Tomcat and SSL Client certificate

Question

I would like to have a following scenario:

1. create my own CA
2. create a server certificate and sign it with my CA
3. create multiple client certificates and sign them with my CA

Next i would like to authenticate every client which presents a certificate signed by my CA.

Is it possible to realize such scenario without adding every single client certificate to my tomcat keystore? I just would like to only verify if the certificate the client presents is issued and signed by my CA.

Answer 1

Yes, that's certainly possible, and I have done exactly this. If you configure Tomcat with a truststore containing your CA certificate then it should accept any client certificate signed by that CA.

I'll assume you have your CA key and root certificate already generated and you know how to use it to turn CSRs into certificates.

First generate your server key, and a corresponding CSR

$ openssl genrsa -out XXX.key 2048
$ openssl req -new -nodes -key XXX.key -out XXX.csr

Use your CA certificate to sign the CSR, producing a server certificate XXX.crt. Now package the server key, server cert and CA cert into a single PKCS#12 file

$ cat XXX.crt ca-certificate.pem | openssl pkcs12 -export -inkey XXX.key -out XXX.p12 -name tomcat -caname myauthority

You will be prompted for several passwords by this process, set them all to the same value (it doesn't matter what this value is and it doesn't have to be a secure password, it just has to be non-empty - I use changeit).

This .p12 file can now act as the keystore for Tomcat. Next you need to create a separate JKS keystore containing just the CA certificate to use as the truststore.

$ keytool -import -alias myauthority -keystore truststore.jks -file ca-certificate.pem

Again, reply to all password prompts with the same non-empty password, such as changeit.

Finally you can configure Tomcat:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
           maxThreads="150" scheme="https" secure="true"
           connectionTimeout="20000"
           keystoreFile="${catalina.home}/conf/XXX.p12"
           keystoreType="PKCS12"
           keystorePass="changeit"
           truststoreFile="${catalina.home}/conf/truststore.jks"
           truststoreType="JKS"
           truststorePass="changeit"
           clientAuth="true" sslProtocol="TLS" />