Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to perform web service calls from within my own web server running on Apache/Tomcat. Apache/Tomcat running on Linux needs to make calls out to a Microsoft server running IIS over HTTPS that uses an internal Certificate Authority (CA) for SSL.

How do I get Apache/Tomcat to trust the proper root certificate from this CA?

Also, how do I test that this trust is working? I assume a browser request from the server hosting Apache/Tomcat is insufficient.

share|improve this question
add comment

2 Answers

up vote 1 down vote accepted

I assume that you have already exported the CA certificate to a file, such as "internal-ca.pem". Also, I assume that it is Tomcat who initiates the SSL connection to the IIS server.

You can must use the Java keytool to import the certificate into the Java keystore that is being used by your Tomcat engine. The keystore for CA certs is $JAVA_HOME/jre/lib/security/cacerts. So to import your new internal-ca.pem certificate into this keystore, you would use:

$JAVA_HOME/bin/keytool -importcert \
  -keystore $JAVA_HOME/jre/lib/security/cacerts \
  -file /path/to/internal-ca.pem  \
  -trustcacerts -alias internal-ca-1

The default password for the keystore is: changeit

Verify that your cert is in the keystore:

$JAVA_HOME/bin/keytool -list \
  -keystore $JAVA_HOME/jre/lib/security/cacerts -v | less

Test the connection to the server:

openssl s_client -CAfile /path/to/internal-ca.pem -connect server:port

This should give you, near the end of its output:

Verify return code: 0 (ok)

If you want to test the trust from within Tomcat, you will have to write some test code to do it. Sorry, I don't know any Java. :-)

share|improve this answer
    
Great details - thanks! –  Kirk Liemohn Nov 15 '10 at 13:04
add comment
SSLProxyEngine on
SSLProxyCACertificateFile /etc/ssl/internal-ca.crt
SSLProxyVerify require
share|improve this answer
    
Wait, my solution is for Apache HTTPD, did you mean Apache Tomcat, or Apache HTTPD OR/AND Tomcat? –  ptman Nov 11 '10 at 15:39
    
Thanks for the details. Unfortunately, I suspect that it will vary from client to client since this is a product that can be set up in various ways. My question may have been misleading as my expertise is on the Microsoft/IIS side and not on the Apache/Tomcat (esp. when on Linux as is the case here). Would you be able to enumerate the options (maybe you already have)? Of course giving answers for each would be very helpful. Also, are you saying that the "SSLProxyVerify require" is a verification step? –  Kirk Liemohn Nov 11 '10 at 17:09
    
It's part of my configuration. Makes problems with the certificate a hard failure instead of a soft one. httpd.apache.org/docs/2.2/mod/mod_ssl.html –  ptman Nov 11 '10 at 17:23
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.