I would like to setup Client Certificate Auth with my tomcat. I've configured the webapp for this auth and this is my tomcat config. I'm using Windows PKI for my certificates so I have pfx files. The keystore with my pfx for ssl works fine. I can access with port 443 when I disable clientauth.

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true" clientAuth="true" sslProtocol="TLS" keystoreFile="D:\SSL\Keystore\.keystore" keystorePass="Pass" maxHttpHeaderSize="65536"/>  

This webapp also has a mobile app. I've installed a pfx certificate on my IOS device and tried to connect. In Wireshark I can see

Client Hello
Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done
Client Key Exchange
Encrypted Handshake Massage

For the Client Key Exchange Handshake Protocol Diffie-Hellman is used.

Diffie-Hellman Client Params
Pubkey Length: 96
Pubkey: 3e11d540564377e996b0f7d13de11838ccc7f0d00f918592...

When I access the webapp via browser, I get to the point where I can choose a certificate, but it's not showing me the certificate that I want to use.

Client Hello
Server Hello, Certificate, Server Key Exchange, Certificate Request, Server Hello Done
Certificate, Client Key Exchange, Certificate Verify, Change Cipher Spec, Encrypted Handshake Massage
Encrypted Handshake Massage

So it looks like I don't have the correct certificate or the web app is not configured correctly. I just want to make sure I'm not missing something in my tomcat config.

migrated from security.stackexchange.com Dec 1 '14 at 17:40

This question came from our site for information security professionals.

  • This is a tomcat-specific config question. You'll have better luck on ServerFault. – schroeder Dec 1 '14 at 17:40

This may be pretty rudimentary, basic stuff, but I have missed the simple stuff too many times.

Presuming your web-client is running inside Windows and is a web-client that understands Windows CAPI, you would want the user-certificate to reside in CAPI --> Current User --> Personal --> Certificates, and must have Extended Key Usage "clientAuth". In this case, it will be presented by the certificate selector in IE and Chrome.

Firefox does its own thing (I believe this is to be cross-OS consistent), which is the NSS subsystem and file-format. As far as I know, the certificate can only be ingested into NSS via the Firefox browser GUI in Options --> Advanced --> Encryption --> View Certificates. Again, the certificate must have sensible EKU and constraints.

  • I tried with Chrome so i installed my test certificate in User Personal Store. When i open the site i get a certificate to choose but it's an SAP Portal certificate, i tried to rebuild this but somehow i doesn't make sense, Enhanced Key Usage is "Any Purpose" and key Usage is "Digital Signature,Allowed, Key Encipherment, Data Encipherment (f0)" It doesn't have clientAuth for Key Usage – Sinista Dec 1 '14 at 13:32
  • @Sinista can you please try with IE, just to see if it is doing sensible things? Are you running the browser as the user into whose personal store you installed the PKCS#12 bundle? Did you check via the MMC that it shows the certificate and PrKey tied together? – DTK Dec 1 '14 at 19:57
  • If all EKU are allowed, client auth should be implied. – DTK Dec 1 '14 at 19:58
  • IE gives me an error message from my webapp, i don't get to choose a certificate so i guess ie chooses for me and is trying to login with my sap portal certificate that i can see in chrome. I was testing with my normal user and installed the pfx files into my User personal store, i have around 7 client certs in there so i don't understand why the app only recognize one that isn't even with client auth purpose. I also logged in as my webapp test user and because i don't have the sap cert in there only my test certificates i get an ERR_BAD_SSL_ClIENT_AUTH_CERT – Sinista Dec 2 '14 at 13:13
  • @Sinista Out of curiosity, is there a chance you are running the browser as a user account other than yourself, or even possibly as "System" ? – DTK Dec 3 '14 at 2:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.