Skip to main content

Running HTTPS - Tomcat - Ubuntu 11.04

Today my friend wanted to setup HTTPS implementation on his tomcat server.
So here how we did it.


Installing Tomcat on Ubuntu 11.04
ahmed@ubuntu:~$ sudo apt-get install tomcat6
ahmed@ubuntu:~$ sudo apt-get install tomcat6-admin
Here is complete information on howto install tomcat on Ubuntu 11.04.
https://help.ubuntu.com/11.04/serverguide/C/tomcat.html
Next once we have tomcat installed here is what we need to do.



Creating KeyStore File
ahmed@ubuntu:~$ keytool -genkeypair -alias tomcat -keyalg RSA -keysize 1024 -dname "CN=localhost, OU=Organization, O=Company Name, L=City, S=State, C=US" -validity 365 -keystore keystore

Enter keystore password: <enter a new password here>
Enter key password for <tomcat>
        (RETURN if same as keystore password): <just hit enter here>
The password you enter in the first password prompt will be the password for the "keystore" file where your server certificate is stored. File will be create in the current directory where you executed the above command. Then you can copy it to your tomcat directory as requried.

Next Updating server.xml file
Next, edit your Tomcat's conf/server.xml to enable the HTTPS connector (Add last line with your information).
Look for a connector that looks like this and uncomment these lines:
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
    maxThreads="150" scheme="https" secure="true"
    clientAuth="false" sslProtocol="TLS"
    keystoreFile="/etc/tomcat6/keystore" keystorePass="ahmed"/>
Comment the below information in the servel.xml file,
if you want the server to accept on SSL connections only.
<!--
    <Connector port="8080" protocol="HTTP/1.1"
     connectionTimeout="20000"
     URIEncoding="UTF-8"
     redirectPort="8443" />
-->
Once this is done lets restart.
ahmed@ubuntu:~$ sudo service tomcat6 restart

Then we can hit https://localhost:8443 on the browser.
Your web browser will warn you about the self-signed certificate,
this is fine if your not running any critical application.

You will get the below warning on the browser as this is a self-signed certificate.
10
Add the site to exception.
25
Then access the site, all the data between the browser and server is secured over SSL.
34
Labels:

Comments

Post a Comment

Popular posts from this blog

Installing Zabbix Version 2.4 Offline (Zabbix Server without Internet).

There might be situations where you have a remote/zabbix server which does not have internet connectivity, due to security or other reasons. So we create a custom repo on the remote/zabbix server so that we can install zabbix using rpms Here is how we are planning to do this. Download all the dependency rpms on a machine which has internet connection, using yum-downloadonly or repotrack . Transfer all the rpms to the remote server. Create a repo on the remote server. Update yum configuration. Install. NOTE: This method can be used to install any application, but here we have used zabbix as we had this requirement for a zabbix server. Download dependent rpms . On a machine which has internet connection install the package below. And download all the rpms . Make sure the system are similar (not required to be identical - At-least the OS should be of same version) mkdir /zabbix_rpms yum install yum-downloadonly Downloading all the rpms to location /zabbix_rpms/ ,...
1 comment
Read more

Access Filter in SSSD `ldap_access_filter` [SSSD Access denied / Permission denied ]

Access Filter Setup with SSSD ldap_access_filter (string) If using access_provider = ldap , this option is mandatory. It specifies an LDAP search filter criteria that must be met for the user to be granted access on this host. If access_provider = ldap and this option is not set, it will result in all users being denied access. Use access_provider = allow to change this default behaviour. Example: access_provider = ldap ldap_access_filter = memberOf=cn=allowed_user_groups,ou=Groups,dc=example,dc=com Prerequisites yum install sssd Single LDAP Group Under domain/default in /etc/sssd/sssd.conf add: access_provider = ldap ldap_access_filter = memberOf=cn=Group Name,ou=Groups,dc=example,dc=com Multiple LDAP Groups Under domain/default in /etc/sssd/sssd.conf add: access_provider = ldap ldap_access_filter = (|(memberOf=cn=System Adminstrators,ou=Groups,dc=example,dc=com)(memberOf=cn=Database Users,ou=Groups,dc=example,dc=com)) ldap_access_filter accepts standa...
1 comment
Read more

Setting up ssl https On Nagios XI Server

HTTPS is a protocol for secure communication over a computer network which is widely used on the Internet. HTTPS consists of communication over Hypertext Transfer Protocol (HTTP) within a connection encrypted by Transport Layer Security or its predecessor, Secure Sockets Layer. The main motivation for HTTPS is authentication of the visited website and protection of the privacy and integrity of the exchanged data. Intro Courtesy Wikipedia Full SSL support requires Nagios XI version 2011R1.6 or later. Before we start. Check if the below packages are install, they should be if you are using latest Nagios XI, but check them anyways. yum install mod_ssl openssl Creating Key and Certificate Lets generate the key for the server. openssl genrsa -out ca.key 2048 Output for the command. [ahmed@nagiosserver ~]$ openssl genrsa -out ca.key 2048 Generating RSA private key, 2048 bit long modulus ...........................................................................................
3 comments
Read more