물꼬기의 프로젝트 이야기

You can enable SSL support for a particular instance of this Connector by setting the SSLEnabledattribute to true.

You will also need to set the scheme and secure attributes to the values https and true respectively, to pass correct information to the servlets.

The BIO and NIO connectors use the JSSE SSL whereas the APR/native connector uses OpenSSL. Therefore, in addition to using different attributes to configure SSL, the APR/native connector also requires keys and certificates to be provided in a different format.

For more information, see the SSL Configuration HOW-TO.

SSL Support - BIO and NIO

The BIO and NIO connectors use the following attributes to configure SSL: Attribute Description algorithm The certificate encoding algorithm to be used. This defaults to KeyManagerFactory.getDefaultAlgorithm() which returns SunX509 for Sun JVMs. IBM JVMs return IbmX509. For other vendors, consult the JVM documentation for the default value. allowUnsafeLegacyRenegotiation Is unsafe legacy TLS renegotiation allowed which is likely to expose users to CVE-2009-3555, a man-in-the-middle vulnerability in the TLS protocol that allows an attacker to inject arbitrary data into the user's request. If not specified, a default of false is used. This attribute only has an effect if the JVM does not support RFC 5746 as indicated by the presence of the pseudo-ciphersuite TLS_EMPTY_RENEGOTIATION_INFO_SCSV. This is available JRE/JDK 6 update 22 onwards. Where RFC 5746 is supported the renegotiation - including support for unsafe legacy renegotiation - is controlled by the JVM configuration. useServerCipherSuitesOrder Set to true to enforce the server's cipher order (from the ciphers setting). Set to false to choose the first acceptable cipher suite presented by the client. Use of this feature requires Java 8 or later. Default is undefined, leaving the choice up to the JSSE implementation. ciphers The comma separated list of encryption ciphers to support for HTTPS connections. If specified, only the ciphers that are listed and supported by the SSL implementation will be used. By default, the default ciphers for the JVM will be used less those considered to be insecure. Note that with older JVMs this will result in a very limited set of ciphers being available by default. The ciphers are specified using the JSSE cipher naming convention. The special value of ALL will enable all supported ciphers. This will include many that are not secure. ALL is intended for testing purposes only. clientAuth Set to true if you want the SSL stack to require a valid certificate chain from the client before accepting a connection. Set to want if you want the SSL stack to request a client Certificate, but not fail if one isn't presented. A false value (which is the default) will not require a certificate chain unless the client requests a resource protected by a security constraint that uses CLIENT-CERT authentication. clientCertProvider When client certificate information is presented in a form other than instances of java.security.cert.X509Certificate it needs to be converted before it can be used and this property controls which JSSE provider is used to perform the conversion. For example it is used with the AJP connectors, the HTTP APR connector and with the org.apache.catalina.valves.SSLValve. If not specified, the default provider will be used. crlFile The certificate revocation list to be used to verify client certificates. If not defined, client certificates will not be checked against a certificate revocation list. The file may be specified using a URL, an absolute path or a relative (to CATALINA_BASE) path. keyAlias The alias used for the server key and certificate in the keystore. If not specified, the first key read from the keystore will be used. The order in which keys are read from the keystore is implementation dependent. It may not be the case that keys are read from the keystore in the same order as they were added. If more than one key is present in the keystore it is strongly recommended that a keyAlias is configured to ensure that the correct key is used. keyPass The password used to access the server certificate from the specified keystore file. The default value is "changeit". keystoreFile The pathname of the keystore file where you have stored the server certificate to be loaded. By default, the pathname is the file ".keystore" in