Breadcrumbs

Configuring Apache Tomcat to use Utimaco HSM for SSL

  1. Create a file /opt/tomcat/bin/setenv.sh and add the environment variables listed below.

›_ Console

# vim /opt/tomcat/bin/setenv.sh

ae05ba1c-3665-4de3-8794-3057dd453f54.jpg


Setting up environment

  1. Open the server.xml file

›_ Console

# vim /opt/tomcat/conf/server.xml

  1. Add the following entries for SSL to the connector section.

›_ Console

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
<SSLHostConfig>
<Certificate certificateKeystoreFile=""
certificateKeystorePassword="123456"
certificateKeystoreProvider="CryptoServer"
certificateKeystoreType="CryptoServer"
certificateKeyAlias="tomsslec"
</SSLHostConfig>

</Connector>

Here:

  • certificateKeystoreFile is blank as HSM is being used

  • certificateKeystoreType is CryptoServer

  • certificateKeystoreProvider is CryptoServer

  • certificateKeyAlias is the name of the key generated using the keytool command

  • certificateKeystorePassword is the PIN of the HSM key store

  1. Reload the daemon using:

›_ Console

# systemctl daemon-reload

  1. Restart Tomcat Service using:

›_ Console

# systemctl restart tomcat

  1. Confirm that the Tomcat status is running using:

›_ Console

# systemctl status tomcat

  1. The output below shows that it is running.

b386f66c-705f-4812-91a2-ad3bf604636c.jpg


Tomcat service status output

  1. Now access the page over https using https://<apache_tomcat_server_ip>:443

5149c67a-381d-47cd-a767-c400c23c2509.jpg


Browsing the page over https

This completes the integration of Apache Tomcat and Utimaco HSM.