3

I distribute a Java desktop application that needs to communicate with some RESTful APIs served by embedded Tomcat within a Spring Boot webapp.

I was planning on using a self-signed certificate for communication between the desktop and the server. But if I later want to expose some public web pages needing encryption I believe I will need a commercial certificate for that.

Is it possible to use multiple certificates in Tomcat? If so, how does the server distinguish which requests are encrypted by which certificate?

1
  • Your accepted answer is FALSE, google for "Server Name Indication"!
    – peterh
    Mar 28, 2015 at 6:03

1 Answer 1

2

The protocol itself does not allow you to host two SSL certificates on the same port on the same IP.

From the Tomcat SSL Configuration HOW-TO:

Using name-based virtual hosts on a secured connection can be problematic. This is a design limitation of the SSL protocol itself. The SSL handshake, where the client browser accepts the server certificate, must occur before the HTTP request is accessed. As a result, the request information containing the virtual host name cannot be determined prior to authentication, and it is therefore not possible to assign multiple certificates to a single IP address.

An email to the Tomcat Users List states that you can do this with "a Connector and associated keystore per IP (or IP/port) you want to secure."

This will let you serve on separate ports (e.g. 0.0.0.0:443 publicly and 0.0.0.0:4443 for your API) and/or addresses (e.g. 192.0.2.1:443 publicly and 192.0.2.2:443 for your API).


It is theoretically possible to make this distinction on a per-interface or per-CIDR level before the SSL handshake (e.g. traffic from 192.168.0.1/16 gets one cert, other traffic gets the other cert), but I don't know of any single piece of software that does this; you'd need to use port forwarding via your firewall.

To do this with simple port forwarding: Forward connections from your internal infrastructure on port 443 to local port 4443 and serve your internal SSL cert on port 4443 within Tomcat.

Note: I've never heard of this being done.

3
  • 1
    Not true! See "Server Name Indication"!
    – peterh
    Mar 28, 2015 at 6:01
  • 1
    @peterh: Nice, I didn't know Server Name Indication had ever matured. You are correct: SNI allows a TLS connection to negotiate certificates after identification. Still, Tomcat does not support SNI.
    – Adam Katz
    Mar 28, 2015 at 6:23
  • You have right - it would need a hybride solution (apache proxyes to tomcat by mod_ajk).
    – peterh
    Apr 3, 2015 at 3:01

You must log in to answer this question.