OpenForum RSS: tomcat � ssl

tomcat � ssl (ALex_hha)

Fri, 03 Jul 2015 13:01:35 GMT

http://sys-adm.org.ua/www/jira-tomcat-ssl

�� , ��

tomcat � ssl (ALex_hha)

Tue, 30 Jun 2015 11:58:11 GMT

> �� , �� jks � ��
> ��, �� tomcat+ssl:
> <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
> maxThreads="150" scheme="https" secure="true"
> SSLCACertificateFile="${catalina.home}/cert/root.crt"
> SSLCertificateFile="${catalina.home}/cert/client.crt"
> SSLCertificateKeyFile="${catalina.home}/cert/client.key"
> sslProtocol="TLS" />
> � root.crt �� .

��, �� , �� apr ��, ��

[code]
<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
scheme="https"
secure="true"
clientAuth="false"
useBodyEncodingForURI="true"

SSLEnabled="true"
SSLHonorCipherOrder="true"
SSLDisableCompression="true"
SSLCertificateFile="/etc/pki/jira/jira.example.net.crt"
SSLCertificateKeyFile="/etc/pki/jira/jira.e

tomcat � ssl (and)

Thu, 25 Jun 2015 08:38:47 GMT

�� , �� jks � �� , �� tomcat+ssl:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
SSLCACertificateFile="${catalina.home}/cert/root.crt"
SSLCertificateFile="${catalina.home}/cert/client.crt"
SSLCertificateKeyFile="${catalina.home}/cert/client.key"
sslProtocol="TLS" />

� root.crt �� .

tomcat � ssl (anonymous)

Thu, 25 Jun 2015 08:37:47 GMT

tomcat � ssl (eRIC)

Wed, 24 Jun 2015 16:52:48 GMT

> �� .

�� , � ��

tomcat � ssl (ALex_hha)

Wed, 24 Jun 2015 15:52:14 GMT

� ��

�� . �� ! [b]root -> intermediate -> server[/b]
[code]
$ cat rootca.crt > chain.pem
$ cat sub.class1.server.ca.crt >> chain.pem
$ cat jira.example.net.crt >> chain.pem
[/code]

https://answers.atlassian.com/questions/146659/unable-to-configure-ssl-in-jira

Note: If root or intermediate certificates are necessary, they MUST be inserted into the keychain in the order root -> intermediate(s) -> domain

��
[code]
$ openssl verify chain.pem
chain.pem: OK
[/code]

�� pkcs12
[code]
$ openssl pkcs12 -export -in chain.pem -inkey jira.example.net.key > chain.p12
Enter Export Password:
Verifying - Enter Export Password:
[/code]

�� keystore
[code]
$ keytool -importkeystore -srckeystore chain.p12 -destkeystore jira.jks -srcstoretype pkcs12
Enter destination keystore password:
Re-enter new password:
Enter source keystore password:
Entry

tomcat � ssl (ALex_hha)

Wed, 24 Jun 2015 11:22:50 GMT

> �� , �� (chain) ��, �.� ��
> �� .

��

> ��
> keystore

�� .

> ��:
> https://stackoverflow.com/questions/8120690/tomcat-doesnt-deliver-intermediate-certificate-https
> http://www.fourproc.com/2010/06/23/create-a-ssl-keystore-for-a-tomcat-server-using-openssl-.html

ok, ��

tomcat � ssl (eRIC)

Wed, 24 Jun 2015 10:16:45 GMT

>[�� ]
>CONNECTED(00000003)
>depth=0 C = UA, CN = jira.example.net, emailAddress = webmaster@example.net
>verify error:num=20:unable to get local issuer certificate
>verify return:1
>depth=0 C = UA, CN = jira.example.net, emailAddress = webmaster@example.net
>verify error:num=27:certificate not trusted
>verify return:1
>depth=0 C = UA, CN = jira.example.net, emailAddress = webmaster@example.net
>verify error:num=21:unable to verify the first certificate
>verify return:1

�� , �� (chain) ��, �.� �� .

�� keystore

��:
https://stackoverflow.com/questions/8120690/tomcat-doesnt-deliver-intermediate-certificate-https
http://www.fourproc.com/2010/06/23/create-a-ssl-keystore-for-a-tomcat-server-using-openssl-.html

tomcat � ssl (ALex_hha)

Wed, 24 Jun 2015 09:43:21 GMT

> openssl s_client -connect jira.example.net:8443 -CApath /etc/ssl/certs/

��

[code]
$ openssl s_client -connect jira.example.net:8443 -CApath /etc/ssl/certs/
CONNECTED(00000003)
depth=0 C = UA, CN = jira.example.net, emailAddress = webmaster@example.net
verify error:num=20:unable to get local issuer certificate
verify return:1
depth=0 C = UA, CN = jira.example.net, emailAddress = webmaster@example.net
verify error:num=27:certificate not trusted
verify return:1
depth=0 C = UA, CN = jira.example.net, emailAddress = webmaster@example.net
verify error:num=21:unable to verify the first certificate
verify return:1
---
...
...
...
subject=/C=UA/CN=jira.example.net/emailAddress=webmaster@example.net
issuer=/C=IL/O=StartCom Ltd./OU=Secure Digital Certificate Signing/CN=StartCom Class 1 Primary Intermediate Server CA
---
No client certificate CA names sent
Server Temp Key: ECDH, secp521r1, 521 bits
---
SSL handshake has read 2644 bytes and written 443 bytes
---
New, TLSv1/SSLv3,