Tomcat/Spring SSL configuration

Question

I'm trying to configure my Spring application to use an SSL certificate I purchased from a CA. I followed the directions for the Tomcat 6.0 configuration and have imported the key into my Tomcat keystore and uncommented the SSL connector in the server.xml. When I start Tomcat, I see the connector start on port 8443 in the Tomcat logs, but when I go to https ://example.com:8443 or http: //example.com:8443 or https: //example.com (without the spaces - I don't have the reputation to post links), it times out. What other configuration do I need to do to enable SSL for my Spring application. Do I have to change the application configuration?

I'd also like to only have some URLs over SSL (login, edit profile, etc.). How can I allow this in the Spring configuration? If I have to have all URLs accessible over SSL, that would be ok, but not desirable. I haven't found any tutorials that are Spring specific.

Answer 1

There are two things that need to be in the Tomcat keystore: 1. The private key and the public key pair that was generated (usually generated by the keytool -genkeypair command). 2. The certificate signing the public key (imported from the CA's reply using the keytool -importcert command).

Assuming that the above two are correct, you might want to figure out more details on why the connection is timing out. Is the SSL/TLS-enabled port accessible at example.com:8443 or is it listening on a different network interface? Moreover, are all the attributes specified for the Connector correct (the Tomcat logs would provide a hint or two)? Finally, you might want to use the javax.net.debug flag when starting the JVM to determine if there are any other reasons for the connection timeout.

Answer 2

Wouldn't you do the URI-specific SSL configuration using standard security constraints in your web.xml file?