Re: SSL trouble in embeddedLand

2021-01-22 Thread Rob Sargent
On 1/22/21 3:06 PM, Christopher Schultz wrote: You are telling keytool to read-in localhost-rsa-key.pem as a PKCS12 file, which is most likely wrong. You don't want to import a keystore, you want to import a key. Unfortunately, keytool doesn't allow that. But openssl does: $ openssl pkcs1

Re: SSL trouble in embeddedLand

2021-01-22 Thread Christopher Schultz
Rob, On 1/22/21 15:21, Rob Sargent wrote: For completeness, I must admit that I was unable to use PKCS12 files.  I had to use JKS format. I copied and transformed my cacerts files as per keytool recommendation:    keytool -importkeystore -srckeystore    /usr/lib/jvm/java-15-oracle/lib/sec

Re: Reg: Jars under web-inf lib being accessed by tomcat even when the application is not running.

2021-01-22 Thread Christopher Schultz
Jalaj, On 1/22/21 13:50, Jalaj Asher wrote: The files are being reopened and then closed and then again reopened. Sounds fishy. Can you post as much of your conf/server.xml, conf/context.xml, and your application's META-INF/context.xml files as you can? -chris -Original Message-

Re: SSL trouble in embeddedLand

2021-01-22 Thread Rob Sargent
For completeness, I must admit that I was unable to use PKCS12 files.  I had to use JKS format. I copied and transformed my cacerts files as per keytool recommendation: keytool -importkeystore -srckeystore /usr/lib/jvm/java-15-oracle/lib/security/cacerts -destkeystore /tmp/key/cacert

Re: [OT] Security Vulnerability -Default files

2021-01-22 Thread Bill Stewart
On Fri, Jan 22, 2021 at 11:49 AM Christopher Schultz wrote: > I think the OP is a non-native English speaker. I interpreted this to > mean "I'm hoping to get some help you you and this group." I appreciate the less-entitled potential interpretation. Bill

RE: Reg: Jars under web-inf lib being accessed by tomcat even when the application is not running.

2021-01-22 Thread Jalaj Asher
The files are being reopened and then closed and then again reopened. Regards Jalaj P Asher -Original Message- From: Christopher Schultz Sent: Friday, January 22, 2021 1:47 PM To: users@tomcat.apache.org Subject: Re: Reg: Jars under web-inf lib being accessed by tomcat even when the ap

Re: [OT] Security Vulnerability -Default files

2021-01-22 Thread Christopher Schultz
Bill, On 1/22/21 12:26, Bill Stewart wrote: On Thu, Jan 21, 2021 at 8:43 PM Nitin Kadam wrote: I am from a Windows Administrator background and hence facing these challenges, So expecting help from you and this group. "Expecting help from you and this group": This phrasing makes it sound lik

Re: Reg: Jars under web-inf lib being accessed by tomcat even when the application is not running.

2021-01-22 Thread Christopher Schultz
Jalaj, On 1/22/21 11:39, Jalaj Asher wrote: We have not set the autoreload setting at all. I believe by default its set to false. Please correct me if that’s not the case. Also manager is disabled in our environment. I used the watch command along with lsof highlighted below . Watch "lsof /WEB

Re: Security Vulnerability -Default files

2021-01-22 Thread Bill Stewart
On Thu, Jan 21, 2021 at 8:43 PM Nitin Kadam wrote: > I am from a Windows Administrator background and hence facing these > challenges, So expecting help from you and this group. "Expecting help from you and this group": This phrasing makes it sound like you think you are entitled to something. P

RE: Reg: Jars under web-inf lib being accessed by tomcat even when the application is not running.

2021-01-22 Thread Jalaj Asher
Hi Chris, We have not set the autoreload setting at all. I believe by default its set to false. Please correct me if that’s not the case. Also manager is disabled in our environment. I used the watch command along with lsof highlighted below . Watch "lsof /WEB-INF/lib/*.jar" Jalaj -Origi

Re: Extensibility of LegacyCookieProcessor?

2021-01-22 Thread Polina Georgieva
Hi Chris, > The SameSite attribute should be ignored by browsers that do not support it. Which browser are you trying to work-around? You can find more information about the incompatible browsers here: https://www.chromium.org/updates/same-site/incompatible-clients >The newer cookie parser