0

I'm trying to setup a CAS-based echosystem on the Jelastic infrastructure. I was able to setup both the server and a client under the same Tomcat 7 instance, using the example web application described here. The SSL certificates (CA and server's) I'm using are self signed.

When asking for a protected resource, the webapp correctly redirects to the CAS login page, and the authentication is done well at server level. However, in the return flow something goes bad and the browser shows an exception that has the following root cause:

javax.net.ssl.SSLHandshakeException: 
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: 
unable to find valid certification path to requested target
Caused by: sun.security.validator.ValidatorException: 
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: 
unable to find valid certification path to requested target

This is because the CAS protocol has an additional client-server verification dialogue that is done immediately after the authentication, and during this dialogue the client has to trust the server again. This time, it doesn't use Tomcat's SSL settings but the ones of the JVM (see here)

The problem is that on Jelastic there's no way to access the JAVA_HOME/jre/lib/security folder, as far I know. Any hint? Thanks.

UPDATE: I've found the solution. On Jelastic, since v.1.8.5, Tomcat apps have write rights on the the JAVA_HOME/jre/lib/security folder. This IMHO opens a security issue, but for this specific case was good. I've been able to write a simple servlet that added my certificate to the JVM cacerts file, and I've solved the problem.

user3407016
  • 11
  • 4

1 Answers1

0

If I understood correctly, you need exactly the same certificate installed on Tomcat AND on the JVM itself?

Currently the Jelastic SSL install option only installs the certificate onto the application/web server (in this case, Tomcat). To install it on the JVM as well you need to seek assistance from your hosting provider.

You should also ask them to raise a feature request for this functionality with the development team; I suppose it would be useful to install the certificate to both places (Tomcat and JVM) by default?

(are there cases you can see where it would be useful to have different certificates for each?)

Damien - Layershift
  • 1,508
  • 8
  • 15
  • Yes, I need the same certificate on both cert stores (Tomcat and JVM). But I've found the way to add it by myself. (see my own response). Thanks. – user3407016 Mar 12 '14 at 15:12