-
Notifications
You must be signed in to change notification settings - Fork 12
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use system truststore #68
Comments
we need to overwrite the jks-keystore hook to add detection for adoptopenjdk - point adoptopenjdk at the generated truststore - stop messing with keytool to generate a java truststore with a useless localhost cert - stop pointing jvms at a local java truststore tested with vagrant on buster/debian 10
should work now, tests welcome ;) |
Salut, ansible/roles/tomcat/templates/server-proxycas.xml.j2 Lines 81 to 82 in 3519326
|
et bien ... je ne sais plus :/ ou alors pointer vers le keystore par defaut ? |
une instance de test qui marchait hier n'arrive plus a valider de tickets CAS ajd, et si dans le
|
j'ai pu retrouver un CAS fonctionnel en commentant toute la section liée au connector écoutant sur le port 8443, mais je ne sais plus dans quels cas ce dernier était nécessaire..; |
et ce meme CAS qui fonctionnait (avec le connector sur le port 8443 commenté) n'arrive soudainement plus a valider de tickets via SSL, sans raison apparente. Décidément, java et ssl.. |
hm, donc avec |
…orgotten in #68 not even sure this is still needed, but what we have now cant be right
Pierre recommends using the system wide truststore instead of using a custom one for every tomcat.
This means:
openssl s_client -connect localhost:443
/usr/local/share/ca-certificates/georchestra.crt
update-ca-certificates
javax.net.ssl.trustStore*
The text was updated successfully, but these errors were encountered: