Matthias, Thanks very much for your response. I've actually tried that, but still have no success on the client authentication part.
This is what I had to do to just get things sort of working:
1. Apache default-ssl file (I'm using Ubuntu, so this may just be the httpd.conf file's :443 virtualhost on other systems):
2. In my tomcat/conf/server.xml I had to add the keystore (otherwise casserver fails to start up, with errors about jsse.invalid_ssl_conf):
When I try to connect to the tomcat server directly (http://myhost:8444/cas/login) I get a "SSL peer cannot verify your certificate. (Error code: ssl_error_bad_cert_alert)" from firefox. This is because I've set clientauth="true". If I set clientauth="want", then I get the CAS login form.
So basically I'm unable to get the client authentication using the pkcs12 alfresco-system.p12 keystore.
I thought maybe this was because the alfesco-system cert has a CN of alfresco-system, and so changed this to my DNS. But did not make any difference.
I also tried to import the /etc/ssl/certs/cacert.pem into my keystore using keytool:
I'm sure there's something relatively simple that I'm missing, but just can't figure out what. The fact that I've been staring at this for several days is probably not helping either
Thanks for your help, anyway!
This is what I had to do to just get things sort of working:
1. Apache default-ssl file (I'm using Ubuntu, so this may just be the httpd.conf file's :443 virtualhost on other systems):
SSLCertificateFile /etc/ssl/certs/localhost.crt
SSLCertificateKeyFile /etc/ssl/private/localhost.pem
JkMountCopy On
JkMount /cas casnode
JkMount /cas/* casnode
JkMount /examples casnode
JkMount /examples/* casnode
SSLVerifyClient optional
SSLCACertificateFile /etc/ssl/certs/cacert.pem
SSLOptions +StdEnvVars + ExportCertData
2. In my tomcat/conf/server.xml I had to add the keystore (otherwise casserver fails to start up, with errors about jsse.invalid_ssl_conf):
<Connector port="8444" protocol="HTTP/1.1" SSLEnabled="true"
maxHttpHeaderSize="8192" minSpareThreads="25" maxSpareThreads="75"
maxThreads="150" scheme="https" secure="true"
sslProtocol="TLS" connectionTimeout="20000"
clientauth="true"
keystoreFile="/etc/ssl/alfresco-system.p12"
keystoreType="PKCS12" keystorePass="password"
truststoreFile="/etc/ssl/alfresco-system.p12"
truststorePass="password" truststoreType="PKCS12"
/>
When I try to connect to the tomcat server directly (http://myhost:8444/cas/login) I get a "SSL peer cannot verify your certificate. (Error code: ssl_error_bad_cert_alert)" from firefox. This is because I've set clientauth="true". If I set clientauth="want", then I get the CAS login form.
So basically I'm unable to get the client authentication using the pkcs12 alfresco-system.p12 keystore.
I thought maybe this was because the alfesco-system cert has a CN of alfresco-system, and so changed this to my DNS. But did not make any difference.
I also tried to import the /etc/ssl/certs/cacert.pem into my keystore using keytool:
keytool –import -alias alfresco-system -keystore /etc/ssl/keystore -file /etc/ssl/certs/cacert.pem
I'm sure there's something relatively simple that I'm missing, but just can't figure out what. The fact that I've been staring at this for several days is probably not helping either
Thanks for your help, anyway!
dward, thanks for the response. My tomcat is the zip file from apache (apache-tomcat-6.0.20.tar.gz), not the ubuntu packaged one.
When using the standard server.xml (without keystore definitions), but with tomcatAuthentication="false", I get:
This is the ONLY reason I deviated from the wiki - I could not figure out any other way to make this work (and basically followed the tomcat instructions on the CAS site, the one where you explicitly say "don't worry about tomcat configuration steps").
Anyway, I don't have a keystore file by default (the /root/.keystore), so how to proceed?
Again, thanks. I'm completely flummoxed and have had no luck getting this to work, so any help is hugely appreciated!
