0

I have a 3 Tomcat application servers with 3 Apache servers in front. Communication between Apache and Tomcats is done via mod_jk. I need to have secure connections between the Tomcat and Apache servers. To make this connection secured, it has to be encrypted and authenticated (to prevent man in the middle attacks).

To be clear, I am not trying to authenticate clients. Only to make sure that traffic between Tomcat and Apache cannot be sniffed.

I've been looking around, but I cant find a way to have mod_jk authenticate the certificates exposed by Tomcat. Any idea where I should be looking ?

Thanks for your help !

Guillaume
  • 1,063
  • 5
  • 12
  • 24
  • AJP connections are not encrypted. Are you looking to authenticate the Tomcat servers to verify their identity, or the clients connecting to Apache? – Shane Madden Jun 07 '11 at 14:54
  • I am trying to authenticate the Tomcat servers. I'll update the question. – Guillaume Jun 08 '11 at 08:31
  • Unfortunately, I don't think server authentication is possible via an AJP connector. You may be forced to switch to HTTPS if that's a requirement. – Shane Madden Jun 08 '11 at 14:45

1 Answers1

1

Unfortunately, I don't think server authentication is possible via an AJP connector.

While client certificates can be communicated to the Tomcat server via SSLOptions +ExportCertData, the AJP connection itself is in the clear and has no means of authenticating either the AJP client (Apache) or the AJP server (Tomcat) in either direction.

You may be forced to switch to HTTPS if server authentication is required. If there's a reason that AJP is needed, there are options adding extra security layers outside of the AJP protocol for doing mutual authentication and connection security; SSH port forwarding or IPsec policies come to mind.

Shane Madden
  • 114,520
  • 13
  • 181
  • 251
  • I cannot get client certificates to communicate to tomcat in this setting. Could you help? https://stackoverflow.com/questions/58240796/pass-username-and-client-certificate-from-apache-to-tomcat-using-mod-jk – user157726 Oct 05 '19 at 07:42