Posts Tagged ‘SSL’

SSL Implementation in Apache Tomcat

November 28th, 2010

To implement ssl for a Application server ,first we need to create Certificate Store ,using the java utility keytool.

1. cd $CATALINA_HOME
If path does not found set the path to tomcat bin directory.
2. $JAVA_HOME/keytool -genkey -alias tomcat -keyalg RSA -keystore mycert.jks
3. Enter keystore password: changeit
4. What is your first and last name? [Unknown]: Pawan Kumar
5. What is the name of your organizational unit? [Unknown]: IT
6. What is the name of your organization? [Unknown]: My Comp.
7. What is the name of your City or Locality? [Unknown]: KL
8. What is the name of your State or Province? [Unknown]: KL
9. What is the two-letter country code for this unit? [Unknown]: MY
10. US Is CN=Pawan Kumar, OU=IT, O=”My Comp.”, L=KL, ST=KL, C=MY correct? [no]: yes
11. Enter key password for (RETURN if same as keystore password): Hit Enter.

Tomcat will assume the password is “changeit” by default so it’s advised to leave it that way. Now let’s tell Tomcat to use the keystore file.

1. cd $CATALINA_HOME/conf/
2. vi server.xml
3. Look for “”. Remove the comments indicator and add the keystore info.

Time to restart Tomcat and test.

1. cd $CATALINA_HOME/bin/
2. ./shutdown.sh to make sure Tomcat is down.
3. ./startup.sh to start Tomcat.
4. Fire up your browser and test your new https site. https://localhost/

View Comments »

Posted in Apache

Tags:

SSL Configuration in Apache

January 24th, 2010

Secure Sockets Layer (SSL) enables the HTTP protocol to be secured. This page will show you how to configure SSL in Apache and SquirrelMail.

Generate a Private Key

Make sure you are logged in as the root user when doing steps below.

1. Generate a pass phrase protected private key using the command below. Provide a pass phrase when asked.
2. #openssl genrsa -des3 -out localhost.key 1024
3. Remove the pass phrase protection using the command below. Provide the pass phrase when asked.
4. #openssl rsa -in localhost.key -out localhost.key
5. Type in the command below to ensure that the private key will be readable by the root user only.
6.#chmod 400 localhost.key

Generate a Certificate

Generate a certificate signing request by typing in the command below and filling in your host information.

#openssl req -new -key localhost.key -out localhost.csr

To self sign your certificate request, type in the command below.
#openssl x509 -req -days 365 -in localhost.csr -signkey localhost.key -out localhost.crt

Configuring Apache for SSL

Move the file localhost.key into /etc/pki/tls/private/

Place the certificate file into /etc/pki/tls/certs/ and name the file as localhost.crt. The command below applies to self-signed certificate only.

mv localhost.crt /etc/pki/tls/certs/

Edit the file /etc/httpd/conf.d/ssl.conf and edit the lines below.

DocumentRoot = /usr/share/squirrelmail
ServerName = mail.acme.local:443

Restart web server

Thanks
Manoj Chauhan

View Comments »

Posted in Apache, Security

Tags: