Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on a very specific apache+mod_ssl+mod_jk+tomcat

So far, a basic configuration works as I want: accessing my webapps behind all that stuff works great. I am using a wildcard certificate for the frontend (thus, apache). the connection is something like:

[apache] <-> [mod_JK] <-> [tomcat]

apache: 2.2.17

Tomcat: 7.0.12

JK_mod version: 1.2.31

Note: for the time being I only have 1 tomcat running, but I may need to add others using the load balancer in mod_jk.

ok, now the funny part. I need to use client certificates to protect my webapps. for instance, providing the "client certificate 1" to "user 1" in order to access "webapp1" should be allowed but not any other webapps. This goes the same for "user 2": accessing webapp2 with his own client certificate (client certificate 2), and so on.

In order to be more flexible (there are some java code in the webapp as well, so it was ideal), I've decided to let Tomcat handling client certificates, not Apache. But there is a tricky aspect of it: for web-browsing (with an internet browser, like Firefox, IE, ...) the wildcard certificate should be used (this certificate was generated, signed by verisign and then importer in the apache conf); BUT for application data upload(these are webapps features), a client certificate (see above) is requested to allow only a very limited access.

I know it may sound stupid, but that's what I was asked for...

I have ended to 2 different configurations:

1) Using apache on port 443 with wildcard certificate and Tomcat on port 8443 - SSL

With a webbrowser, I can view my apps fine through apache via mod_jk. Data upload is performed through Tomcat SSL port. this could be alright, but I may need later on to run multiple instance of Tomcat, so I am not sure how it will behave. But this could be a solution. This is the most relevant configuration I have, so far

2) Using apache on port 443 with tomcat on regular 8080 port

I am able to query my keystore to retrieve any client certificate. The problem is that I can no longer use my wildcard certificate and client certificate is needed to access my webapps in webbrowsing (which I don't want).

Next, to try to workaround it, I tried to add a virtualhost in apache to have 2 differents servername. What I wanted to have is a DNS name for webbrowsing my apps and another to data upload to my apps. but it still ask for client certificate.

So my questions are:

1) according to my prerequesites, is this feasible ?

2) Assuming it is, am I doing it right or should I consider another approach?

3) If I am doing it right, am I far away from the solution?

If needed I can provide conf files.

Using apache for doing this instead of tomcat is a possibility

many many thanks in advance (I am bumping my head for days now)

PS: I have seen the link "" but it only answer my questions partially

share|improve this question

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.