You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by "Konstantin Kolinko (Confluence)" <no...@apache.org> on 2019/11/24 00:40:07 UTC
[CONF] Apache Tomcat > AJP with stunnel
There's **1 new edit** on this page
---
|
---
| | [](https://cwiki.apache.org/confluence/display/TOMCAT/AJP+with+stunnel?src=mail&src.mail.product=confluence-
server&src.mail.timestamp=1574556007731&src.mail.notification=com.atlassian.confluence.plugins.confluence-
notifications-batch-plugin%3Abatching-
notification&src.mail.recipient=8aa9809569d423cd016a0413306f00db&src.mail.action=view
"page icon")
---
[AJP with
stunnel](https://cwiki.apache.org/confluence/display/TOMCAT/AJP+with+stunnel?src=mail&src.mail.product=confluence-
server&src.mail.timestamp=1574556007731&src.mail.notification=com.atlassian.confluence.plugins.confluence-
notifications-batch-plugin%3Abatching-
notification&src.mail.recipient=8aa9809569d423cd016a0413306f00db&src.mail.action=view
"AJP with stunnel")
| | | | |  | | Konstantin
Kolinko edited this page
---
|
| | Here's the version comment
---
|
---
| | |  | | Konstantin
Kolinko edited at [12:32
AM](https://cwiki.apache.org/confluence/pages/viewpage.action?pageId=103098444)
---
| | | Add a permalink. Fix formatting. Convert links to https.
---
|
| | Here's what changed:
---
|
_Permalink_ to this page; [
https://cwiki.apache.org/confluence/x/TCglBg](https://cwiki.apache.org/confluence/x/TCglBg)
# AJP over stunnel
stunnel is a little more complicated than a normal protocol because it can be
used in a number of different ways. I'll give some contrived examples to see
how you can set it up in different ways, depending upon the support for
encryption of the underlying protocol.
 Wiki MarkupThis wiki entry is intended to be a
starter-guide and not a replacement for the fine
\\[https://www.stunnel.org/docs.html|[documentation
](https://www.stunnel.org/docs.html) [ provided
](https://www.stunnel.org/docs.html) [ by ](https://www.stunnel.org/docs.html)
[ the ](https://www.stunnel.org/docs.html) [ stunnel
](https://www.stunnel.org/docs.html) [
team](https://www.stunnel.org/docs.html)\\].
Let's say that you have an HTTPS server, but your client can't speak HTTPS for
some reason. If you set up stunnel on the _client_ side, you can connect
locally to the stunnel server and have it establish a secure-connection to the
remote server running HTTPS. Like this:
|
No Format
---
client -> localhost:12345 (stunnel)
stunnel -> remote_host:443 (httpd)
As far as the client is concerned, it's using HTTP to talk to localhost. But
really it's talking to remote_host:443, so everyone is happy. (Yes, there are
issues with URLs and redirects produced by the server, but that's out of scope
for this discussion).
Let's take another example: you have clients that are HTTPS-capable, but the
service you are running can only support HTTP for some reason, and you want to
secure it. Set up stunnel on the _server_ , then have your remote clients
connect to _it_ and tunnel to localhost. Like this:
No Format
---
client -> remote_host:443 (stunnel)
stunnel -> localhost:8080 (httpd)
As far as the client is concerned, it's using HTTPS to communicate with
remote_host:443, but really it's connecting to remote_host:8080. (Yes, there
are some issues with URLs and redirects but that's out of scope for this
discussion.)
...
1. Depending upon the version, you might only be able to use TLSv1 (and not e.g. TLSv1.2)
...
1. stunnel generally ignores certificate issues, such as expiration, etc. You might want to configure it with a little more care than the default. **THIS ALSO MEANS IT DOES NOT AUTHENTICATE THE SERVER BY DEFAULT**. You could accidentally connect to a malicious server.
This should be enough to get you started. Please refer to the [official
stunnel documentation](https://www.stunnel.org/docs.html) for specifics.
| | | [Go to page
history](https://cwiki.apache.org/confluence/pages/viewpreviousversions.action?pageId=103098444&src=mail&src.mail.product=confluence-
server&src.mail.timestamp=1574556007731&src.mail.notification=com.atlassian.confluence.plugins.confluence-
notifications-batch-plugin%3Abatching-
notification&src.mail.recipient=8aa9809569d423cd016a0413306f00db "Go to page
history")
---
---
| [View
page](https://cwiki.apache.org/confluence/display/TOMCAT/AJP+with+stunnel?src=mail&src.mail.product=confluence-
server&src.mail.timestamp=1574556007731&src.mail.notification=com.atlassian.confluence.plugins.confluence-
notifications-batch-plugin%3Abatching-
notification&src.mail.recipient=8aa9809569d423cd016a0413306f00db&src.mail.action=view)
---
| | [Stop watching
space](https://cwiki.apache.org/confluence/users/removespacenotification.action?spaceKey=TOMCAT&src=mail&src.mail.product=confluence-
server&src.mail.timestamp=1574556007731&src.mail.notification=com.atlassian.confluence.plugins.confluence-
notifications-batch-plugin%3Abatching-
notification&src.mail.recipient=8aa9809569d423cd016a0413306f00db&src.mail.action=stop-
watching&jwt=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ4c3JmOjhhYTk4MDk1NjlkNDIzY2QwMTZhMDQxMzMwNmYwMGRiIiwicXNoIjoiMzQ1ZWZhYjliNjUzNjk4YTQwZjhkOTA2Mjg1NmJlMWY2OGU0NDc4OGEwNmMyMGY2YjYxYzIwM2JjYTZjNzQ5MSIsImlzcyI6ImNvbmZsdWVuY2Vfbm90aWZpY2F0aW9uc0FSRUgtWFVEMS1QT1FHLUNTQU8iLCJleHAiOjE1NzUxNjA4MDcsImlhdCI6MTU3NDU1NjAwN30.i3_NXNp0MoozQXNthAl-
kHX73R9GJXNZRIDSQv7d0r4) | •
---|---
[Manage
notifications](https://cwiki.apache.org/confluence/users/editmyemailsettings.action?src=mail&src.mail.product=confluence-
server&src.mail.timestamp=1574556007731&src.mail.notification=com.atlassian.confluence.plugins.confluence-
notifications-batch-plugin%3Abatching-
notification&src.mail.recipient=8aa9809569d423cd016a0413306f00db&src.mail.action=manage)
---
| 
---
This message was sent by Atlassian Confluence 6.15.8
---