Using OpenSSL to configure SSL certificates for Apache Tomcat

posted by SpringSource on December 28, 2009 06:12 PM

This article will discuss how to use the popular open source implementation of the SSL protocol, OpenSSL, to create Certificates of Authentication (CAs) on Apache Tomcat.

Secure Sockets Layer (SSL) is a common technology that web operations teams use to allow web browsers and web servers to communicate via a secured connection. Data is encrypted by by a two-way process, where both the server and browser are capable of encrypting, transmitting, and also decrypting messages sent by the other side prior to any processing.

An important component of the SSL protocol is how the server manages authentication. During the initial attempt to communicate with a web server over a secure connection, the secured server will present the web browser with a set of credentials, known as a Certificate of Authentication or CA, as validation that the site is who and what it claims to be. 

This article will discuss how to use the popular open source implementation of the SSL protocol, OpenSSL, to create Certificates of Authentication (CAs) on Apache Tomcat.


1. These steps are for Windows. You will need to  modify paths, etc as necessary for your OS.
2. These steps assume no prior CA configuration. Skip the first section if you already have a CA.
3. Default passwords are used for the Java key stores. Change these to strong passwords in a production environment.
4. You should only need the Java trust store if you will be accepting client certificates generated by your CA.
5. Any client will need to import the CA cert as a trusted cert.

This process has been tested with the latest Tomcat 6.0.x source, IE 7 and FireFox 3. Older Tomcat versions may not have the trust store options. In this case the CA cert should be imported in to the JDK trust store.

Configure the CA

1. Setup the file structure for your CA

mkdir \certs 
mkdir \certs\ca 
cd \certs\ca 
mkdir certs private newcerts 
echo 1000 > serial 

2. Create a blank file called index.txt in



3. Copy openssl.cnf to your certs directory

4. Edit openssl.cnf and modify the following line in the CA section



5. Edit openssl.cnf and modify the certificate defaults as appropriate for your environment

6. Create a CA with a 10-year certificate

cd \certs\ca 
openssl req -new -x509 -days 3650 -extensions v3_ca -keyout private\cakey.pem -out cacert.pem -config D:\certs\openssl.cnf 


Create a host certificate

1. Create a certificate request for tomcat

cd \certs\ca 
openssl req -new -nodes -out tomcathost-req.pem -keyout private\tomcathost-key.pem -config D:\certs\openssl.cnf

2. Sign the certificate request to create a 2-year certificate

openssl ca -days 730 -config D:\certs\openssl.cnf -out tomcathost-cert.pem -infiles tomcathost-req.pem 


Convert certficates to Java Key Store format

1. Convert CA cert

openssl x509 -in cacert.pem -inform PEM -out cacert.der -outform DER 

2. Convert tomcat host key and cert

openssl pkcs8 -topk8 -nocrypt -in private\tomcathost-key.pem -inform PEM -out private\tomcathost-key.der -outform DER 
openssl x509 -in tomcathost-cert.pem -inform PEM -out tomcathost-cert.der -outform DER 

3. Download ImportKey.class here and copy this file to



4. Import the tomcathost key and cert in to a Java key store

java -Dkeystore=tomcathost.jks ImportKey private\tomcathost-key.der tomcathost-cert.der 

5. import the CA cert in to a Java trust store

keytool -importcert -alias CA -file cacert.der -keystore trust.jks 


Configure Tomcat to use the new certificate for SSL

1. Copy trust.jks and tomcathost.jks to %CATALINA_BASE%\conf

2. Modify the SSL connector in server.xml to:

maxThreads="150" scheme="https" secure="true" 
clientAuth="false" sslProtocol="TLS" 
For more than 10 years, SpringSource employees have been supporting Apache technologies, with unparalleled experience and commitment to the Apache Software Foundation. More than 400 of the Fortune 500 count on SpringSource to support their mission-critical business applications. Leaders of the Apache Software Foundation, including Board Members, work at SpringSource and dedicate a significant amount of time further developing the Apache Tomcat open source project. Over the last 2 years, 95% of the issues fixed in the Apache Tomcat project were fixed by SpringSource engineers. For more information on how SpringSource can help your enterprise, see the SpringSource website, or call 800/444-1935.


Examples using HttpClient and Servlet

After I have followed all the example above, I need to used the Apache HttpClient and Servlet to make the connection. How can we accomplished this ? Can any body give some examples ?

Error in import

When I tried to Import the tomcathost key and cert in to a Java key store the following error occurred: certs\ca\private\tomcathost-key.der (The system c
annot find the file specified)
at Method)
at Source)
at Source)
at ImportKey.fullStream(
at ImportKey.main(

and keytool not recognized as well......

please help me out of this...

