Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I try to evaluate a infrastructure for a customer on my local win32 machine. The infrastructure should be based on a j2ee webapp running on a tomcat (6.0.20+), behind a secur apache httpd (httpd-2.2.16/openssl-0.9.8) which only forwards those requests which are authorized (with a client certificate).

My approach was to solve the connection between tomcat and apache with the mod_jk and the corresponding ajp13 protocol. The tomcat (ajp13) is running on port 8099, i configured the workers.properties and my mod_jk.conf (and included it in httpd.conf). The connection works successful. The httpd is running on port 80 the tomcat runs his http port under 8084. When sending a http request to http://localhost/my-webapp-context. The tomcats answers and showing up my webapp.

So far there are the following configuration files:

mod_jk.conf

LoadModule    jk_module  modules/mod_jk.so
#LoadModule    ssl_module  modules/mod_ssl.so

JkWorkersFile conf/workers.properties
JkShmFile     logs/httpd/mod_jk.shm
JkLogLevel    info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "

JkMount /* balancer

workers.properties

worker.list=jk-status
worker.jk-status.type=status
worker.jk-status.read_only=true
worker.list=jk-manager
worker.jk-manager.type=status
worker.list=balancer
worker.balancer.type=lb
worker.balancer.error_escalation_time=0
worker.balancer.max_reply_timeouts=10
worker.balancer.balance_workers=node1
worker.node1.reference=worker.template
worker.node1.host=localhost
worker.node1.port=8109
worker.node1.activation=A
worker.balancer.balance_workers=node2
worker.node2.reference=worker.template
worker.node2.host=localhost
worker.node2.port=8099
worker.node2.activation=A
worker.template.type=ajp13
worker.template.socket_connect_timeout=5000
worker.template.socket_keepalive=true
worker.template.ping_mode=A
worker.template.ping_timeout=10000
worker.template.connection_pool_minsize=0
worker.template.connection_pool_timeout=600
worker.template.reply_timeout=300000
worker.template.recovery_options=3

As described this works like a charm, now i read to several ssl tutorials. I already created a server.key (without private key because this seems to fail at win32 platform) and a server.cer which is certified by our local certification authority.

When it comes to the point of enabling mod_ssl i get several errors. I tried the following configuration:

<VirtualHost *:443>
  SSLEngine On
  SSLCertificateFile conf/server.cer
  SSLCertificateKeyFile conf/server.key
</VirtualHost>

With this configuration I produce the upcoming error (where the CN is my computer name in the lan), this is also the value i provided while generating the certification. The apache refuses to startup with this configuration and shows me the listed error.

Update

Now I finally get the apache with ssl and client certificates running:

mod_jk_ssl.conf

LoadModule    jk_module  modules/mod_jk.so
LoadModule    ssl_module  modules/mod_ssl.so

JkWorkersFile conf/workers.properties
JkShmFile     logs/httpd/mod_jk.shm
JkLogLevel    info
JkLogStampFormat "[%a %b %d %H:%M:%S %Y] "

Listen 443

<VirtualHost *:443>
 JkMount /* balancer

 SSLEngine On
 SSLCertificateFile conf/web.crt
 SSLCertificateKeyFile conf/web.key
 SSLCACertificateFile conf/exampleCA.crt
 SSLVerifyClient require
 SSLVerifyDepth 2

 <IfDefine SSL>
     SSLRequireSSL
     SSLRequire           %{SSL_CLIENT_S_DN_O}  eq "certification-authority" and  
     %{SSL_CLIENT_S_DN_OU} in {"BALVI"}
 </IfDefine>
</VirtualHost>
share|improve this question
    
Have u tried accessing your app as "computer-name/my-webapp-context";. –  techiepark Aug 27 '10 at 7:51

2 Answers 2

up vote 2 down vote accepted

Captain Obvious here. You did give the my-computer-name exactly as it is, including the domain name? If not, re-create the key one more time.

share|improve this answer
    
This finally lead me to rethink the certification, i missed several points which are very well explained here: garex.net/apache/#CACreate Thank you anyway. –  codedevour Aug 27 '10 at 12:24

You can always add a redirect to apache to take you straight to your webapp

RedirectMatch ^/(.)/$ http://host.domain.com/your-webapp-context/?

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.