To launch an AWS\/EC2 instance, at first setting up a security group to specify what network traffic is allowed to reach the instance. Then select an AMI and launch an instance from it. And create a volume in the same zone of the instance and attach with it. Format the device and mount it to a directory. After that follow the steps to create SSL for Tomcat:<\/p>\n
1. For the tomcat we need java, so create a directory to save the Java Binary file.<\/p>\n
[shell] mkdir \/usr\/java
\ncd \/usr\/java [\/shell]<\/p>\n
2. Download jdk binary file (jdk-x-linux-ix.bin) here 3. Execute the Binary file<\/p>\n [shell] \/usr\/java\/jdk-x-linux-ix.bin [\/shell]<\/p>\n Now we have the Java in our device. Then Download the Tomcat and install it followed by the instructions:-<\/strong><\/p>\n 1. Create a directory to save the tomcat<\/p>\n [shell] mkdir \/usr\/tomcat 2. Download tomcat source file (apache-tomcat-x.tar.gz) here 3. Extract that file<\/p>\n [shell] tar -zxvf apache-tomcat-x.tar.gz [\/shell]<\/p>\n 4. Edit the catalina.sh file<\/p>\n [shell] vim \/usr\/tomcat\/apache-tomcat-x\/bin\/catalina.sh [\/shell]<\/p>\n [shell]<\/p>\n #** Add at the top ** [\/shell]<\/p>\n save and exit [shell] \/usr\/tomcat\/apache-tomcat-x\/bin\/startup.sh [\/shell]<\/p>\n 6. We can see the logs by using the given command<\/p>\n [shell]tail -f \/usr\/tomcat\/apache-tomcat-x\/logs\/catalina.out [\/shell]<\/p>\n 7. Take the browser and enter the URL http:\/\/localhost<\/span> 8. To stop the tomcat<\/p>\n [shell]\/usr\/tomcat\/apache-tomcat-x\/bin\/shutdown.sh [\/shell]<\/p>\n Now configure the SSL Certificate for tomcat. When you choose to activate SSL on your web server you will be prompted to complete a number of questions about the identity of your website and your company. Your web server then creates two cryptographic keys – a Private Key and a Public Key. The Public Key does not need to be secret and is placed into a Certificate Signing Request (CSR) – a data file also containing your details.<\/p>\n Create a self signed certificate authority (CA) and keystore.<\/strong><\/p>\n 1. Make a directory to hold the certs and keystore. This might be something like:<\/p>\n [shell] mkdir \/usr\/tomcat\/ssl 2. Generate a private key for the server and remember it for the next steps<\/p>\n [shell]openssl genrsa -des3 -out server.key 1024[\/shell]<\/p>\n Generating RSA private key, 1024 bit long modulus 3. Generate a CSR (Certificate Signing Request). Give the data after executing this command<\/p>\n [shell]openssl req -new -key server.key -out server.csr[\/shell]<\/p>\n Enter pass phrase for server.key: Please enter the following ‘extra’ attributes 4. Remove the passphrasse from the key<\/p>\n [shell]cp server.key server.key.org Enter pass phrase for server.key.org: 5. Generate the self signed certificate<\/p>\n [shell]openssl x509 -req -days 365 -in server.csr -signkey server.key -out server.crt[\/shell]<\/p>\n Signature ok You should then submit the CSR. During the SSL Certificate application process, the Certification Authority will validate your details and issue an SSL Certificate containing your details and allowing you to use SSL. Typically an SSL Certificate will contain your domain name, your company name, your address, your city, your state and your country. It will also contain the expiration date of the Certificate and details of the Certification Authority responsible for the issuance of the Certificate.<\/p>\n Create a certificate for tomcat and add both to the keystore<\/strong><\/p>\n 1. Change the path to ssl<\/p>\n [shell]cd \/usr\/tomcat\/ssl[\/shell]<\/p>\n 2. Create a keypair for ‘tomcat’<\/p>\n [shell]keytool -genkey -alias tom -keyalg RSA -keystore tom.ks[\/shell]<\/p>\n Enter keystore password: Is CN=Unknown, OU=Unknown, O=Unknown, L=Unknown, ST=Unknown, C=Unknown correct? Enter key password for <tom> 3. Generate a CSR (Certificate Signing Request) for tomcat<\/p>\n [shell]keytool -keystore tom.ks -alias tom -certreq -file tom.csr[\/shell]<\/p>\n Enter keystore password:<\/strong><\/p>\n 4. create unique serial number<\/p>\n [shell]echo 02 > serial.txt[\/shell]<\/p>\n 5. Sign the tomcat CSR<\/p>\n [shell]openssl x509 -CA server.crt -CAkey server.key -CAserial serial.txt -req -in tom.csr -out tom.cer -days 365[\/shell]<\/p>\n Signature ok 6. Import the server CA certificate into the keystore<\/p>\n [shell]keytool -import -alias serverCA -file server.crt -keystore tom.ks[\/shell]<\/p>\n Enter keystore password: 7. Add the tomcat certificate to the keystore<\/p>\n [shell]keytool -import -alias tom -file tom.cer -keystore tom.ks[\/shell]<\/p>\n Enter keystore password: To configure a secure (SSL) HTTP connector for Tomcat, verify that it is activated in the $TOMCAT_HOME\/conf\/server.xml file. Edit this file and add the following lines.<\/p>\n Tomcat configuration<\/strong><\/p>\n 1. Edit the given portion of tomcat configuretion file and change the port as 80<\/p>\n [shell]vim \/usr\/tomcat\/apache-tomcat-6.0.13\/conf\/server.xml[\/shell]<\/p>\n [shell]\u201c\u201d\u201d\u201d\u201d\u201d <Connector port=”8080″ protocol=”HTTP\/1.1″ <Connector port=”80″ protocol=”HTTP\/1.1″ [\/shell]<\/p>\n 2. Add the given portion to server.xml and give your password in the password portion<\/p>\n [shell]<\/p>\n <Connector port=”443″ protocol=”HTTP\/1.1″ SSLEnabled=”true” [\/shell]<\/p>\n When you start the Tomcat Your web server will match your issued SSL Certificate to your Private Key. Your web server will then be able to establish an encrypted link between the website and your customer’s web browser.<\/p>\n Start the tomcat with SSL Certificate<\/strong><\/p>\n 1. Restart tomcat<\/p>\n [shell]\/usr\/tomcat\/apache-tomcat-6.0.13\/bin\/shutdown.sh 2. Go to https:\/\/Public DNS name:443\/<\/span><\/p>\n Then your browser shows a security issue. Click the Approve button. Then you can enter to the tomcat with your certificate. When a browser connects to a secure site it will retrieve the site’s SSL Certificate and check that it has not expired, it has been issued by a Certification Authority the browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the browser will display a warning to the end user letting them know that the site is not secured by SSL.<\/p>\n You are Done !!!<\/p>\n","protected":false},"excerpt":{"rendered":" To launch an AWS\/EC2 instance, at first setting up a security group to specify what network traffic is allowed to reach the instance. Then select an AMI and launch an instance from it. And create a volume in the same zone of the instance and attach with it. Format the device and mount it to […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[34,3,17],"tags":[4,129,235,485,20,491,78,488,238,116,444,483,484,187,486,492,493,18,490,489,77,40,487,204,233,138],"class_list":["post-885","post","type-post","status-publish","format-standard","hentry","category-amazon-ec2","category-cloud-computing","category-iaas","tag-amazon","tag-amazon-ec2","tag-amazon-elastic-compute-cloud","tag-apache-tomcat","tag-aws","tag-certification-authority","tag-cloud","tag-company-my-screen-mobile","tag-dns","tag-http","tag-java","tag-java-enterprise-platform","tag-java-platform","tag-linux","tag-mobile-application-software","tag-private-key","tag-public-key","tag-s3","tag-secure-site","tag-security","tag-ssl","tag-tomcat","tag-web-browser","tag-web-server","tag-web-services","tag-xml"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t
\nUse URL http:\/\/www.oracle.com\/technetwork\/java\/archive-139210.html<\/span><\/p>\n
\ncd \/usr\/tomcat [\/shell]<\/p>\n
\nUse URL http:\/\/apache.hoxt.com\/tomcat\/tomcat-6\/v6.0.32\/bin\/<\/span><\/p>\n
\nJAVA_HOME=\/usr\/java\/jdk1.x.x_x<\/p>\n
\n5. Start the tomcat<\/p>\n
\nNow we can see the tomcat index page<\/p>\n
\ncd \/usr\/tomcat\/ssl [\/shell]<\/p>\n
\n…………………..++++++
\n…++++++
\ne is 65537 (0x10001)
\nEnter pass phrase for server.key:
\nVerifying – Enter pass phrase for server.key:<\/p>\n
\nYou are about to be asked to enter information that will be incorporated
\ninto your certificate request.
\nWhat you are about to enter is what is called a Distinguished Name or a DN.
\nThere are quite a few fields but you can leave some blank
\nFor some fields there will be a default value,
\nIf you enter ‘.’, the field will be left blank.
\n—–
\nCountry Name (2 letter code) [GB]:
\nState or Province Name (full name) [Berkshire]:
\nLocality Name (eg, city) [Newbury]:
\nOrganization Name (eg, company) [My Company Ltd]:
\nOrganizational Unit Name (eg, section) []:
\nCommon Name (eg, your name or your server’s hostname) []:
\nEmail Address []:<\/p>\n
\nto be sent with your certificate request
\nA challenge password []:
\nAn optional company name []:<\/p>\n
\nopenssl rsa -in server.key.org -out server.key[\/shell]<\/p>\n
\nwriting RSA key<\/p>\n
\nsubject=\/C=GB\/ST=Berkshire\/L=Newbury\/O=My Company Ltd
\nGetting Private key<\/p>\n
\nRe-enter new password:
\nWhat is your first and last name?
\n[Unknown]:
\nWhat is the name of your organizational unit?
\n[Unknown]:
\nWhat is the name of your organization?
\n[Unknown]:
\nWhat is the name of your City or Locality?
\n[Unknown]:
\nWhat is the name of your State or Province?
\n[Unknown]:
\nWhat is the two-letter country code for this unit?
\n[Unknown]:<\/p>\n
\n[no]: yes<\/p>\n
\n(RETURN if same as keystore password):
\nRe-enter new password:<\/p>\n
\nsubject=\/C=Unknown\/ST=Unknown\/L=Unknown\/O=Unknown\/OU=Unknown\/CN=Unknown
\nGetting CA Private Key<\/p>\n
\nOwner: O=My Company Ltd, L=Newbury, ST=Berkshire, C=GB
\nIssuer: O=My Company Ltd, L=Newbury, ST=Berkshire, C=GB
\nSerial number: ee13c90cb351968b
\nValid from: Thu May 19 02:12:51 EDT 2011 until: Fri May 18 02:12:51 EDT 2012
\nCertificate fingerprints:
\nMD5: EE:F0:69:01:4D:D2:DA:A2:4E:88:EF:DC:A8:3F:A9:00
\nSHA1: 47:97:72:EF:30:02:F7:82:BE:CD:CA:F5:CE:4E:ED:89:73:23:4E:24
\nSignature algorithm name: SHA1withRSA
\nVersion: 1
\nTrust this certificate? [no]: yes
\nCertificate was added to keystore<\/p>\n
\nCertificate reply was installed in keystore<\/p>\n
\nconnectionTimeout=”20000″
\nredirectPort=”8443″ \/> \u201c\u201d\u201d\u201d\u201d\u201d<\/p>\n
\nconnectionTimeout=”20000″
\nredirectPort=”8443″ \/><\/p>\n
\nmaxThreads=”150″ scheme=”https” secure=”true”
\nkeystoreFile=”tom.ks”
\nkeystorePass=”password”
\nclientAuth=”false” sslProtocol=”TLS” \/><\/p>\n
\n\/usr\/tomcat\/apache-tomcat-6.0.13\/bin\/startup.sh[\/shell]<\/p>\n