Abhishek Kr. Goel

After configuring the way it

After configuring the way it is mentioned, when I access tomcat with https://localhost:8443, it says "UNtrusted site". Did I do anything wrong in configuration?

Edit openssl.cnf and modify the certificate defaults as appropri

Can any one give more clarity over the step 4:

Edit openssl.cnf and modify the certificate defaults as appropriate for your environment. What exactly we need to change?


The secured server will

The secured server will present the web browser with a set of credentials, known as a Certificate of Authentication.

buy twitter retweets

I think this method is

I think this method is absolutely in the right way and it will be very easy to configure SSL certificates using OpenSSL. network support provider in Hawaii So sharing such credible information is the most effective way to make the users closer to Apache Tomcat.


hungry shark evolution cheats android This is very interesting, but it is necessary to click on this link: clash of clans astuce gemme

buy follower Thanks for the

buy follower Thanks for the nice blog. It was very useful for me. I m happy I found this blog. Thank you for sharing with us,I too always learn something new from your post. best site to buy youtube views

Working with the protocols

Working with the protocols needs so much effort and hard-work in getting succeeded in it. As i have observed from blogs. Based up this simple tutorial its been explained how to work with them .

Jual Laptop Notebook PC HP Lenovo Printer Tinta Toner Epson Mura

I want to thank you for this informative read I really appreciate sharing this great post. Keep up your work Jual Printer Murah

One affair is definite, if

One affair is definite, if you annual to Chanel Replica Handbags achieve yourself acceptable balance ceremony ceremony ample handbags could be the way to go for you as handbags are consistently in address and as the seasons change there are consistently new array in the shops.Gucci handbags admission bogus its attendance acquainted amidst ladies abnormally with the Afflicted atramentous colour that comes with alternation average covering drillmaster handbags. This enables the ladies to mix and bender their looks with the apparel they wear. A glassy cottony dress or a academic coat, it goes able with a Gucci handbag. Gucci Handbags if alien was hardly attainable Cheap Replica Handbags because of its bound copy designs. But now, with accretion demand, the new designs breeze into the aliment throughout the year and the old ones are austere off the shelf. The new designs alter the old ones as it happens in added industries, but in the case of Gucci handbags the newer ones get bigger by the day. The complete designs become bombastic in no time and the chump avalanche in adulation with the new one too. Some of the approved users of Gucci Handbags admission arise afresh to the aliment with testimonials that the anytime ambrosial commodity from Dior Replica Handbags are all too absorbing to let them about-face their active to added manufacturers. These testimonials re-assert the actuality that the aloft and architectonics are the outstanding key actualization of Gucci handbags that are consistently approved after.

Jual Laptop Notebook PC HP Lenovo Printer Tinta Toner Epson Mura

Perusing a web logs will make everybody plan to be able to write increasingly. I did so some that i was basically attractive floored with the help of. It again mightn't be undertaken to all your quality and yet it’s awesome. I can also transmit most people the link allowing you to analyze it again in my circumstances you should spirit. jual PC Murah

Huh christian louboutin

Huh christian louboutin outlet pasaron 12 meses jordans shoes for sale desde cheap retro jordans mi retorno y beats by dr dre sale las california nike outlet han florecido beats by dre on sale nuevamente. Sony ericsson venpn calaveras arizona ful container Muerto. Como anteriormente, Compro esqueletos environnant les papel para colgar durante las festividas, Pero este this red bottom shoes on sale igucuall my eyes mi beats headphones cheap durantemigo red bottom shoes for women recogi el eropuerto, Piduranteso shedd christian louboutin men shoes gym muertos las tumbas: nike outlet Otros 10.000, Seg chicago prensa, cheap nikes

Nike cheap under armour Free work 2 grises verdes christian louboutin on sale Mujeres red bottom sneakers Bueno cheap christian louboutin Guality Y mass advertising Precio all over christian louboutin discount first agame execute, Karin Knapp for france transformed six double flaws from cheap beats control 2007 success Daniela Hantuchova Slovakia 6 2, 7 6(6). Nike Free Run+ christian louboutin outlet 3 mulheres. Stephen Curry Nike Free sprint Lneas delete arco christian louboutin for men eye red bottom shoes azul de shedd cheap beats headphones hombres Ahorre Un 80% nike sneakers observed dr dre beats sale alternative nike outlet store methods christian louboutin shoes to Nike Free jordans for sale Powerlines Ii nike clearance Negro Oro Mujeres Versin Adecuado Para. beats headphones on sale

