0

I've managed to make my Ubuntu support HTTPS. If on Chrome I want to see a page located in /var/www it is displayed good (green lock on the side).

But I have problems on tomcat. If I want to see a page on tomcat in Chrome, I get a security warning (and a red lock). Also, In Android, I can issue requests via GET, but for POST requests I get javax.net.ssl.SSLHandshakeException: Handshake failed. I didn't know how to get a keystore, so I created one and made server.xml support it via <Connector.... Is it the problem?

How can I make tomcat support POST and not only GET?

1 Answer 1

0

Well if you need to run tomcat to use HTTPS thene you need keystore to be created and if you need to run the same in 443 port you need to configure ubuntu to allow tomcat using the privileged ports. Port numbers less that 1024 are privileged ports. So you need to do the follows steps. I am very unsure of how much you have done or achieved.Meanwhile I detail the following steps.

Tomcat7 on Privileged Ports (:80,443)
1) In server.xml, change the line

 <Server port="8005" shutdown="SHUTDOWN">
    <Connector port="80" maxHttpHeaderSize="8192" protocol="HTTP/1.1" 
            maxThreads="150" minSpareThreads="25" maxSpareThreads="75" 
            enableLookups="false" redirectPort="443" acceptCount="100" 
            connectionTimeout="20000" disableUploadTimeout="true" 
            socketBuffer="18000" 
            compression="on" URIEncoding="UTF-8" 
            compressionMinSize="2048" 
            noCompressionUserAgents="gozilla, traviata" 
            compressableMimeType="application/javascript,text/html,text/xml,text/javascript,text/css,text/plain,application/json,text/json,a    pplication/xml"/>

<Connector port="443" maxHttpHeaderSize="8192" protocol="HTTP/1.1" SSLEnabled="true" 
        scheme="https" secure="true" 
        keystoreFile="/path/to/my.keystore" keystorePass="changeit" 
        clientAuth="false" sslProtocol="TLS" 
        maxThreads="350" minSpareThreads="25" maxSpareThreads="75" 
        enableLookups="false" acceptCount="100" 
        connectionTimeout="60000" disableUploadTimeout="true" 
        bufferSize="4096" 
        compression="on" 
        compressionMinSize="2048" URIEncoding="UTF-8" 
        noCompressionUserAgents="gozilla, traviata" 
        compressableMimeType="application/javascript, text/html, text/xml,text/javascript, text/css,text/plain,     application/json,text/json,application/xml"/>


2) Install authbind

sudo apt-get install authbind

3) Make port 80 available to authbind (you need to be root):

sudo su
touch /etc/authbind/byport/80
chmod 500 /etc/authbind/byport/80
chown tomcat7 /etc/authbind/byport/80
touch /etc/authbind/byport/443
chmod 500 /etc/authbind/byport/443
chown tomcat7 /etc/authbind/byport/443

4) Make IPv4 the default (authbind does not currently support IPv6). To do so, create the file $TOMCAT_HOME/bin/setenv.sh with the following content:

CATALINA_OPTS="-Djava.net.preferIPv4Stack=true"
AUTHBIND=yes

5) Change /usr/share/tomcat7/bin/startup.sh last line to something as follows.

exec authbind --deep "$PRGDIR"/"$EXECUTABLE" start "$@"
# OLD: exec "$PRGDIR"/"$EXECUTABLE" start "$@"

Tomcat Keystore generation steps:

  1. To generate SSL key, run the following command in the Terminal

$JAVA_HOME/bin/keytool -genkey -alias Tomcat -keysize 2048 -keyalg RSA -validity 3650 -keystore /path/to/my.keystore

Provide the necessary information and set the password. The default password is “changeit”.

  1. Grant execute permission to the my.keystore file

chmod 777 /path/to/my.keystore

Thats it.

Note: I have posted connector tags of tomcat server.xml for a production environment. if you are running it in pre-production environment with low server config better avoid or reduce options inside the tags like max-min-Threads, lookups, timesouts etc at your ease.

10
  • Now, I can find a page in a regular HTTP and port 8080, but in HTTPS and port 443 it is not found (via Apache).
    – Ran
    Aug 28, 2016 at 6:16
  • post log while accessing https 443 and post output of the following command also netstat -nltp
    – SAGAR Nair
    Aug 28, 2016 at 10:49
  • I don't see any log when trying on port 443. And the output is: Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name tcp 0 0 127.0.0.1:8005 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
    – Ran
    Aug 28, 2016 at 11:17
  • tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN - tcp6 0 0 :::139 :::* LISTEN - tcp6 0 0 :::80 :::* LISTEN - tcp6 0 0 :::22 :::* LISTEN - tcp6 0 0 :::443 :::* LISTEN - tcp6 0 0 :::445 :::* LISTEN -
    – Ran
    Aug 28, 2016 at 11:17
  • I have to say that if I use code below, I can post, but the variables are null (Like setEntity doesn't work - null gets to the method in tomcat): mobiledevguide.com/2013/07/…,
    – Ran
    Aug 28, 2016 at 11:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .