and assumed that the OP wanted to continue using mod_jk for
whatever reason.
But In
> cloud-based, hosted systems, there is no guarantee someone isn't
> listening. Does this make a case for securing Apache<->tomcat
> communication?
One could easily argue that if those servers are on different "cloud-based, hosted
systems", any thought of a high level of security is a bit of a stretch anyway.
And that anyone who manages to usefully listen on those links, is probably already so deep
inside your cloud infrastructure that this is not the worst they're doing.
Or that the risk of ditto, compared to the risk constituted by umpteen buggy and
virus-infected user workstations, pales into insignificance.
In an absolute sense though, you are right. If you want to really secure the
Apache-Tomcats link, then you will have to re-encrypt the data at the Apache level and
decrypt it at the Tomcat level.
You could probably do this using mod_proxy_http instead of mod_jk (and a HTTPS Connector
in Tomcat). But you should then also accept the overhead.
Or you could set up SSL tunnel connections for AJP between Apache and Tomcat, but the
overhead would still be there.
>
>
> On Oct 21, 2012, at 6:09 AM, "vicky007aggarwal@yahoo.co.in"
> <vi...@yahoo.co.in> wrote:
>
>> Thanks André for such a elaborate reply.
>> Just want to check another thing, is it possible to setup SSL at tomcat level using mod_proxy module.. But i think it does not work in load balancing case. Does my understanding is correct??
>>
>> Thanks for your support,
>> Vicky
>>
>>
>>
>> On Oct 20, 2012, at 7:21 PM, André Warnier <aw...@ice-sa.com> wrote:
>>
>>> vivek aggarwal wrote:
>>>> Hello All,
>>>> I need to setup the SSL over my tomcat ,which i am able to do it by generating Self signed certificate using Keytool
>>>> But when i am redirecting the request form apache using "mod_jk "module its not working.
>>>> I am not sure how to make Apache & Tomcat work in SSL when using Mod_jk module as i need load balancing
>>>> Can someone please share the steps for doing ssl setup when apache is used along with Tomcat
>>> A simplified graphical view of the recommended setup :
>>>
>>> browser <- HTTPS -> Apache + mod_jk <- AJP -> Tomcat-1 (AJP Connector)
>>> <- AJP -> Tomcat-2 (AJP Connector)
>>> ...
>>> <- AJP -> Tomcat-n (AJP Connector)
>>>
>>> In other words, you should handle the HTTPS/SSL at the front-end Apache httpd level, not at the Tomcat level. (This is also sometimes called "terminating SSL at the Apache level").
>>> The reason is that the AJP protocol does not support HTTPS/SSL (so, there is no way to set up the AJP Connector in Tomcat for SSL) (and no way to set up mod_jk to "talk SSL to Tomcat").
>>> What the Apache/mod_jk combination can do however, is pass on all the required SSL headers of the original requests to Tomcat, over the AJP connection, so that a Tomcat application could make use of them.
>>>
>>> To see how to set up Apache for SSL, check the Apache httpd on-line documentation.
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: users-help@tomcat.apache.org
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by Aladin Dajani <al...@gmail.com>.
Hello,
Terminating SSL at the Apache level assumes all tomcat servers behind
Apache are on a secure, externally inaccessible, network. But In
cloud-based, hosted systems, there is no guarantee someone isn't
listening. Does this make a case for securing Apache<->tomcat
communication?
On Oct 21, 2012, at 6:09 AM, "vicky007aggarwal@yahoo.co.in"
<vi...@yahoo.co.in> wrote:
> Thanks André for such a elaborate reply.
> Just want to check another thing, is it possible to setup SSL at tomcat level using mod_proxy module.. But i think it does not work in load balancing case. Does my understanding is correct??
>
> Thanks for your support,
> Vicky
>
>
>
> On Oct 20, 2012, at 7:21 PM, André Warnier <aw...@ice-sa.com> wrote:
>
>> vivek aggarwal wrote:
>>> Hello All,
>>> I need to setup the SSL over my tomcat ,which i am able to do it by generating Self signed certificate using Keytool
>>> But when i am redirecting the request form apache using "mod_jk "module its not working.
