0

I have a server where it's running Apache and Tomcat. The front end app (built in angularjs) is running in Apache, there I installed the SSL cert and it is working fine, I can access with HTTPS and the browser trust on the cert. But then this app is consuming some services from another app that is in the SAME server but it's running with Tomcat 8 (as it's an app built in Java).

The issue is that the browser (chrome) is not allowing the site in https consume services from another server (actually it's running in the same server but it's a different app) that is not using SSL. So I'm trying to use the same SSL that I'm using in Apache in Tomcat. BUt I cannot make it work. As per I was reading, I neet to add the certificate to the keystore, but when I try to do that, the cert is listed as trustedCertEntry and as per the documentation is beucause I'm not using the same alias that I used to generate the private key.... But when I create the private key I didn't use a alias, so I'm not sure how to fix this...

In Summary: One server where an app in Apache (port 80) and other app in Tomcat(port 8080) are running. In Apache the setting is ok to use SSL I generate the private key with:

openssl genrsa -out mydomain.key 2048 
openssl req -new -key mydomain.key -out mydomain.csr 

And then I tried to add the cert to the keystore with

keytool -import -keystore mydomain -alias mydomain -file [certificate file]

But it's listed as trustedCertEntry and the tomcat is not working with HTTPS in port 8080 or 8443.

What I'm missing? Can I do this with one cert? Or do I need two even if they are on the same server?

My server.xml is

<?xml version="1.0" encoding="UTF-8"?>

  http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. --> -->

<!--The connectors can use a shared executor, you can define one or more named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
    maxThreads="150" minSpareThreads="4"/>
-->


<!-- A "Connector" represents an endpoint by which requests are received
     and responses are returned. Documentation at :
     Java HTTP Connector: /docs/config/http.html
     Java AJP  Connector: /docs/config/ajp.html
     APR (HTTP/AJP) Connector: /docs/apr.html
     Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
-->
<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />
<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
           port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />
-->
<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
     This connector uses the NIO implementation. The default
     SSLImplementation will depend on the presence of the APR/native
     library and the useOpenSSL attribute of the
     AprLifecycleListener.
     Either JSSE or OpenSSL style configuration may be used regardless of
     the SSLImplementation selected. JSSE style configuration is used below.
-->

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
     This connector uses the APR/native implementation which always uses
     OpenSSL for TLS.
     Either JSSE or OpenSSL style configuration may be used. OpenSSL style
     configuration is used below.
-->

<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
           maxThreads="150" SSLEnabled="true" >
    <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
    <SSLHostConfig>
        <Certificate certificateKeyFile="conf/localhost-rsa-key.pem"
                     certificateFile="conf/localhost-rsa-cert.pem"
                     certificateChainFile="conf/localhost-rsa-chain.pem"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />


<!-- An Engine represents the entry point (within Catalina) that processes
     every request.  The Engine implementation for Tomcat stand alone
     analyzes the HTTP headers included with the request, and passes them
     on to the appropriate Host (virtual host).
     Documentation at /docs/config/engine.html -->

<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">

  <!--For clustering, please take a look at documentation at:
      /docs/cluster-howto.html  (simple how to)
      /docs/config/cluster.html (reference documentation) -->
  <!--
  <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
  -->

  <!-- Use the LockOutRealm to prevent attempts to guess user passwords
       via a brute-force attack -->
  <Realm className="org.apache.catalina.realm.LockOutRealm">
    <!-- This Realm uses the UserDatabase configured in the global JNDI
         resources under the key "UserDatabase".  Any edits
         that are performed against this UserDatabase are immediately
         available for use by the Realm.  -->
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
           resourceName="UserDatabase"/>
  </Realm>

  <Host name="localhost"  appBase="webapps"
        unpackWARs="true" autoDeploy="true">

    <!-- SingleSignOn valve, share authentication between web applications
         Documentation at: /docs/config/valve.html -->
    <!--
    <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
    -->

    <!-- Access log processes all example.
         Documentation at: /docs/config/valve.html
         Note: The pattern used is equivalent to using pattern="common" -->
    <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
           prefix="localhost_access_log" suffix=".txt"
           pattern="%h %l %u %t &quot;%r&quot; %s %b" />

  </Host>
</Engine>

1

Browsers can be a bit funny about ssl sites containing unsecure content. If you've got SSL working on Apache you could use Apache as a reverse proxy to publish the Tomcat app, either using an ajp connector or reverse proxy. That way you don't have to worry about SSL on Tomcat at all, its all taken care of on the Apache server (the connection between tomcat and apache is not secure, but that should be on a private network anyway). All the necessary docs are on from apache:

Tomcat AJP reference

Configuring the AJP connector on Apache

Or you can use a simple reverse proxy

The tomcat AJP docs aren't particularly clear - just edit the conf/server.xml file, and uncomment/include the following bit to make tomcat accept ajp requests:

<Service name="Catalina">
    <Connector port="8080" protocol="HTTP/1.1"
               connectionTimeout="20000"
               redirectPort="8443" />
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
...
  • Updating the server.xml as you mention, give me the same error: "the page at 'example.com' was loaded over HTTPS, but requested an insecure XMLHttpRequest endpoint 'example:8080/api/sponsor/list'. This request has been blocked; the content must be served over HTTPS." – Faabass Jul 17 '17 at 12:52
  • I adde the server.xml file – Faabass Jul 17 '17 at 12:54
  • Ok so is that full URL set in your code somewhere? Run it from localhost, did it still give the same hostname or does the error state local host instead? – Jim ReesPotter Jul 17 '17 at 13:29
  • So the problem isn't that your https link is being rejected for certificate not being set up correctly, its that your app is still going to example:8080 - why is this? It must be specified somewhere? – Jim ReesPotter Jul 17 '17 at 13:31
  • Finally I use the appache proxy... It was a great solution! Thanks for the help! – Faabass Jul 17 '17 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.