Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-04 Thread Mark Thomas
On 05/02/2018 02:14, Indunil Rathnayake wrote: Hi, On 2 February 2018 at 19:55, Christopher Schultz < ch...@christopherschultz.net> wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 2/2/18 5:35 AM, Mark Thomas wrote: On 02/02/18 04:06, Christopher Schultz wrote: It seems r

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-04 Thread Indunil Rathnayake
Hi, On 2 February 2018 at 19:55, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Mark, > > On 2/2/18 5:35 AM, Mark Thomas wrote: > > On 02/02/18 04:06, Christopher Schultz wrote: > > > > > > > >> It seems reasonable for Tomcat to

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-02 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 2/2/18 5:35 AM, Mark Thomas wrote: > On 02/02/18 04:06, Christopher Schultz wrote: > > > >> It seems reasonable for Tomcat to verify that any "critical" >> key-use extensions are respected, and perhaps even some >> non-critical ones. >

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-02 Thread Indunil Rathnayake
Hi Chris, On 2 February 2018 at 09:36, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Indunil, > > On 2/1/18 7:33 AM, Indunil Rathnayake wrote: > > I have configured a tomcat connector for handling requests for a > > particul

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-02 Thread Mark Thomas
On 02/02/18 04:06, Christopher Schultz wrote: > It seems reasonable for Tomcat to verify that any "critical" key-use > extensions are respected, and perhaps even some non-critical ones. I'd assume that JSSE / OpenSSl do this automatically. Is there any evidence that they do not? Mark

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-01 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Indunil, On 2/1/18 7:33 AM, Indunil Rathnayake wrote: > I have configured a tomcat connector for handling requests for a > particular servlet and have configured a trust store for the > connector. Anyone knows whether tomcat handles validation of "K

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-01 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Indunil, On 2/1/18 6:15 PM, Indunil Rathnayake wrote: > Adding Chris There's no need to specifically CC list members. - -chris > On 1 February 2018 at 18:03, Indunil Rathnayake > wrote: > >> Hi, >> >> I have configured a tomcat connector for h

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-01 Thread Indunil Rathnayake
Adding Chris On 1 February 2018 at 18:03, Indunil Rathnayake wrote: > Hi, > > I have configured a tomcat connector for handling requests for a > particular servlet and have configured a trust store for the connector. > Anyone knows whether tomcat handles validation of "Key Usage" and "Extended >

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-01 Thread Indunil Rathnayake
Hi Chris, On 1 February 2018 at 20:25, Christopher Schultz < ch...@christopherschultz.net> wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > Indunil, > > On 2/1/18 7:29 AM, Indunil Rathnayake wrote: > > I have configured a tomcat connector for handling requests for a > > particular s

Re: Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-01 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Indunil, On 2/1/18 7:29 AM, Indunil Rathnayake wrote: > I have configured a tomcat connector for handling requests for a > particular servlet and have configured a trust store for the > connector. Anyone knows whether tomcat handles validation of "K

Mutual SSL client certificate validation(Key Usage and Extended Key Usage) in tomcat server

2018-02-01 Thread Indunil Rathnayake
Hi, I have configured a tomcat connector for handling requests for a particular servlet and have configured a trust store for the connector. Anyone knows whether tomcat handles validation of "Key Usage" and "Extended Key Usage" extensions in client certificates? And how it's handled through tomcat