Tomcat 8.0 Configuring HTTPS Connector

Table of Contents SSL Implementation SSL Ciphers SSL Client Authentication SSL Keystore JKS Keystore PKCS #11 Keystore PKCS #12 Keystore SSL Trust Manager

SSL Implementation

• Tomcat SSL Implementations

SSL Ciphers

• Tomcat SSL Ciphers

SSL Client Authentication

 <Connector ... clientAuth="want" />

SSL Keystore

JKS Keystore

$ $JAVA_HOME/bin/keytool -genkey -alias sslserver -keyalg RSA -keystore /usr/share/tomcat/keystore

<Connector port="8443"
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="200"
           scheme="https"
           secure="true"
           SSLEnabled="true">

    <SSLHostConfig sslProtocol="SSL" ...>

        <Certificate certificateKeystoreType="jks"
                     certificateKeystoreFile="/usr/share/tomcat/keystore"
                     certificateKeystorePass="Secret.123"
                     certificateKeyAlias="sslserver" />

    </sslhostconfig>

</connector>

PKCS #11 Keystore

• Java PKCS11

 <Connector name="Secure"
            port="8443"
            <font color="red">protocol="org.dogtagpki.tomcat.Http11NioProtocol"</font>
            SSLEnabled="true"
            sslProtocol="SSL"
            scheme="https"
            secure="true"
            ...
            <font color="red">keystoreType="pkcs11"
            keystoreProvider="Mozilla-JSS"
            keyAlias="sslserver"</font>
            ...
 />

PKCS #12 Keystore

• Tomcat SSL Configuration with JSSE
• Tomcat SSL Configuration with OpenSSL
• Tomcat SSL Configuration with JSS

SSL Trust Manager

• PKITrustManager.java

 <Connector ... <font color="red">trustManagerClassName="org.dogtagpki.tomcat.PKITrustManager"</font> />