the operating system home directory of the user that is running Tomcat. If yourkeystoreType doesn't need a file use "" (empty string) for this parameter. The file may be specified using a URL, an absolute path or a relative (to CATALINA_BASE) path. keystorePass The password used to access the specified keystore file. The default value is the value of the keyPass attribute. keystoreProvider The name of the keystore provider to be used for the server certificate. If not specified, the list of registered providers is traversed in preference order and the first provider that supports the keystoreType is used. keystoreType The type of keystore file to be used for the server certificate. If not specified, the default value is "JKS". sessionCacheSize The number of SSL sessions to maintain in the session cache. Use 0 to specify an unlimited cache size. If not specified, a default of 0 is used. sessionTimeout The time, in seconds, after the creation of an SSL session that it will timeout. Use 0 to specify an unlimited timeout. If not specified, a default of 86400 (24 hours) is used. sslEnabledProtocols The comma separated list of SSL protocols to support for HTTPS connections. If specified, only the protocols that are listed and supported by the SSL implementation will be enabled. If not specified, the JVM default (excluding SSLv2 and SSLv3 if the JVM enables either or both of them by default) is used. The permitted values may be obtained from the JVM documentation for the allowed values for SSLSocket.setEnabledProtocols() e.g. Oracle Java 6and Oracle Java 7. Note: There is overlap between this attribute and sslProtocol. sslImplementationName The class name of the SSL implementation to use. If not specified, the default of org.apache.tomcat.util.net.jsse.JSSEImplementation will be used which wraps JVM's default JSSE provider. Note that the JVM can be configured to use a different JSSE provider as the default. sslProtocol The SSL protocol(s) to use (a single value may enable multiple protocols - see the JVM documentation for details). If not specified, the default is TLS. The permitted values may be obtained from the JVM documentation for the allowed values for algorithm when creating anSSLContext instance e.g. Oracle Java 6 and Oracle Java 7. Note: There is overlap between this attribute andsslEnabledProtocols. trustManagerClassName The name of a custom trust manager class to use to validate client certificates. The class must have a zero argument constructor and must also implement javax.net.ssl.X509TrustManager. If this attribute is set, the trust store attributes may be ignored. trustMaxCertLength The maximum number of intermediate certificates that will be allowed when validating client certificates. If not specified, the default value of 5 will be used. truststoreAlgorithm The algorithm to use for truststore. If not specified, the default value returned byjavax.net.ssl.TrustManagerFactory.getDefaultAlgorithm() is used. truststoreFile The trust store file to use to validate client certificates. The default is the value of the javax.net.ssl.trustStore system property. If neither this attribute nor the default system property is set, no trust store will be configured. The file may be specified using a URL, an absolute path or a relative (to CATALINA_BASE) path. truststorePass The password to access the trust store. The default is the value of the javax.net.ssl.trustStorePassword system property. If that property is null, no trust store password will be configured. If an invalid trust store password is specified, a warning will be logged and an attempt will be made to access the trust store without a password which will skip validation of the trust store contents. truststoreProvider The name of the truststore provider to be used for the server certificate. The default is the value of thejavax.net.ssl.trustStoreProvider system property. If that property is null, the value of keystoreProvider is used as the default. If neither this attribute, the default system property nor keystoreProvideris set, the list of registered providers is traversed in preference order and the first provider that supports the truststoreType is used. truststoreType The type of key store used for the trust store. The default is the value of the javax.net.ssl.trustStoreType system property. If that property is null, the value of keystoreType is used as the default.

