0

I have a website (http://app4u.ml/, that resides in Ubuntu) with Tomcat installed on it. Via HTTP, everything works great. I tried adding to the site HTTPS. I downloaded a self-signed certificate from http://www.selfsignedcertificate.com/ and put the '.cert' and '.key' in the server in /etc/ssl/localcerts and '.crt' file in /usr/share/ca-certificates/mozilla.

Then, I ran on Putty:

openssl req -new -x509 -sha256 -days 365 -nodes -out /etc/ssl/localcerts/app4u.ml.crt -keyout /etc/ssl/localcerts/app4u.ml.key
chmod 600 /etc/ssl/localcerts/app4u.ml*

Then, I added to the 2 files in /etc/apache2/sites-available the values of:

<VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile /etc/ssl/localcerts/app4u.ml.cert
    SSLCertificateKeyFile /etc/ssl/localcerts/app4u.ml.key
    ServerAdmin info@app4u.ml
    ServerName app4u.ml
    DocumentRoot /var/www/html/public_html/
    ErrorLog /var/www/html/log/error.log
    CustomLog /var/www/html/log/access.log combined
</VirtualHost>

and ran: sudo a2enmod ssl and then service apache2 restart. This made trying to get the site in HTTPS throw a warning in chrome. If I tried to continue, I saw an empty folder list (but it had values in it if I tried to go to it in plain HTTP). Also, trying to contact the Tomcat on the server throws

javax.net.ssl.SSLHandshakeException: Handshake failed

What have I done wrong? What is missing?

EDIT2: Further problems - Now my tomcat work for GET requests, but not POST. For POST requests I get javax.net.ssl.SSLHandshakeException: Handshake failed. Why?

  • 1
    Self-signed certificates cannot be verified by a trusted third-party. That is where the issue lies. – Rob Aug 26 '16 at 12:36
  • I tried deleting the .crt file from /usr/share/ca-certificates/mozilla, but still have problems. What should I do? – Ran Aug 26 '16 at 12:46
  • 3
    Purchase a proper trusted SSL cert. – DanBig Aug 26 '16 at 13:01
  • 2
    Don't use self-signed certificates for public websites. Have a look at let's encrypt: letsencrypt.org To set it up with apache have a look at CertBot: letsencrypt.readthedocs.io/en/latest/index.html – Gino Aug 26 '16 at 13:05
  • Cacerts is also a good place to have a look (i don't work for them) – bgtvfr Aug 26 '16 at 13:07
0

You need to instruct Apache to forward (proxy) requests to Tomcat. The documentation is pretty complete but the following should get you in the right direction (it's not totally possible to give you cut&paste directions since it depends on exactly what you want and what you have):

Run this:

a2enmod proxy
a2enmod proxy_http

And put that in your config:

<VirtualHost *:443>
    SSLEngine On
    SSLCertificateFile /etc/ssl/localcerts/app4u.ml.cert
    SSLCertificateKeyFile /etc/ssl/localcerts/app4u.ml.key
    ServerAdmin info@app4u.ml
    ServerName app4u.ml

    SSLProxyEngine on
    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/

    ErrorLog /var/www/html/log/error.log
    CustomLog /var/www/html/log/access.log combined
</VirtualHost>
  • I have 2 files in /etc/apache2/sites-available. Should I put it in both of them? What is a command and what should be in the file? – Ran Aug 27 '16 at 5:36
  • You have to put it in the appropriate file and you have to make sure the site is enabled - a2ensite xyz. Sorry, I don't have your server in front of me so can't give copy/paste commands, you have to have some understanding of Apache to configure and run it. – ETL Aug 27 '16 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.