Servlet and JSP containers are not required to support SSL, even in fully J2EE-com- pliant application servers or with version 2.4 of the servlet specification. There are servlet containers that don’t support SSL and function as a plug-in to the Web server.
Even if the communication between the client and the Web server is encrypted, the communication between the Web server and the servlet container might not be.
Thus, if you declare that some URLs in your application must use SSL, you would
not be able to deploy your application on such a server. Therefore, Web applications that rely on SSL are not necessarily portable.
Nevertheless, SSL is extremely useful, and many applications make use of it. For example, many application servers are self-contained; they do not have a servlet/JSP plug-in that is separate from the main Web server. In addition, some server plug-ins use SSL even for the communication between the Web server and the plug-in. The BEA WebLogic plug-in and IBM WebSphere support this very useful capability, for example.
In Tomcat, the support for SSL is present, but disabled by default. This section summarizes the steps necessary to enable the SSL support in Tomcat. For more details, see http://jakarta.apache.org/tomcat/tomcat-5.0-doc/ssl-howto.html.
1. Create a self-signed public key certificate. SSL-based servers use X.509 certificates to validate to clients that they (i.e., the servers) are who they claim to be. This prevents attackers from hacking Domain Name System (DNS) servers to redirect SSL requests to their site.
For real-world use, the certificate needs to be signed by a trusted authority like VeriSign or Thawte. For testing purposes, however, a self-signed certificate is sufficient. To generate one that will be valid for two years (730 days), execute the following:
keytool -genkey -alias tomcat -keyalg RSA -validity 730 The system will prompt you for a variety of information starting with your first and last name. For a server certificate, this should be the server’s name, not your name! For example, with a server that will be accessed from multiple machines, respond with the hostname (www.yourcompany.com) or the Internet Protocol (IP) address (207.46.230.220) when asked “What is your first and last name?” For a development server that will run on your desktop, use localhost.
Remember that, for deployment purposes, self-signed certificates are not sufficient. You would need to get your certificate signed by a trusted Certificate Authority. You can use certificates from keytool for this purpose also; it just requires a lot more work. For testing pur- poses, however, self-signed certificates are just as good as trusted ones.
Core Approach
Supply the server’s hostname or IP address when asked for your first and last name. Use localhost for a desktop development server.
The system will also prompt you for your organization, your location, a keystore password, and a key password. Be sure to use the same value for both passwords. The system will then create a file called
.keystore in your home directory (e.g., /home/username on UNIX or
C:\Documents and Settings\username on Windows XP). You can also use the -keystore argument to change where this file is created.
For more details on keytool (including information on creating trusted certificates that are signed by a standard Certificate Author- ity), see http://java.sun.com/j2se/1.5.0/docs/tooldocs/windows/key- tool.html.
2. Copy the keystore file to the Tomcat installation directory.
Copy the .keystore file just created from your home directory to
tomcat_dir.
3. Uncomment and edit the SSL connector entry in tomcat_dir/
conf/server.xml. Look for a commented-out Connector element that has the port attribute set to 8443. Remove the enclosing com- ment tags (<!--...-->). Change the port from 8443 to the default SSL value of 443. Add a keystoreFile attribute designating the location and name of the keystore file relative to the tomcat_dir
installation directory. Add a keystorePass attribute designating the password (used when you created the .keystore file). Here is an example:
<Connector port="443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25"
maxSpareThreads="75" enableLookups="false"
disableUploadTimeout="true" acceptCount="100"
scheme="https" secure="true" clientAuth="false"
sslProtocol="TLS" keystoreFile=".keystore"
keystorePass="mypassword"/>
4. Change the main connector entry in tomcat_dir/conf/
server.xml to use port 443 for SSL redirects. Use the redirectPort attribute to specify this. Here is an example:
<Connector port="80" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25"
maxSpareThreads="75" enableLookups="false"
redirectPort="443" acceptCount="100"
connectionTimeout="20000"
disableUploadTimeout="true"/>
5. Restart the server.
6. Access https://localhost/. (Note that this URL starts with https, not http.) With Firefox, you should see an initial warning like that of Figure 3–20. If you click the Examine Certificate button, you should see a dialog box like the one shown in Figure 3–21. You can suppress the warnings on Firefox by choosing the “Accept this cer- tificate permanently” option in the original warning dialog box.
Once you have accepted the certificate, you should see the Tomcat home page (Figure 3–22). With Internet Explorer, you will see an initial warning like that shown in Figure 3–23. To view the certifi- cate information, click the View Certificate button. You should see something close to Figure 3–24. For future requests, you can sup- press the warnings by clicking the Install Certificate button and importing the certificate (Figures 3–25 through 3–29). The next time you access http://localhost/, you should see the Tomcat home page without any warnings as in Figure 3–30.
Figure 3–20 Certificate warning dialog box supplied by Firefox. You can view the certificate information by clicking Examine Certificate.
Figure 3–21 Certificate information presented on Firefox.
Figure 3–22 After the certificate has been accepted, accessing Tomcat’s home page with HTTPS does not produce any warnings (Firefox shown).
Figure 3–23 Certificate warning dialog box supplied by Internet Explorer. You can view the certificate information by clicking View Certificate.
Figure 3–24 Certificate information presented by Internet Explorer. View different types of certificate information by clicking the General, Details, and Certification Path tabs at the top of this dialog box. To suppress future warnings, you can import the certificate by clicking the Install Certificate button and starting the Certificate Import Wizard shown in Figure 3–25.
Figure 3–25 First screen of the Certificate Import Wizard in Internet Explorer.
Figure 3–26 Second screen of the Certificate Import Wizard in Internet Explorer. You can let Internet Explorer place the certificate in its default certificate store or choose your own.
Figure 3–27 Third screen of the Certificate Import Wizard in Internet Explorer.
Figure 3–28 Warning dialog box in Internet Explorer making sure you understand that once the certificate is imported, Windows will no longer pop up a warning dialog box, automatically trusting this certificate.
Figure 3–29 Internet Explorer Certificate Import Wizard success dialog box.
Figure 3–30 After the certificate has been accepted, accessing Tomcat’s home page with HTTPS does not produce any warnings (Internet Explorer shown).