Robert,
On 12/9/20 17:54, Robert Turner wrote:
I am trying to configure Tomcat 9.0.37 (or later if I need to) to use both
an RSA and an ECC certificate for the same host.
Platform is Windows 2008 R2, with the Tomcat Native 1.2.24 library
installed.
Do you know if you are using the APR connector or the NIO(2) connector?
My configuration is roughly as follows:
<SSLHostConfig protocols="TLSv1.3,TLSv1.2"
honorCipherOrder="true"
ciphers="<omitted for simplicity>"
hostName="*.blahblah.com">
<Certificate certificateKeyFile="conf/blahblah_com_priv.key"
certificateFile="conf/blahblah_com.crt"
certificateChainFile="conf/blahblah_com.intermediate.crt"
type="RSA"
/>
<Certificate
certificateKeyFile="conf/blahblah_com_com-ECC.private.key"
certificateFile="conf/blahblah_com-ECC.pem"
certificateChainFile="conf/blahblah_com-ECC.intermediate.pem"
type="EC"
/>
</SSLHostConfig>
The only change I've made was to add the additional Certificate element for
the ECC certificate (so I believe everything else about our configuration
is all good.
When I run "testssh.sh" against the host, I end up with a failed
certificate chain for the RSA certificate. The ECC certificate is all fine
though, and before adding the ECC certificate, the RSA certificate was fine.
Hmm. So if you specify either RSA or EC alone, with the certificate
chain, all is well (aside from the fact that you can only use one of the
two certs)?
What does testssh.sh do?
I've dug into the documentation and found this statement with reference to
the certificateChainFile parameter:
"Note that when using more than one certificate for different types, they
all must use the same certificate chain"
So I checked the Git repo, and that was added with a commit comment that
references the Apache HTTP configuration which states something slightly
differently:
"But be careful: Providing the certificate chain works only if you are
using a single RSA or DSA based server certificate. If you are using a
coupled RSA+DSA certificate pair, this will work only if actually both
certificates use the same certificate chain. Else the browsers will be
confused in this situation."
The two statements suggest slightly different things. However the second
doesn't suggest that ECC and RSA cannot be combined with different chains.
Is there any way to have two different certificate chains for the ECC and
RSA certificates and get it working with Tomcat/OpenSSL? (as we don't have
certificates with the same chains as our provider seems to use different
intermediate CAs for ECC versus RSA).
Yeah... it's possible for a CA to use a single cert to sign both EC and
RSA keys, but yours appears to use different ones. Any chance you can
request a re-issue of one of your certificates using the other type of
signing certificate? You will almost certainly have to call and request
this from your CA.
I don't know why the two certs have to have the same chain when you use
SSLCertificateChainFile. Oh, I think it's because there isn't a way to
say in httpd which certificate which chain goes with, so there can be
only one (effective) directive for that.
What happens if you pack everything into (each of) your certificateFile
and don't use certificateChainFile *at all*?
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
