Deploying war file with apache ssl certificate

[protik ahmed]

Hi, I recently created a keystore with the keytool and stored it in my <user>/ directory as default.

When it gets to the point to deplying the site using a WAR file, and transferring it onto another machine. Is it possible to include that keystore file? And if so, what is the process of getting it to work on another machine

[Tim Holloway]

You can't assign a certificate to a WAR. Certs are applied to the server as a whole, not an individual webapp or even virtual host (which can be a real pain).

Thus, you have to create a discrete certificate file for the server machine that it will be deployed on (since certs both aid in encryption and certify that you're really talking to the indicated host machine).

I'm afraid that SSL configuration is not considered as part of the J2EE spec, so there's no J2EE support for that. You have to do it manually. Or, failing that, do what I do and make an OS installer package for the cert and its containing keystore (MSI, RPM, deb, pkg or whatever, depending on the OS).

[Ned Ryerson]

Well before you config tomcat, you need to bundle the cert & key into the keystore:

openssl pkcs12 -export -chain -CAfile gd_bundle.crt -in NAMEOFCERT.crt  -inkey NAMEOFKEY.key -out keystore.tomcat -name tomcat -passout pass:TOMCATPASS

of course tomcat password is changeit by default.

then in conf/server.xml

    <!-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->

    <Connector port="8443" maxThreads="200" scheme="https" secure="true" SSLEnabled="true" keystoreType="PKCS12" keystoreFile="PATH/TO/keystore.tomcat" keystorePass="changeit" clientAuth="false" sslProtocol="TLS"/>

then you can force your app to run only in ssl by adding this to web.xml within your app:

<security-constraint>
<web-resource-collection>
<web-resource-name>securedapp</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>