Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a 3 Tomcat application servers with 3 Apache servers in front. Communication between Apache and Tomcats is done via mod_jk. I need to have secure connections between the Tomcat and Apache servers. To make this connection secured, it has to be encrypted and authenticated (to prevent man in the middle attacks).

To be clear, I am not trying to authenticate clients. Only to make sure that traffic between Tomcat and Apache cannot be sniffed.

I've been looking around, but I cant find a way to have mod_jk authenticate the certificates exposed by Tomcat. Any idea where I should be looking ?

Thanks for your help !

share|improve this question
    
AJP connections are not encrypted. Are you looking to authenticate the Tomcat servers to verify their identity, or the clients connecting to Apache? –  Shane Madden Jun 7 '11 at 14:54
    
I am trying to authenticate the Tomcat servers. I'll update the question. –  Guillaume Jun 8 '11 at 8:31
    
Unfortunately, I don't think server authentication is possible via an AJP connector. You may be forced to switch to HTTPS if that's a requirement. –  Shane Madden Jun 8 '11 at 14:45
    
You should post your comment as an answer, I'll accept it ... –  Guillaume Jun 9 '11 at 14:38

1 Answer 1

up vote 1 down vote accepted

Unfortunately, I don't think server authentication is possible via an AJP connector.

While client certificates can be communicated to the Tomcat server via SSLOptions +ExportCertData, the AJP connection itself is in the clear and has no means of authenticating either the AJP client (Apache) or the AJP server (Tomcat) in either direction.

You may be forced to switch to HTTPS if server authentication is required. If there's a reason that AJP is needed, there are options adding extra security layers outside of the AJP protocol for doing mutual authentication and connection security; SSH port forwarding or IPsec policies come to mind.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.