SSL Support - APR/Native

When APR/native is enabled, the HTTPS connector will use a socket poller for keep-alive, increasing scalability of the server. It also uses OpenSSL, which may be more optimized than JSSE depending on the processor being used, and can be complemented with many commercial accelerator components. Unlike the HTTP connector, the HTTPS connector cannot use sendfile to optimize static file processing. The HTTPS APR/native connector has the same attributes than the HTTP APR/native connector, but adds OpenSSL specific ones. For the full details on using OpenSSL, please refer to OpenSSL documentations and the many books available for it (see the Official OpenSSL website). The SSL specific attributes for the APR/native connector are: Attribute Description SSLCACertificateFile See the mod_ssl documentation. SSLCACertificatePath See the mod_ssl documentation. SSLCARevocationFile See the mod_ssl documentation. SSLCARevocationPath See the mod_ssl documentation. SSLCertificateChainFile See the mod_ssl documentation. SSLCACertificateFile Name of the file that contains the concatenated certificates for the trusted certificate authorities. The format is PEM-encoded. SSLCACertificatePath Name of the directory that contains the certificates for the trusted certificate authorities. The format is PEM-encoded. SSLCARevocationFile Name of the file that contains the concatenated certificate revocation lists for the certificate authorities. The format is PEM-encoded. SSLCARevocationPath Name of the directory that contains the certificate revocation lists for the certificate authorities. The format is PEM-encoded. SSLCertificateChainFile Name of the file that contains concatenated certifcates for the certificate authorities which form the certifcate chain for the server certificate. The format is PEM-encoded. SSLCertificateFile Name of the file that contains the server certificate. The format is PEM-encoded. In addition to the certificate, the file can also contain as optional elements DH parameters and/or an EC curve name for ephemeral keys, as generated by openssl dhparam and openssl ecparam, respectively. The output of the respective OpenSSL command can simply be concatenated to the certificate file. This feature needs APR/native version 1.1.34 or later. SSLCertificateKeyFile Name of the file that contains the server private key. The format is PEM-encoded. The default value is the value of "SSLCertificateFile" and in this case both certificate and private key have to be in this file (NOT RECOMMENDED). SSLCipherSuite Ciphers which may be used for communicating with clients. The default is "HIGH:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!kRSA". See the OpenSSL documentation for details of the cipher configuration options. SSLDisableCompression Disables compression if set to true and OpenSSL supports disabling compression. Default is false which inherits the default compression setting in OpenSSL. SSLHonorCipherOrder Set to true to enforce the server's cipher order (from the SSLCipherSuite setting) instead of allowing the client to choose the cipher (which is the default). SSLPassword Pass phrase for the encrypted private key. If "SSLPassword" is not provided, the callback function should prompt for the pass phrase. SSLProtocol The names of the protocols to support when communicating with clients. This should be a list of any combination of the following: SSLv2 SSLv3 TLSv1 TLSv1.1 TLSv1.2 all Each token in the list can be prefixed with a plus sign ("+") or a minus sign ("-"). A plus sign adds the protocol, a minus sign removes it form the current list. The list is built starting from an empty list. The token all is an alias for TLSv1+TLSv1.1+TLSv1.2. If more than one protocol is specified for an OpenSSL based secure connector it will always support SSLv2Hello. If a single protocol is specified it will not support SSLv2Hello. Note that SSLv2 and SSLv3 are inherently unsafe. If not specified, the default value of all will be used. SSLVerifyClient Ask client for certificate. The default is "none", meaning the client will not have the opportunity to submit a certificate. Other acceptable values include "optional", "require" and "optionalNoCA". SSLVerifyDepth Maximum verification depth for client certificates. The default is "10".

Below is a small chart that shows how the connectors differ.

                       Java Blocking Connector   Java Non Blocking Connector   APR/native Connector
                                 BIO                         NIO                       APR
    Classname              Http11Protocol             Http11NioProtocol         Http11AprProtocol
    Tomcat Version           3.x onwards                 6.x onwards              5.5.x onwards
    Support Polling              NO                          YES                       YES
    Polling Size                 N/A                   maxConnections             maxConnections
    Read Request Headers      Blocking                  Non Blocking                 Blocking
    Read Request Body         Blocking                    Blocking                   Blocking
    Write Response            Blocking                    Blocking                   Blocking
    Wait for next Request     Blocking                  Non Blocking               Non Blocking
    SSL Support               Java SSL                    Java SSL                   OpenSSL
    SSL Handshake             Blocking                  Non blocking                 Blocking
    Max Connections        maxConnections              maxConnections             maxConnections