Configure Tomcat 7 Two way SSL Authentication

Software: 1. Functional EJBCA PKI (Do not have one? You could use keytool instead. Follow the 2nd section of this post for configuration). 2. Apache Tomcat 7.0.52 ***Section I: To complete the configuration,you have to have your CA root certificate (LeopardRootCA.pem as example). That will be used to sign all client certificates and server certificates. By default Tomcat uses the certificate trust store provided with JDK which can be found in $JAVA_HOME/jre/lib/security/cacerts. Here I am going to create a new certificate trust store in my configuration. 1. Create Key store for Tomcat

keytool -genkeypair -alias tomcat-server -keystore /opt/apache-tomcat-7.0.52/conf/keystore.jks
Enter keystore password: apache123
Re-enter new password: apache123
What is your first and last name?
[Unknown]: Use FQDN of your server
What is the name of your organizational unit?
[Unknown]: Center Research Cancer
What is the name of your organization?
[Unknown]: SHH
What is the name of your City or Locality?
[Unknown]: CityName
What is the name of your State or Province?
[Unknown]: StateName
What is the two-letter country code for this unit?
[Unknown]: US
Is CN=FQDN, OU=Center Research Cancer, O=SHH, L=CityName, ST=StateName, C=US correct?
[no]: yes

Enter key password for 
(RETURN if same as keystore password): apache123
Re-enter new password: apache123

2. Create certificate request for Tomcat server:

keytool -certreq -alias tomcat-server -file FQDN.csr -keystore /opt/apache-tomcat-7.0.52/conf/keystore.jks

3. Sign the request in EJBCA: Copy signed certificate, FQDN.pem, file to current working path. 4. Import signed server certificate into Tomcat: Before importing signed server certificate into Tomca,t you might need to import your CA root certificate into Tomcat first or you might see the following error: "keytool error: java.lang.Exception: Failed to establish chain from reply.".

keytool -importcert -alias leopardrootca -file LeopardRootCA.pem -keystore /opt/apache-tomcat-7.0.52/conf/keystore.jks

4.1 import signed server certificate

keytool -importcert -alias tomcat-server -file FQDN.pem -keystore /opt/apache-tomcat-7.0.52/conf/keystore.jks

5. Create Trust store for tomcat and put yout CA root certificate into it:

keytool -import -keystore cacerts.jks -storepass changeit -alias leopardrootca -file leopardrootCA.pem

6. Configure Tomcat conf/server.xml by uncommenting the following section and edit 7. start Tomcat

bin/startup.sh

8. Create client certificate using the same root CA in EJBCA and import it into Firefox. ***Section II: Using keytool as example 1. create keyp air for rootCA

openssl genrsa -out rootCA.key 1024

2.create root certificate

openssl req -new -x509 -days 3650 -key rootCA.key -out rootCA.crt

3. create necessary folder for openssl

mkdir -p demoCA/newcerts
touch demoCA/index.txt
echo '01' > demoCA/serial

4. create server certificate keypair

openssl genrsa -out localhost.key 2048

5. create server certificate singing request file

openssl req -new -key localhost.key -out localhost.csr

6. sing the server CSR using CA

openssl ca -keyfile rootCA.key -cert rootCA.crt -policy policy_anything -out localhost.crt -infiles localhost.csr

7. create client certificate keypair

openssl genrsa -out client.key 2048

8. create client certificate singing request

openssl req -new -key client.key -out client.csr

9. sing client CSR use CA

openssl ca -keyfile rootCA.key -cert rootCA.crt -out client.crt -policy policy_anything -infiles client.csr

10. convert created server and client certificate into pk12 type:

openssl pkcs12 -export -in localhost.crt -inkey localhost.key -out localhost.p12 -name sercer ##password: sercer
openssl pkcs12 -export -in client.crt -inkey client.key -out client.p12 -name client
#password: client

11.create tomcat keystore

keytool -importkeystore -deststorepass changeit -destkeypass changeit -destkeystore keystore.jks -srckeystore localhost.p12 -srcstoretype PKCS12 -alias sercer #pass is sercer

12. configure tomcat server.xml file 13.

keytool -import -keystore cacerts.jks -storepass changeit -alias rootca -file rootCA.crt