Tag Archives: apache

Tomcat Web Server SSL Certificate Installation

How to generate a CSR in Tomcat with Keytool

Create a New Keystore

You will need to create a new Keystore, this is done by this command:

keytool -genkey -alias domainname.prefix -keyalg RSA -keysize 2048 -keystore /path/domainname.prefix.jks

When the commands ask for the firstname and lastname, please type domainname.prefix instead of you name, else the certificate will issues to you name, instead of the domain name.

Generate a CSR from Your New Keystore

  1. Next, you need to generate a CSR file, this is done by this command
    keytool -certreq -alias domainname.prefix -file certreq.cer -keystore /path/domainname.prefix.jks
  2. Type the keystore password that you chose earlier and hit Enter.
  3. Please upload the certreq.cer, to you standard certificate supplier.

Installing the SSL Certificates to the Keystore

  1. You will then get a certificate, save it as signcert.cer
  2. Download aswell the correct intermediate certificate, aswell as the correct root certificate.
  3. Import them with this command:
    keytool -import -trustcacerts -alias root -file root.cer -keystore /path/domainname.prefix.jks
    
    keytool -import -trustcacerts -alias intermediate -file intermediate.cer -keystore /path/domainname.prefix.jks
  1. Import the signed certificate
    keytool -import -trustcacerts -alias domainanme.prefix -file signcert.cer -keystore /path/domainname.prefix.jks

Configuring your SSL Connector

Before Tomcat can accept secure connections, you need to configure an SSL Connector.

  1. In a text editor, open the Tomcat server.xml file.
    The server.xml file is usually located in the conf folder of your Tomcat’s home directory.
  1. Locate the connector that you want to use the new keystore to secure.
    Usually, a connector with port 443 or 8443 is used, as shown in step 4.
  1. If necessary, uncomment the connector.
    To uncomment a connector, remove the comment tags (<!– and –>).
  1. Specify the correct keystore filename and password in your connector configuration.

When you are done, your connector should look something like this:

<Connector port="443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" SSLEnabled="true"clientAuth="false" sslProtocol="TLS" keyAlias="server" keystoreFile="/path/domainname.prefix.jks " keystorePass="your_keystore_password" />

Note: If you are using a version of Tomcat prior to Tomcat 7, you need to change “keystorePass” to “keypass”.

  1. Save your changes to the server.xml file.
  2. Restart Tomcat.

 

Apache and multiple SSL virtual host on same IP address

In standard way, apache only supports one SSL virtual host per IP address, if you want to use different SSL Certificates file. But with mod-gnutls it is possible to have multiple Virtual host with different SSL Certificates file.

Install mod-gnutls in Debian:

apt-get install libapache2-mod-gnutls

Then you need to enable mod-gnutls

cd /etc/apache2/mods-enabled
ln -s ../mods-available/gnutls.* .

Then you need to create the gnutls cache files

touch /var/cache/apache2/gnutls_cache
chmod 700 /var/cache/apache2/gnutls_cache
chown 33.33 /var/cache/apache2/gnutls_cache

And then you need to setup the two virtualhost:

<VirtualHost *:443>
ServerAdmin [email protected]
ServerName v1.dalbjerg.nu
DocumentRoot /var/www/v1.dalbjerg.nu
GnuTLSEnable on
GnuTLSPriorities NORMAL
GnuTLSCertificateFile /etc/apache2/v1/ssl.crt
GnuTLSKeyFile /etc/apache2/v1/ssl.key
</VirtualHost>

<VirtualHost *:443>
ServerAdmin [email protected]
ServerName v2.dalbjerg.nu
DocumentRoot /var/www/v2.dalbjerg.nu
GnuTLSEnable on
GnuTLSPriorities NORMAL
GnuTLSCertificateFile /etc/apache2/v2/ssl.crt
GnuTLSKeyFile /etc/apache2/v2/ssl.key
</VirtualHost>

Then you need to restart apache

apache2cl restart

If it don’t work see at /var/log/apache2/error.log to see any error is reporting there.

[ad]

Opgraderingen til Apache 2 fra Apache 1.3 og danske bogstaver

Jeg har her til aften opgraderet en webserver fra Apache 1.3 til 2.0, herefter var alle danske bogstaver rettet af alle muligt mærkelige tegn.
Dette kan nemt rettes i apache2.conf filen, som ligger i /etc/apache2/apache2.conf (I hvert fald hvis du kører Debian).

Her skal du finde linien:
# AddDefaultCharset ISO-8859-1
Og så rette den til
AddDefaultCharset ISO-8859-15 (Forskellen på ISO-8859-1 og ISO-8859-15 er at € tegnet er med.)

Herefter skal apache genstartes dette gøres med ”apache2ctl restart”