Actually I am using Tomcat on Docker: https://hub.docker.com/_/tomcat/
I do not really know the answer to your question :/ On Sun, 30 Jul 2017 at 23.12, Mark Thomas <[email protected]> wrote: > On 30/07/17 21:35, Martynas Jusevičius wrote: > > Hey list, > > > > I need my webapp to accept all SSL client certificates and do its own > > validation. > > > > I'm upgrading server.xml from the JSSE SSL Connector which used > > clientAuth="want" and a custom trustManagerClassName in order to do that. > > > > The 8.5.16 docs indicate that this should be replaced with SSLHostConfig > > certificateVerification="optionalNoCA". I have done, and also using > OpenSSL > > implementation now: > > > > <Connector port="8443" > > protocol="org.apache.coyote.http11.Http11AprProtocol" > > maxThreads="150" SSLEnabled="true" > > > <UpgradeProtocol > className="org.apache.coyote.http2.Http2Protocol" > > /> > > <SSLHostConfig certificateVerification="optionalNoCA"> > > <Certificate > certificateKeyFile="/usr/local/ssl/tomcat.key.pem" > > certificateFile="/usr/local/ssl/tomcat.cert.pem" > > type="RSA" /> > > </SSLHostConfig> > > </Connector> > > > > However, I'm getting an exception that shows my client certificate is > > validated and rejected by Tomcat/OpenSSL: > > > > tomcat_1 | https-openssl-apr-8443-exec-3, > handling > > exception: javax.net.ssl.SSLHandshakeException: > > sun.security.validator.ValidatorException: PKIX path building failed: > > sun.security.provider.certpath.SunCertPathBuilderException: unable to > find > > valid certification path to requested target > > tomcat_1 | https-openssl-apr-8443-exec-3, > > IOException in getSession(): javax.net.ssl.SSLHandshakeException: > > sun.security.validator.ValidatorException: PKIX path building failed: > > sun.security.provider.certpath.SunCertPathBuilderException: unable to > find > > valid certification path to requested target > > tomcat_1 | https-openssl-apr-8443-exec-3, called > > close() > > tomcat_1 | https-openssl-apr-8443-exec-3, called > > closeInternal(true) > > > > Am I missing something? certificateVerification="optional" exhibits the > > same behaviour. > > How is your tomcat-native binary built? If it has been built with OCSP > support then neither of the optional verification options will work > since OCSP validation will always fail. > > Mark > > --------------------------------------------------------------------- > To unsubscribe, e-mail: [email protected] > For additional commands, e-mail: [email protected] > >
