Overview

SSL support in Tomcat using NSS/JSS is provided by Tomcat JSS.

Using PKCS #12 Key Store

Generating a self-signed SSL server certificate

To generate a self-signed SSL server certificate, first create an NSS database:

$ cd /usr/share/tomcat

$ echo Secret.123 > password.txt

$ mkdir -p nssdb

$ certutil -N -d nssdb -f password.txt

$ chown -R root.tomcat nssdb

$ chmod -R g+rw nssdb

Then create a self-signed SSL server certificate.

To export the SSL server certificate and key into a PKCS #12 file:

$ pk12util -d nssdb \

``    -k password.txt ``

``    -n “sslserver” ``

``    -o sslserver.p12 ``

``    -w password.txt``

$ chown -R root.tomcat sslserver.p12

$ chmod -R g+r sslserver.p12

or:

$ pki -d nssdb -C password.txt

``    pkcs12-cert-import “sslserver” ``

``    –pkcs12-file sslserver.p12 ``

``    –pkcs12-password-file password.txt ``

``    –cert-encryption “PBE/SHA1/RC2-40” ``

``    –key-encryption “PBE/SHA1/DES3/CBC”``

Exprorting existing SSL server certificate

To export an existing SSL server certificate and key from a PKI server into a PKCS #12 file:

$ pki-server cert-export \

``    sslserver ``

``    –instance “pki-tomcat” ``

``    –pkcs12-file “/var/lib/pki/pki-tomcat/conf/keystore.p12” ``

``    –pkcs12-password-file “/var/lib/pki/pki-tomcat/conf/keystore.pwd” ``

``    –friendly-name “sslserver” ``

``    –cert-encryption “PBE/SHA1/RC2-40” ``

``    –key-encryption “PBE/SHA1/DES3/CBC”``

Configuring SSL connector

Uncomment the SSL connector in $CATALINA_BASE/conf/server.xml and add the keystore parameters as follows:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"

``           maxThreads=”150” SSLEnabled=”true” scheme=”https” secure=”true”``

``           clientAuth=”false” sslProtocol=”TLS”``

``           \ ``keystoreType="pkcs12"

``           keystoreFile=”${catalina.base}/sslserver.p12”``

``           keystorePass=”Secret.123”``

``           keyAlias=”sslserver”``

/>