Win a copy of Svelte and Sapper in Action this week in the JavaScript forum!
  • Post Reply Bookmark Topic Watch Topic
  • New Topic
programming forums Java Mobile Certification Databases Caching Books Engineering Micro Controllers OS Languages Paradigms IDEs Build Tools Frameworks Application Servers Open Source This Site Careers Other all forums
this forum made possible by our volunteer staff, including ...
Marshals:
  • Campbell Ritchie
  • Ron McLeod
  • Paul Clapham
  • Bear Bibeault
  • Junilu Lacar
Sheriffs:
  • Jeanne Boyarsky
  • Tim Cooke
  • Henry Wong
Saloon Keepers:
  • Tim Moores
  • Stephan van Hulst
  • Tim Holloway
  • salvin francis
  • Frits Walraven
Bartenders:
  • Scott Selikoff
  • Piet Souris
  • Carey Brown

Read client certificate in a Servlet

 
Greenhorn
Posts: 5
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I have an app in a tomcat server, and I'm trying to read a client certificate. It's the first time I work with SSL, so probably I am doing something wrong. I don't want client validation, I just need to read the certificate content and send it to a webservice for validation and info retrieval. The problem is that I am unable to read the certificate content.

I already created a keystore and self-signed certificate for the server. The user certificate is on the browser (The user certificate is a valid one, not self-signed). The ssl connector configuration in server.xml is:



If I try to get the cipher suite : , I get the value TLS_DHE_DSS_WITH_AES_128_CBC_SHA

But when I try to read the certificates with , I just get a null value.

I have googled a little, and I read things such as that an Apache server is needed to retrieve the certificate, and then send it to Tomcat server. Is the Apache server really needed, or is Tomcat enough? In any case, what should I do to read the client certificates?


 
Ranch Hand
Posts: 220
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
The reason you get null is because the client was not authenticated. 'clientAuth = want' permits the client to connect without authentication. To require authentication, you must set 'clientAuth = true'.
 
Roberto Ruiz
Greenhorn
Posts: 5
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
If I do that, then I get an error message, because server can't validate the certificate (It does not even ask me to choose a certificate). The user certificate is 100% valid.
 
Roberto Ruiz
Greenhorn
Posts: 5
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
If I do that, then I get an error of type: ssl_error_bad_cert_alert. I am not even prompted to choose a certificate. The personal certificate is 100% valid, as I use it for official issues.
 
greg stark
Ranch Hand
Posts: 220
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
The server must send a list of trusted certificate authorities to the client. It uses the truststore file for this purpose. Look at the tomcat configuration documentation for how to do this. Make sure that at least one of the CA certificates in the server's truststore matches the issuer of your client certificate.

If, for example, your server says it trusts Verisign, the client-side gui will only prompt you to choose amongst your certificates signed by Verisign. If your server sends nothing, your client won't even bother you, it will just fail the connection.
 
Roberto Ruiz
Greenhorn
Posts: 5
  • Mark post as helpful
  • send pies
  • Quote
  • Report post to moderator
I finally made it (or almost). I found an article on how to create and install server an client certificates (I found many, but this one is the first complete)

http://oshogsb.blogspot.com/2007/07/how-to-create-custom-ca-and.html

I configured connector, so that server request a certificate:



And now I can read the certificate with this code:



The only problem now, is that I don't need authentication in the wole context. I just need tomcat to read the certificate in an specific url (Just read the certificate and be able to read it on the servlet) How can I achieve this. I found this: http://mail-archives.apache.org/mod_mbox/tomcat-users/200302.mbox/%3C62E22079089F134682AD19324A0C115F04C284@christine.alfa-ariss.com%3E but it didn't work
 
Good night. Drive safely. Here's a tiny ad for the road:
the value of filler advertising in 2020
https://coderanch.com/t/730886/filler-advertising
    Bookmark Topic Watch Topic
  • New Topic