Encrypt tomcat keystore password

Question

Is there an option to encrypt keystorePass value in tomcat server.xml? I don't want it to be a plain text

    <Connector port="8403" //...
        keystorePass="myPassword" /> 

Answer 1

There is a better way, than just using the XML encode.

Create an Encryption Class to encrypt and decrypt your password.

And override Http11Nio2Protocol class, something similar to the below code.

 public class Http11Nio2Protocol extends org.apache.coyote.http11.Http11Nio2Protocol {

@Override
public void setKeystorePass(String s) {
    try {
        super.setKeystorePass(new EncryptService().decrypt(s));
    } catch (final Exception e){
        super.setKeystorePass("");
    }
}

}

Note: EncryptService is our own encryption class.

And configure the overridden class in the protocol attribute in server.xml like below.

<Connector port="8443" protocol="<com.mypackage.overridden_Http11Nio2Protocol_class>"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS" 
          keystoreFile="conf/.ssl/keystore.jks"        
           keystorePass="<encrypted_password>"/>

Hope this helps.

Answer 2

If someone has access to your server.xml, the plain text value of your keystorePass appearing are only one of your worries.

If someone has access from there, they could do much more harm. Encrypting the password here is really just moving the problem elsewhere as then someone could find the encryption key for this encryption key (a bit like a Russian doll).

If you want to encrypt the password, you have to override the Connector implementation to decrypt the encrypted password so that the real pwd is accessible or available to tomcat.