Re: [OT] ssl client certificate authentication

2013-07-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 7/11/13 2:04 PM, Christopher Schultz wrote: > Mark, > > On 7/10/13 7:39 AM, Mark Thomas wrote: >> On 10/07/2013 12:25, Jan Vávra wrote: >>> Hi all. I've studied the documentation at >>> http://tomcat.apache.org/tomcat-7.0-doc/config/http.

Re: [OT] ssl client certificate authentication

2013-07-11 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Mark, On 7/10/13 7:39 AM, Mark Thomas wrote: > On 10/07/2013 12:25, Jan Vávra wrote: >> Hi all. I've studied the documentation at >> http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support >> and I have several questions on it. >> >>

Re: ssl client certificate authentication

2013-07-10 Thread Jan Vávra
2. It seems me that checking of revocation of client certificate is done via "static" crl files located in APR's SSLCARevocationPath or JSSE's crlFile. If I write a cron task that periodically downloads crl list(s), will the Tomcat react on this change of CRL file(s)? I've found in org.apache.ht

Re: ssl client certificate authentication

2013-07-10 Thread Mark Thomas
On 10/07/2013 12:25, Jan Vávra wrote: > Hi all. > I've studied the documentation at > http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support and > I have several questions on it. > > 1. While the APR/Native has config option SSLCACertificateFile that > defines the set of allowed clie

ssl client certificate authentication

2013-07-10 Thread Jan Vávra
Hi all. I've studied the documentation at http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support and I have several questions on it. 1. While the APR/Native has config option SSLCACertificateFile that defines the set of allowed client cert authorities the JSSE SSL has no analog