When using the standard server.xml (without keystore definitions), but with tomcatAuthentication="false", I get:
SEVERE: Failed to load keystore type JKS with path /root/.keystore due to /root/.keystore (No such file or directory)java.io.FileNotFoundException: /root/.keystore (No such file or directory)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.<init>(FileInputStream.java:106)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:341)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:263)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:473)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:413)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:129)
at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:503)
at org.apache.tomcat.util.net.JIoEndpoint.start(JIoEndpoint.java:526)
at org.apache.coyote.http11.Http11Protocol.start(Http11Protocol.java:203)
at org.apache.catalina.connector.Connector.start(Connector.java:1131)
at org.apache.catalina.core.StandardService.start(StandardService.java:531)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Nov 4, 2009 12:28:14 PM org.apache.coyote.http11.Http11Protocol start
SEVERE: Error starting endpoint
java.io.FileNotFoundException: /root/.keystore (No such file or directory)
at java.io.FileInputStream.open(Native Method)
at java.io.FileInputStream.<init>(FileInputStream.java:106)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:341)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:263)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:473)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:413)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:129)
at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:503)
at org.apache.tomcat.util.net.JIoEndpoint.start(JIoEndpoint.java:526)
at org.apache.coyote.http11.Http11Protocol.start(Http11Protocol.java:203)
at org.apache.catalina.connector.Connector.start(Connector.java:1131)
at org.apache.catalina.core.StandardService.start(StandardService.java:531)
at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
at org.apache.catalina.startup.Catalina.start(Catalina.java:583)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:288)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
This is the ONLY reason I deviated from the wiki - I could not figure out any other way to make this work (and basically followed the tomcat instructions on the CAS site, the one where you explicitly say "don't worry about tomcat configuration steps").
Anyway, I don't have a keystore file by default (the /root/.keystore), so how to proceed?
Again, thanks. I'm completely flummoxed and have had no luck getting this to work, so any help is hugely appreciated!
Ok, starting from scratch, this is what happens:
1. If I try to navigate to http://myhost/cas/login, I get login screen. https://myhost/cas/login gives me
I had to change the SSLCACertificatePath /etc/ssl/certs/ to SSLCACertificateFile /etc/ssl/certs/cacert.pem (like matthias suggested as well), since otherwise Firefox and Safari both just hang on "loading…" connecting to the URL.
I set the SSLCertificateFile to /etc/ssl/certs/localhost.crt and SSLCertificateKeyFile to /etc/ssl/private/localhost.key. These are the cert/key generated in Step 3 of the wiki instructions.
2. I have steps 2, 3 and 4 completed, and have Apache, CASServer and all certificates in place. mod-jk redirects my requests to /cas/login. Trying the snoop.jsp example redirects me to /cas/login and my ldap auth works.
3. Trying out client authentication by importing the alfresco-system.p12 keystore into Firefox, cleaning out cookies and going back to http://myhost/examples/jsp/snp/snoop.jsp takes me to https://myhost/cas/login?service=…
So importing the alfresco-system.p12 keystore into Firefox does not seem to have any effect
Any ideas?
1. If I try to navigate to http://myhost/cas/login, I get login screen. https://myhost/cas/login gives me
Not Found
the requested URL /cas/login was not found on this server
I had to change the SSLCACertificatePath /etc/ssl/certs/ to SSLCACertificateFile /etc/ssl/certs/cacert.pem (like matthias suggested as well), since otherwise Firefox and Safari both just hang on "loading…" connecting to the URL.
I set the SSLCertificateFile to /etc/ssl/certs/localhost.crt and SSLCertificateKeyFile to /etc/ssl/private/localhost.key. These are the cert/key generated in Step 3 of the wiki instructions.
2. I have steps 2, 3 and 4 completed, and have Apache, CASServer and all certificates in place. mod-jk redirects my requests to /cas/login. Trying the snoop.jsp example redirects me to /cas/login and my ldap auth works.
3. Trying out client authentication by importing the alfresco-system.p12 keystore into Firefox, cleaning out cookies and going back to http://myhost/examples/jsp/snp/snoop.jsp takes me to https://myhost/cas/login?service=…
So importing the alfresco-system.p12 keystore into Firefox does not seem to have any effect
Any ideas?
