Tomcat Client Authentication using SSL

Question

I'm at a loss, since I'm not a Tomcat person. I need to use a 3rd party's web service and they require Client Authentication via SSL, so they generated and issued me an SSL certificate. Unfortunately this is as far as they support it and cannot give me any direction on how to actually use it. I'm stuck using this 3rd party so unfortunately I have to put up with their lack of support.

So what I have is a Java application that a vendor is supplying for us (who apparently has never had to deal with this), a Tomcat app server running 6.0.20 on CentOS 5.3, and the SSL cert from the 3rd party.

What all do I need to do at this point? All I can find online is how to set up a keystore so that my app can use Client Authentication against things connecting to it, not for when it needs to connect out to someone else, or how to use SSL over port 8443 (which I know how to do already and have set up).

Answer 1

Here's the really long answer: http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html

Don't take my word for it, but I believe that, as a client, client auth will automatically be performed when the server requests it.

If configuring tomcat is the question, have you read http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html? In particular, note the clientAuth attribute of the Connector element.

Answer 2

I don't know that this is about configuring Tomcat, other than to be able to pass in system properties to a web application running in Tomcat.

The vendor that supplies the web application really should be able to tell you how to get the client connection from their software to use a specific client certificate when making an SSL connection to a remote web service.

For instance, they could have their application implement a custom KeyManager for SSL connections that is able to look up the client certificate and private key from a configurable location.

If they haven't done that, they are probably using the default SunX509 KeyManager.

For the default KeyManager, you can apparently use keytool to create a keystore containing the client certificate and private key the certificate describes. Then you can specify that key store using the following system parameters:

-Djavax.net.ssl.keyStore="/path/to/keystore"
-Djavax.net.ssl.keyStorePassword="<password>"

You will need to configure Tomcat to pass in these properties.