-BEGIN PGP SIGNED MESSAGE-
Hash: SHA1
Andrey,
On 2/16/2010 7:46 AM, Andrey D wrote:
Sorry, but I can't use apache httpd separately... only tomcat.. :(
someone said me:
ok, I think the solution is this
create a CA ... then, import the CA public key into key-store
sign each client certificate with CA private key ..
I believe this will mean that when Tomcat requests client certificate, it
can be checked against the CA public key in keystore ...
have a look at this ..
what do you think about it?
This sounds reasonable: basically, instead of creating many trusted
certificates, you create a single trusted certificate, then use that to
sign the client certificates. Tomcat trusts the signing certificate and
therefore, implicitly, all the client certificates signed with that
top-level one.
and if it helps... how to do it
Heh... it gets to be a bit of a pain in the neck.
For starters, read the thread titled mod_jk Client SSL Certificates
from the archives back in October. Specifically, this message:
http://tomcat.markmail.org/message/kzxsamuiu6bldjmv?q=%22mod_jk+%26+Client+SSL+Certificates%22+list:org.apache.tomcat.users
You can ignore most of the Apache httpd-related stuff, but I did end up
creating the key stores in OpenSSL format, so you'll have to
read-through the certificate creation process in order to get a
top-level certificate that you can actually use with my code.
Or, you could follow the client certificate instructions on Tomcat's
website (I found the lack of documentation for using Client SSL
certificates a little frustrating, but I ended up doing most of my work
with OpenSSL, etc., and not Tomcat so I don't really have any better
instructions than what's already on the Tomcat site).
Good luck,
- -chris
-BEGIN PGP SIGNATURE-
Version: GnuPG v1.4.10 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAkt7DpEACgkQ9CaO5/Lv0PAKWgCffenUPfvSfPeL8EuPIGxx2FiX
1/wAoI4wNFQ5RhBzJKmbOEiNQ2m2yIzb
=5Rrp
-END PGP SIGNATURE-
-
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