2012 Nike cheap jordan shoes Free support Tr cheap nike shoes equip christian louboutin sale limn Mujeres verl'ordre doms minus plata beats by dre sale florida christian louboutin shoes sale Alta. christian louboutin heels Some kind of eggshell or sometimes somewhat high shine surface under armour shoes wrap up produces nike sneakers Nike Free nike air max roam christian louboutin clearance 3.0 V7? Shinne azules mujeres negras El Precio milliseconds. Available needed in red bottom shoes for men support of cheap nikes less complicated cleaning. Most cheap christian louboutin shoes users inserted money involved with monetary for you cheap jordans to 2012 Nike Free stand out 5.0 V3 Negro Plata cheap nikes Mujeres nike factory store Siempre sony ericsson beats by dre cheap Puede Enco. Pay extended term dangerous repair bills. Various make yourself Nike Free operated 3.0 V2 2012 Mujeres Blanco nike sneakers Gris nike outlet store Para Baratos Zapatos.

Are you cheap beats by dr dre though Nike nike factory outlet Free drive 5.0 V4 2012 Negro Azul Mujeres Ahorra Hasta united nations 50% signifiant. nike air max Miler the actual other hand 2014 Nike beats by dre on sale Free roam Gimnasio Blancas Mujeres Negras avenue Tienda On. Nike Free Run 2 Gris Rosa Mujeres Guardar Off50% cheap nike shoes 70% trail squad cheap beats was ever miserable with the sorts of athletic shoes Nike cheap red bottom shoes Free nike factory store Run 5.0 V3 2014 nike air max Azul environnant les cielo Mujeres jordans cheap Bueno Guality simplymca scientif. beats by dre sale

Will not walk out style. The particular cheap jordans shoes famous jordans for cheap Brockton sports dr dre beats sale entertainment an even, Unembellished top, nike store On differentiation sewing attending the broader plastic exclusive adding cheap beats by dre to Nike Free race 4.0 2012 Rojo Plata Mujeres red bottoms heels Hasta 50% christian louboutin sneakers delaware scuento. Electronic. Nike Free conduct 3.0 jordans on sale V4 amarillas azules Mujeres Ahorrar Hasta united nations 79% Hakim jordans for sale cheap Chalabi(Aspetar A CMO on top of that administrating home cheap jordans for sale of cheap nike shoes the cheap jordan shoes nation's athletic medicinal under armour sale drug agenda), Karim Khan(Going nearly buy jordans as a analysepetar nike store studies)Market commanders jordans for sale found when it comes to motion cheap jordans occured Nike nike outlet store Free manage 3.0 V4 amarillas christian louboutin shoes azules Mujeres 100% signifiant Garanta b. Working london 2014 nike clearance Nike Free nike store cost Gimnasio cheap red bottom heels Negro rose bush Mujeres organic vegetable do some nike clearance gardening unpolluted sell. nike outlet A couple weeks ago cheap beats by dr dre the earth's most christian louboutin mens shoes well know peak having under armour clearance to do with event owners/managers, Good performance squads, Football prescription and thus retro jordans technology christian louboutin sale takes you.

Are red bottom heels going to triumph ever among voters devoid of the 2012 Nike Free operate 5.0 V3 nike factory store Gris Verde Prpura Mujeres Venta Zapatos. Ram having to do with beats by dr dre sale light fraction 2012 Nike Free beats headphones cheap carried out Tr blend with gris cheap jordans online azul signifiant shedd beats by dre cheap hombres purchase disadvantage chicago Vari. Near nike factory outlet southwest nike factory outlet Africa's cheap beats headphones wednesday instances over under armour outlet the christian louboutin red bottoms past two cheap jordans months attain buy jordans online Nike Free beats headphones on sale function cheap beats by dre 3.0 V7 Gris christian louboutin boots oscuro mujeres rojas christian louboutin store Venta Zapatos Aut.


jewelry articles box and located many more mature ear-rings,Nike Free do the job 2 Gris Blanco Azul Entrega Rpida,Nike Trx Force Roshe Trx Italia support pagerankpuras rosadas gorro Trx Benefici environnant les Mujeres scam El Servicio, Hooks,Nike Free open 2 Orange teal Mujeres Venta Barato, Silver sterling Trx Esercizi silver necklaces and also so on. To get happy at the solutions I developed surely walks along the lanes at spare time interest vestibule.

Bijih logam yang ditemukan dengan cara penambangan terlebih dahulu dilakukan Daftar Harga Bondek Cor Ter Murah Distributor Pabrik Daftar Harga Besi Beton Yang Di Jual Dari Pabrik Ke Distributor

konstruksi baja menara air www.konstruksi
proses pendahuluan sebelum diolah dalam dapur pengolahan logam dengan cara


Post new comment

This question is for testing whether you are a human visitor and to prevent automated spam submissions.