Skip to main content

tomcat ssl existant

Tomcat: activer HTTPS avec des certificats SSL existants

Dans le cas ou un certificat SSL existe déjà, voici comment faire en sorte que Tomcat serve en HTTPS avec les certificats existants.

Pour que cela fonctionne, il faut avoir en sa possession:
  • La clé privée qui a servie à générer le CSR, généralement un "*.key"
  • Le certificat délivré par le registrar (ce qui a été délivré en réponse à la CSR), généralement un "*.cert"
  • Le certificat de l'autorité, généralement un "*.pem". Par exemple pour Gandi, c'est https://www.gandi.net/static/CAs/GandiStandardSSLCA.pem, docmenté dans https://wiki.gandi.net/en/ssl/intermediate
Noter que la documentation officielle de Tomcat couvre un certain cas d'utilisation mais pas celui-ci. En effet, https://tomcat.apache.org/tomcat-8.0-doc/ssl-howto.html traite des cas ou on souhaite autosigner le certificat, ou alors il traite du cas ou l'on doit encore générer le CSR à partir d'une clé privée, toutes les 2 encore à créer.

Configuration des clés & certificats

Activer la possibilité de se logger à l'utilisateur sous lequel tourne Tomcat: 
nano -w /etc/passwd
Et donner un SHELL à l'utilisateur Tomcat. Passer sous l'utilisateur sous lequel tourne Tomcat: 
su - tomcat8
On crée un certificat de type "pkcs12", car c'est ce format qui est reconnu par les outils Java. La création de ce certificat met en jeu la clé privée et le certificat (que Gandi a délivré). Il demande une passphrase: je mets "rktmb" partout. C'est une mauvaise pratique, mais pour le tutoriel cela simplifie la tâche. 
openssl pkcs12 -export -name tomcat \
  -in /usr/share/tomcat8/ssl.key/rktmb.crt \
  -inkey /usr/share/tomcat8/ssl.key/rktmb.key \
  -out  /usr/share/tomcat8/ssl.key/rktmb.p12
On converti ce certificat de type "pkcs12" en "keystore", dont le chemin est ''/usr/share/tomcat8/.keystore'' (certaines documentations préfère utiliser un fichier avec extension ".jks"): 
keytool -importkeystore -destkeystore /usr/share/tomcat8/.keystore \
                          -srckeystore /usr/share/tomcat8/ssl.key/rktmb.p12 \
                          -srcstoretype pkcs12 -alias tomcat
A cette étape, on a créé le keystore et on l'a appelé "tomcat". Il ne faut plus en créer, on vient de le faire. Le certificat du CA n'a pas encore été importé, on le fait avec: 
keytool -import -alias root   -keystore /usr/share/tomcat8/.keystore -trustcacerts -file /usr/share/tomcat8/ssl.key/GandiStandardSSLCA.pem

Configuration de Tomcat pour utiliser tout cela

Dans ''/etc/tomcat8/server.xml'', décommenter: 

<Connector  port="8443" 
              protocol="org.apache.coyote.http11.Http11NioProtocol"
              keystoreFile="/usr/share/tomcat8/.keystore"
              keystorePass="rktmb"
              maxThreads="150" 
              SSLEnabled="true" 
              scheme="https" secure="true"
              clientAuth="false" 
              sslProtocol="TLS" />

Restart du service et tests

systemctl status tomcat8
  systemctl stop tomcat8
  systemctl status tomcat8


systemctl start tomcat8
  systemctl status tomcat8

Aller sur https://tomcat-ssl-test.rktmb.org:8443/

Popular posts from this blog

Undefined global vim

Defining vim as global outside of Neovim When developing plugins for Neovim, particularly in Lua, developers often encounter the "Undefined global vim" warning. This warning can be a nuisance and disrupt the development workflow. However, there is a straightforward solution to this problem by configuring the Lua Language Server Protocol (LSP) to recognize 'vim' as a global variable. Getting "Undefined global vim" warning when developing Neovim plugin While developing Neovim plugins using Lua, the Lua language server might not recognize the 'vim' namespace by default. This leads to warnings about 'vim' being an undefined global variable. These warnings are not just annoying but can also clutter the development environment with unnecessary alerts, potentially hiding other important warnings or errors. Defining vim as global in Lua LSP configuration to get rid of the warning To resolve the "Undefined global vi...
Read more

LazyGit AI Commit Message

Having AI‑generated commit messages directly integrated into LazyGit If you use LazyGit every day, you already know how it turns Git from a chore into something you can actually enjoy. But there is one part of the workflow that still tends to feel a bit tedious: writing good commit messages. In this post, I show how to plug OpenAI models directly into LazyGit using a tiny one‑file BASH script, so you can get AI‑generated commit messages based on your actual diffs, without waiting for external tools to catch up with the new OpenAI Responses API . The result is a minimal, focused tool you can drop into your setup today: lgaicm . It behaves like a mini aichat that does exactly one thing: generate commit messages from Git diffs, optimized for LazyGit. Why AI‑generated commit messages in LazyGit? Commit messages matter. They are the stor...
Read more

CopilotChat GlobFile Configuration

CopilotChat GlobFile Configuration Want to feed multiple files into GitHub Copilot Chat from Neovim without listing each one manually? Let's add a tiny feature that does exactly that: a file glob that includes full file contents . In this post, we'll walk through what CopilotChat.nvim offers out of the box, why the missing piece matters, and how to implement a custom #file_glob:<pattern> function to include the contents of all files matching a glob. Using Copilot Chat with Neovim CopilotChat.nvim brings GitHub Copilot's chat right into your editing flow. No context switching, no browser hopping — just type your prompt in a Neovim buffer and let the AI help you refactor code, write tests, or explain tricky functions. You can open the chat (for example) with a command like :CopilotChat , then provide extra context using built-in functions. That “extra context” is where the magic really happens. Built-in functio...
Read more