Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have an SSL certificate from GoDaddy that I would like to use with my tomcat installation. Currently it is being used by Apache HTTP server without problems.

The private key is stored in /etc/ssl/private and access is restricted. Apache HTTP server however had no problem serving the correct certificate over SSL.

When I try to point tomcat to the same private key it fails to init the secure protocol because it cannot read the private key. This is the excerpt from my server.xml. I am using APR:

<Connector SSLCertificateFile="/etc/ssl/certs/mysite.crt"
               SSLCertificateKeyFile="/etc/ssl/mysite.key"
               SSLEnabled="true" maxThreads="150" port="8443"
               protocol="HTTP/1.1" scheme="https" secure="true" sslProtocol="TLSv1" />

This generates an error. The Apache HTTP configuration looks like this and works: SSLCertificateFile /etc/ssl/certs/mysite.crt SSLCertificateKeyFile /etc/ssl/private/mysite.key

The permissions for the /etc/private directory were not changed afaik: drwx--x--- 2 root ssl-cert 4096 2011-05-01 11:50 private Inside: -rw-r--r-- 1 root root 1,7K 2011-04-30 11:00 mysite.key

Now my question is: How can I make tomcat make use of the same file? My temporary solution is to copy the key file to a publicly accessible place but I believe this is dangerous right?

Thanks

share|improve this question
    
This generates an error. - What is the error? –  Shane Madden Oct 12 '11 at 17:25
    
The exact error is: Error initializing endpoint java.lang.Exception: Unable to load certificate key /etc/ssl/private/mysite.key (error:0200100D:system library:fopen:Permission denied) –  Luksurious Oct 12 '11 at 17:34

1 Answer 1

up vote 2 down vote accepted

The ssl-cert group has traverse permissions on private, and everyone has read permissions on the key itself - so, the user that Tomcat is running as is likely not a member of the ssl-cert group.

Add the user to the group to give it read-only access to the cert:

usermod -a -G ssl-cert tomcatusername

And, although you've got the directory permissions locked down, which should cover you, you may want to change the permissions on the certificate itself to match (some services check for world-readable on private keys):

chown root:ssl-cert /etc/ssl/private/mysite.key
chmod 640 /etc/ssl/private/mysite.key
share|improve this answer
    
Thanks. That fixed it. I was confused, however, since the apache user www-data is not part of this group but was stil able to access the file. Also thanks for the hint on the key permissions! –  Luksurious Oct 12 '11 at 19:05

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.