How to set up tomcat with server authentication and client certificate authentication enabled

How to set up tomcat with server authentication and client certificate authentication enabled?

When I  do my daily work, I need to set up a server with client certificate authentication enabled. Now I record all steps for further reference.

ENV: windows7/x86, tomcat-7.0.79, jdk1.7.0_151

Generally, the steps are as follows:

1. Create a certificate for the tomcat server. The client has to trust this certificate.
2. Create a keystore for the tomcat server, and import the server certificate into it.
3. Create a certificate for the client. The server has to trust this certificate.
4. Import the client certificate into the server keystore
5. Update the tomcat server.xml file with the correct Connector XML.

Detail steps:

1. Create certificate/keysotre for server and client

# For the following commands, set the values in parenthesis to be whatever makes sense for your environment.  The parenthesis are not necessary for the command.

# This is an all-in-one command that generates a certificate for the server and places it in a keystore file, while setting both the certifcate password and the keystore password.
# The net result is a file called "tomcat.keystore".

keytool -genkeypair -alias servercert -keyalg RSA -dname "CN=oracle,OU=java,O=oracle,L=SC,ST=California,C=US" -keystore tomcat.keystore -keypass changeit -storepass changeit

# This is the all-in-one command that generates the certificate for the client and places it in a keystore file, while setting both the certificate password and the keystore password.
# The net result is a file called "client.keystore"

keytool -genkeypair -alias clientcert -keyalg RSA -dname "CN=client,OU=java,O=oracle,L=SC,ST=California,C=US" -keypass changeit -keystore client.keystore -storepass changeit

# This command exports the client certificate.  
# The net result is a file called "client.cer" in your home directory.

keytool -exportcert -rfc -alias clientcert -file client.cer -keypass changeit -keystore client.keystore -storepass changeit

# This command imports the client certificate into the "tomcat.keystore" file.

keytool -importcert -alias clientcert -file client.cer -keystore tomcat.keystore -storepass changeit -noprompt

2. Configure your connector in the tomcat server.xml:

<Connector port="8443"
    maxThreads="150"
    scheme="https"
    secure="true"
    SSLEnabled="true"
    truststoreFile="/full-path-to/tomcat.keystore"
    truststorePass="(password)"
    keystoreFile="/full-path-to/tomcat.keystore"
    keystorePass="(password)"
    clientAuth="true"
    keyAlias="servercert"
    sslProtocol="TLS"/>  

Additionally, in the server.xml, ensure that you DO NOT have an AprLifecycleListner defined. The XML for that listener will look something like this:

<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

That element should be delete/commented out. The AprLifecycleListener does not get configured the same way as described above, and will not work with these instructions.

3. Test your server configuration

Start tomcat server and load the following link in your browser

https://mytomcatdomain.com:8443

You should get the standard alert from Firefox or IE about an untrusted connection because we created a self-signed certificate for our Tomcat server. Accept to proceed. You should get a "Secure Connection Failed" message. The error code is "ssl_error_bad_cert_alert". This confirms that our Tomcat server is requesting authentication from the client. The request is failing because we have not configured browser to send our trusted client certificate yet.

4. Extract a key from the client.keystore

# This extracts the client key from the client keystore

java DumpPrivateKey client.keystore changeit clientcert > clientkey.pkcs8

# This creates a client.p12 file that can be used by Firefox

openssl pkcs12 -export -in client.cer -inkey clientkey.pkcs8 -password pass:changeit -out client.p12

5. Import client.p12 to browser

For Firefox, open preferences. Click on the "Certificates" tab. Click on the "View Certificates" button. Click on the "Your Certificates" tab. Click on the "Import" button and browse to the "client.p12" file that was created previously. You should be prompted to enter the password for the client certificate.

For IE, open Internet options-> Content->Certificates->Personal. Click on the "Import" button and browse to the "client.p12" file that was created previously. You should be prompted to enter the password for the client certificate.

6. Refresh your browser page, and you should get a successful response from your Tomcat server endpoint.