3

I distribute a Java desktop application that needs to communicate with some RESTful APIs served by embedded Tomcat within a Spring Boot webapp.

I was planning on using a self-signed certificate for communication between the desktop and the server. But if I later want to expose some public web pages needing encryption I believe I will need a commercial certificate for that.

Is it possible to use multiple certificates in Tomcat? If so, how does the server distinguish which requests are encrypted by which certificate?

1 Answers1

2

The protocol itself does not allow you to host two SSL certificates on the same port on the same IP.

From the Tomcat SSL Configuration HOW-TO:

Using name-based virtual hosts on a secured connection can be problematic. This is a design limitation of the SSL protocol itself. The SSL handshake, where the client browser accepts the server certificate, must occur before the HTTP request is accessed. As a result, the request information containing the virtual host name cannot be determined prior to authentication, and it is therefore not possible to assign multiple certificates to a single IP address.

An email to the Tomcat Users List states that you can do this with "a Connector and associated keystore per IP (or IP/port) you want to secure."

This will let you serve on separate ports (e.g. 0.0.0.0:443 publicly and 0.0.0.0:4443 for your API) and/or addresses (e.g. 192.0.2.1:443 publicly and 192.0.2.2:443 for your API).

It is theoretically possible to make this distinction on a per-interface or per-CIDR level before the SSL handshake (e.g. traffic from 192.168.0.1/16 gets one cert, other traffic gets the other cert), but I don't know of any single piece of software that does this; you'd need to use port forwarding via your firewall.

To do this with simple port forwarding: Forward connections from your internal infrastructure on port 443 to local port 4443 and serve your internal SSL cert on port 4443 within Tomcat.

Note: I've never heard of this being done.

Adam Katz
  • 951
  • 8
  • 17
  • 1
    Not true! See "Server Name Indication"! – peterh Mar 28 '15 at 06:01
  • 1
    @peterh: Nice, I didn't know [Server Name Indication](https://en.wikipedia.org/wiki/Server_Name_Indication) had ever matured. You are correct: SNI allows a [TLS](https://en.wikipedia.org/wiki/Transport_layer_security) connection to negotiate certificates after identification. Still, **Tomcat does [not support](https://en.wikipedia.org/wiki/Server_Name_Indication#No_support) SNI**. – Adam Katz Mar 28 '15 at 06:23
  • You have right - it would need a hybride solution (apache proxyes to tomcat by mod_ajk). – peterh Apr 03 '15 at 03:01