On 30/07/17 21:35, Martynas Jusevičius wrote: > Hey list, > > I need my webapp to accept all SSL client certificates and do its own > validation. > > I'm upgrading server.xml from the JSSE SSL Connector which used > clientAuth="want" and a custom trustManagerClassName in order to do that. > > The 8.5.16 docs indicate that this should be replaced with SSLHostConfig > certificateVerification="optionalNoCA". I have done, and also using OpenSSL > implementation now: > > <Connector port="8443" > protocol="org.apache.coyote.http11.Http11AprProtocol" > maxThreads="150" SSLEnabled="true" > > <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" > /> > <SSLHostConfig certificateVerification="optionalNoCA"> > <Certificate certificateKeyFile="/usr/local/ssl/tomcat.key.pem" > certificateFile="/usr/local/ssl/tomcat.cert.pem" > type="RSA" /> > </SSLHostConfig> > </Connector> > > However, I'm getting an exception that shows my client certificate is > validated and rejected by Tomcat/OpenSSL: > > tomcat_1 | https-openssl-apr-8443-exec-3, handling > exception: javax.net.ssl.SSLHandshakeException: > sun.security.validator.ValidatorException: PKIX path building failed: > sun.security.provider.certpath.SunCertPathBuilderException: unable to find > valid certification path to requested target > tomcat_1 | https-openssl-apr-8443-exec-3, > IOException in getSession(): javax.net.ssl.SSLHandshakeException: > sun.security.validator.ValidatorException: PKIX path building failed: > sun.security.provider.certpath.SunCertPathBuilderException: unable to find > valid certification path to requested target > tomcat_1 | https-openssl-apr-8443-exec-3, called > close() > tomcat_1 | https-openssl-apr-8443-exec-3, called > closeInternal(true) > > Am I missing something? certificateVerification="optional" exhibits the > same behaviour.
How is your tomcat-native binary built? If it has been built with OCSP support then neither of the optional verification options will work since OCSP validation will always fail. Mark --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
