Web Application under Tomcat with SSL

Question

I wanted to secure an application I developed recently, and I following mkyong's tutorial.

It worked only for tomcat manager's pages.

Indeed, I use the <transport-guarantee>CONFIDENTIAL</transport-guarantee> with <auth-method>CLIENT-CERT</auth-method>.

At the beginning, I wasn't sure about mkyong's certificate, so I followed instructions in maximporges.

I keep getting error code 401.

When I change auth-method from CLIENT-CERT to BASIC, I am prompted to enter login and password, I enter a user's credentials that exists in tomcat-users.xml, and it works.

I tried to add a user in tomcat-users.xml like <user username="CN=xxxx xxx xxx, O=knmi, O=users, O=dutchgrid" password="null" roles="abc" /> I duplicate the exact same information entered previously for the certificate, but doesn't work.

I think the server can't find the client's certificate

Note: I had to change protocol="HTTP/1.1" to protocol="org.apache.coyote.http11.Http11AprProtocol" in server.xml to avoid getting ERR_BAD_SSL_CLIENT_AUTH_CERT.

This question is not well explained. Do you want to stablish a secure web channel ssl/tls(contento encrypted)? Or also identfy clients with certificate? — pedrofb, Jun 02 '16 at 16:30
I want to establish a secure connection (sorry for the confusion). — Mohamed Ennahdi El Idrissi, Jun 02 '16 at 16:47
Therefore you do not need a client certificate. This is simple http://www.mkyong.com/tomcat/how-to-configure-tomcat-to-support-ssl-or-https/ If you want a 'green bar' I suggest buy an SSL certificate instead of generating one — pedrofb, Jun 02 '16 at 16:55
It is not necessary. http://stackoverflow.com/questions/7790141/is-security-constraint-configuration-for-tomcat-mandatory — pedrofb, Jun 02 '16 at 17:25
Disable the http connector, usually on port 8080. Then, only the https connector will be reachable — pedrofb, Jun 02 '16 at 18:05

score 1 · Answer 1 · edited May 23 '17 at 12:15

[Response from comments]

To stablish a secure connection you do not need a client certificate. Here you are a simple tutorial http://www.mkyong.com/tomcat/how-to-configure-tomcat-to-support-ssl-or-https/

If you want a 'green bar' I suggest buy an SSL certificate instead of generating one

Tomcat tag in web.xml is not needed. See Is security-constraint configuration for Tomcat mandatory?

<transport-guarantee>CONFIDENTIAL</transport-guarantee>

To force HTTPS disable the http connector, usually on port 8080. Then, only the https connector will be reachable

Web Application under Tomcat with SSL

1 Answers1