>>> I am not sure how to make Apache & Tomcat work in SSL when using Mod_jk module as i need load balancing
>>> Can someone please share the steps for doing ssl setup when apache is used along with Tomcat
>>
>> A simplified graphical view of the recommended setup :
>>
>> browser <- HTTPS -> Apache + mod_jk <- AJP -> Tomcat-1 (AJP Connector)
>> <- AJP -> Tomcat-2 (AJP Connector)
>> ...
>> <- AJP -> Tomcat-n (AJP Connector)
>>
>> In other words, you should handle the HTTPS/SSL at the front-end Apache httpd level, not at the Tomcat level. (This is also sometimes called "terminating SSL at the Apache level").
>> The reason is that the AJP protocol does not support HTTPS/SSL (so, there is no way to set up the AJP Connector in Tomcat for SSL) (and no way to set up mod_jk to "talk SSL to Tomcat").
>> What the Apache/mod_jk combination can do however, is pass on all the required SSL headers of the original requests to Tomcat, over the AJP connection, so that a Tomcat application could make use of them.
>>
>> To see how to set up Apache for SSL, check the Apache httpd on-line documentation.
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by vi...@yahoo.co.in.
Thanks André for such a elaborate reply.
Just want to check another thing, is it possible to setup SSL at tomcat level using mod_proxy module.. But i think it does not work in load balancing case. Does my understanding is correct??
Thanks for your support,
Vicky
On Oct 20, 2012, at 7:21 PM, André Warnier <aw...@ice-sa.com> wrote:
> vivek aggarwal wrote:
>> Hello All,
>> I need to setup the SSL over my tomcat ,which i am able to do it by generating Self signed certificate using Keytool
>> But when i am redirecting the request form apache using "mod_jk "module its not working.
>> I am not sure how to make Apache & Tomcat work in SSL when using Mod_jk module as i need load balancing
>> Can someone please share the steps for doing ssl setup when apache is used along with Tomcat
>
> A simplified graphical view of the recommended setup :
>
> browser <- HTTPS -> Apache + mod_jk <- AJP -> Tomcat-1 (AJP Connector)
> <- AJP -> Tomcat-2 (AJP Connector)
> ...
> <- AJP -> Tomcat-n (AJP Connector)
>
> In other words, you should handle the HTTPS/SSL at the front-end Apache httpd level, not at the Tomcat level. (This is also sometimes called "terminating SSL at the Apache level").
> The reason is that the AJP protocol does not support HTTPS/SSL (so, there is no way to set up the AJP Connector in Tomcat for SSL) (and no way to set up mod_jk to "talk SSL to Tomcat").
> What the Apache/mod_jk combination can do however, is pass on all the required SSL headers of the original requests to Tomcat, over the AJP connection, so that a Tomcat application could make use of them.
>
> To see how to set up Apache for SSL, check the Apache httpd on-line documentation.
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSl Query-- please help
Posted by André Warnier <aw...@ice-sa.com>.
vivek aggarwal wrote:
> Hello All,
>
> I need to setup the SSL over my tomcat ,which i am able to do it by generating Self signed certificate using Keytool
>
> But when i am redirecting the request form apache using "mod_jk "module its not working.
>
> I am not sure how to make Apache & Tomcat work in SSL when using Mod_jk module as i need load balancing
>
> Can someone please share the steps for doing ssl setup when apache is used along with Tomcat
>
A simplified graphical view of the recommended setup :
browser <- HTTPS -> Apache + mod_jk <- AJP -> Tomcat-1 (AJP Connector)
<- AJP -> Tomcat-2 (AJP Connector)
...
<- AJP -> Tomcat-n (AJP Connector)
In other words, you should handle the HTTPS/SSL at the front-end Apache httpd level, not
at the Tomcat level. (This is also sometimes called "terminating SSL at the Apache level").
The reason is that the AJP protocol does not support HTTPS/SSL (so, there is no way to set
up the AJP Connector in Tomcat for SSL) (and no way to set up mod_jk to "talk SSL to Tomcat").
What the Apache/mod_jk combination can do however, is pass on all the required SSL headers
of the original requests to Tomcat, over the AJP connection, so that a Tomcat application
could make use of them.
To see how to set up Apache for SSL, check the Apache httpd on-line documentation.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org