In more details, we are going to implement the following setup:
- Setup Tomcat 7 listening on port 8080
- Redirect port 80 (HTTP) to port 443 (HTTPS)
- Use self signed RSA server certificates to authenticate our HTTPs server on clients and secure the TCP session.
Public and Private Server Key
In order to create the Server Public/Private key set we are going to use openSSL tools.To install them in you Fedora 22 server do:
# dnf install openssl # or for older Fedora systems # yum install openssl
Then openssl tools are installed to:
# which openssl /bin/openssl
Go to the apache httpd configuration directory and do the following:
# cd /etc/httpd/conf/
Generate a PEM RSA private key key using DES3
# openssl genrsa -des3 -passout pass:mypass -out server.pass.key 2048 Generating RSA private key, 2048 bit long modulus ..............................+++ ...................................................................................+++ e is 65537 (0x10001)
Create a Server PEM certificate request using the server key:
# openssl req -new -key server.pass.key -out server.csr Enter pass phrase for server.pass.key: # put mypass here You are about to be asked to enter information that will be incorporated into your certificate request. What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank. ----- Country Name (2 letter code) [AU]:GR State or Province Name (full name) [Some-State]:Athens Locality Name (eg, city) []:Athens Organization Name (eg, company) [Internet Widgits Pty Ltd]:Illumine IT Consulting Organizational Unit Name (eg, section) []: Common Name (e.g. server FQDN or YOUR name) []:www.illumineit.com Email Address []:info@illumine.gr Please enter the following 'extra' attributes to be sent with your certificate request A challenge password []: # press enter here to skip password An optional company name []: Illumine IT Consulting
Finally, create the server certificate using the PEM Certificate Request
# openssl x509 -req -in server.csr -signkey server.pass.key -out server.crt -days 365 Signature ok subject=/C=GR/ST=Athens/L=Athens/O=Illumine IT Consulting/CN=www.illumineit.com/emailAddress=info@illumineit.com Getting Private key Enter pass phrase for server.pass.key: # put mypass here
By the end of this operation you should have the following files created:
# ls -l -rw-r--r--. 1 root root 1318 Mar 7 18:11 server.crt -rw-r--r--. 1 root root 1115 Mar 7 18:07 server.csr -rw-r--r--. 1 root root 1743 Mar 7 18:05 server.pass.key
- server.ctr: is the server certificate
- server.csr: is the server PEM certificate request
- server.pass.key : server´s private RAS key.
Configure Apache HTTPd working with SSL certificates and reverse proxy to Tomcat
# vi /etc/httpd/conf/httpd.conf
Add the following section:
ServerRoot "/etc/httpd" # Port 80 (HTTP) will be redirected to 443 (HTTPS) Listen 80The first section VirtualHost configures Apache to redirect whatever goes to port 80 to be redirected to port 443 (HTTPS)ServerName www.illumineit.com Redirect permanent / https://www.illumineit.com # Port 443 HTTPS will be default Listen 443ServerName www.illumineit.com ServerAdmin my-mail-here # # Configure SSL engine on and add your certificates # SSLEngine on SSLCertificateFile conf/server.crt SSLCertificateKeyFile conf/server.key # # proxypass configuration to your tomcat server running on 8080 # ProxyPass /zsecure-pdf/ http://www.illumineit.com:8080/zsecure-pdf/ ProxyPassReverse /zsecure-pdf/ http://www.illumineit.com:8080/zsecure-pdf/ ProxyPassReverseCookieDomain www.illumineit.com www.illumineit.com ProxyPassReverseCookiePath /zsecure-pdf /zsecure-pdf ProxyPassReverse / SetOutputFilter proxy-html RequestHeader unset Accept-Encoding BrowserMatch "MSIE [2-5]" \ nokeepalive ssl-unclean-shutdown \ downgrade-1.0 force-response-1.0
The second section VirtualHost configures Apache to use Tomcat as reverse Proxy. So if someone requests URI path /zsecure-pdf/ this will be redirected to port 8080 where tomcat listens.
Save and restart the Apache HTTPD:
# service httpd restart Redirecting to /bin/systemctl restart httpd.service
Test Apache
Hit with browser http://www.illumineit.com this will redirect you to https://www.illumineit.comif you also navigate to the path that was reverse pass: https://31.171.245.82/zsecure-pdf/secure-my-pdf-to-image-password-encrypt-and-watermark.html then you will be served from Tomcat serving your application.
Potential problems
AH01114: HTTP: failed to make connection to backendTo get rid of this log to your server as root and run those commands:
/usr/sbin/setsebool httpd_can_network_connect 1 /usr/sbin/setsebool -P httpd_can_network_connect 1
Page does not renders correctly: images and CSS are missing. That is very common since HTML pages might taken from other sites by A HREF. The only think you can do is copy them locally to WebContent directory of your WAR deployment.
