2

I have Tomcat7 running on RHEL6 with mutual authentication using x509 certificates for the entire container.

From the user point of view in the browser, everything seems to work fine with a cert challenge. This is on an intranet with a proxy.

My goal is have the user x509 cert dn written out to the AccessLogValve logs.

Following this post I have modified the AccessLogValve pattern (in server.xml) to include:

%{javax.servlet.request.X509Certificate}r

However what is written to the logs are strings like this:

[Ljava.security.cert.X509Certicate;@4737f9e8

My concern is that the cert-related headers are being dropped, so I have also enabled the RequestDumperFilter in web.xml to look for clues in the headers. In those logs I don't see anything cert-related other than possibly:

remoteUser=null 
isSecure=true 
=============
authType=null
1
  • Have you figured out how to do this without creating a cutom valve?
    – Ebsan
    May 23, 2017 at 1:34

0

You must log in to answer this question.

Browse other questions tagged .