Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Configure Truststore in Tomcat

Tags:

java

ssl

tomcat7

I have a Java servlet currently running on Tomcat 7 (Windows) and it connects to a SQL Server database. I now need to encrypt this connection and I have a public Key SSL certificate in a keystore. But apparently I have to configure a system property for a "Truststore" and have the truststore set to the keystore.

The keystore location is C:\SSLKeys\appkeystore.key and from what I have found I have to set the Truststore up with the following;

Djavax.net.ssl.trustStore=C:\SSLKeys\appkeystore.key
Djavax.net.ssl.trustStorePassword=appkeystorePassword

But how do I set these please? I have tried it in the command line but that doesn't seem to work. I don't want to hard code these in the Java as I need them to be configurable.

Can these be set in the Catalina.bat file in Tomcat? If so where in the file do I put the command?

like image 270
AJF Avatar asked Feb 17 '14 16:02

AJF


People also ask

What is Tomcat truststore?

Basically, the truststore parameters in Connector are for setting which client certificates you want to trust. The javax. net. ssl. * settings in JAVA_OPTS affect the default SSL context (typically for connection made from within the servlets, where they act as clients, for example).

What is the default truststore?

This Trust Store contains all the certificates of well-known certification authorities. By default, the password for this Trust Store is "changeit".


2 Answers

I think I may have found how, or at least one way of doing this. Someone please tell me if there is a better way of processing this. In the Tomcat\bin folder, where the catalina.bat file is I created a setenv.bat file and in there I declared the two Java option properties for;

set JAVA_OPTS="-Djavax.net.ssl.trustStore=C:\path\to\keystore.key" "-Djavax.net.ssl.trustStorePassword=************"

Apparently when Tomcat is started it initiates the catalina.bat file and the catalina.bat file determines if a setenv.bat file exists and if so runs this file to set the Java options.

Again someone please correct me if I am wrong and advise of any better way of doing this. Although apparently where Tomcat is set up as a Windows service the options above are input through the tomcatXw.exe to initiate the Tomcat console and the Java tab is selected.

like image 95
AJF Avatar answered Sep 29 '22 04:09

AJF


Incase anybody else is having this question, here is what I did:
1. Navigate to \tomcatDirectory\bin\
2. Edit the catalina.sh/bat depending on you machine.
3. Add these properties to the JAVA_OPTS property

JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=$CATALINA_HOME/certificates/truststore.ks -Djavax.net.ssl.trustStorePassword=truststorePassword -server"

This will essentially tell tomcat to use the specified truststore instead of the default cacerts truststore which tomcat loads if it does not find any truststore specified in the system properties.

Also, I have noticed that it is possible to define the truststore in tomcat's main configuration file server.xml. All you have to do is set these properties in the connector property.

<Connector port="8443" maxThreads="500"
           server="Apache"
           scheme="https" secure="true" SSLEnabled="true" acceptCount="500"
           keystoreFile="/apps/content/certificates/keystore.ks" keystorePass="keystorepass"
           truststoreFile="/apps/content/certificates/truststore.ks" truststorePass="truststorePassword"/>

Try it out, Hope it helps!

like image 36
HeCodes Avatar answered Sep 29 '22 04:09

HeCodes