{"componentChunkName":"component---node-modules-gatsby-theme-blog-core-src-templates-post-query-js","path":"/lets-encrypt-for-tomcat-7-on-ds/","result":{"data":{"site":{"siteMetadata":{"title":"one melo a day","social":[{"name":"twitter","url":"https://twitter.com/melo0187"},{"name":"github","url":"https://github.com/melo0187"}]}},"blogPost":{"__typename":"MdxBlogPost","id":"703f4203-112a-57c0-9975-ecd2b70d909c","excerpt":"In my  last blog post  I described the benefits of HTTPS and how to set up your Synology DiskStation to use HTTPS with a trusted certificate…","body":"function _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"layout\": \"post\",\n  \"title\": \"HTTPS for Tomcat 7 with Let's Encrypt\",\n  \"author\": \"melo\",\n  \"date\": \"2016-02-13T13:21:36.000Z\",\n  \"categories\": [\"DiskStation\", \"https\", \"Let's Encrypt\", \"Technical\", \"Tomcat\"],\n  \"slug\": \"lets-encrypt-for-tomcat-7-on-ds\",\n  \"draft\": false,\n  \"meta_title\": \"HTTPS for Tomcat 7 with Let's Encrypt\"\n};\n\nvar makeShortcode = function makeShortcode(name) {\n  return function MDXDefaultShortcode(props) {\n    console.warn(\"Component \" + name + \" was not imported, exported, or provided by MDXProvider as global scope\");\n    return mdx(\"div\", props);\n  };\n};\n\nvar Connector = makeShortcode(\"Connector\");\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, [\"components\"]);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"p\", null, \"In my \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/get-https-on-diskstation-with-lets-encrypt/\"\n  }), \"last blog post\"), \" I described the benefits of HTTPS and how to set up your Synology DiskStation to use HTTPS with a trusted certificate from Let\\u2019s Encrypt. However I am also running Tomcat 7 on my DiskStation, which is also\\xA0accessible from the internet. Needless to say, I want\\xA0to secure access to Tomcat, too. If you run Tomcat yourself and want to set it up for HTTPS, this is for you.\"), mdx(\"h2\", {\n    \"id\": \"update-for-dsm-6-users\"\n  }, \"Update for DSM 6 Users!\"), mdx(\"p\", null, \"In case you own a DSM 6 powered Diskstation, you do \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"not\"), \" want to follow the instructions described in this post. I found a much easier and automatable approach by using DSM 6 integrated Let\\u2019s Encrypt support and the new reverse proxy feature, which I described in a recent post \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/reverse-proxy-tomcat-for-https/\"\n  }), \"over here\"), \".\"), mdx(\"hr\", null), mdx(\"h2\", {\n    \"id\": \"prerequisites\"\n  }, \"Prerequisites\"), mdx(\"p\", null, \"In case you want to follow along, make sure you have Java and Tomcat already running. I won\\u2019t cover how to set up Tomcat\\xA0in this post. However, there is no need to worry! Especially if you are a DiskStation user, because both \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://www.synology.com/en-us/dsm/app_packages/JavaManager\"\n  }), \"Java\"), \" and \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://www.synology.com/en-us/dsm/app_packages/Tomcat7\"\n  }), \"Tomcat 7\"), \"\\xA0are\\xA0available in Synology Package Center for your one-click-install pleasure. \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://ludovic-fernandez.com/homelabs/continuous-integration-part1/\"\n  }), \"Check this guide\"), \" in case you need more advice on how to get Tomcat 7 running. You will also need openSSL, but I found it was already installed on my DiskStation. Furthermore I assume you already have a certificate from Let\\u2019s Encrypt. If you do not, \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/get-https-on-diskstation-with-lets-encrypt/\"\n  }), \"check out my last post\"), \" to learn how to get that certificate and set up your DiskStation to use it for HTTPS. Once you got the certificate issued with the official Let\\u2019s Encrypt client, you will find that the client\\xA0created a directory for you:  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"/etc/letsencrypt\"), \" . In this directory you will find the path\\xA0 \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"live/yourDomain\"), \" \\xA0which contains symbolic links to the latest version of their corresponding file in  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"/etc/letsencrypt/archive/yourDomain\"), \" . Follow the links \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"fullchain.pem\"), \" and \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"privkey.pem\"), \" to grab their corresponding files. In a terminal you can do this\\xA0like so:\"), mdx(\"pre\", null, mdx(\"code\", _extends({\n    parentName: \"pre\"\n  }, {}), \" `$ cp -L /etc/letsencrypt/live/yourDomain/fullchain.pem /remember/this/path/` \\n `$ cp -L /etc/letsencrypt/live/yourDomain/privkey.pem /remember/this/path/` \\n\\n\")), mdx(\"p\", null, \"Now that you have these two files, we are ready to go!\"), mdx(\"h2\", {\n    \"id\": \"what-is-acutally-required-for-https\"\n  }, \"What is acutally required for HTTPS?\"), mdx(\"p\", null, \"To enable Tomcat to serve requests through HTTPS we need to provide it with a certificate and the entire chain required to validate that certificate. This way when accessing Tomcat with a browser, the browser will be able to validate the provided certificate. After making sure the certificate is valid, the browser checks if it is issued to the server the client actually called and if this is the case, the connection is trusted. But for the connection to also be private, Tomcat needs the private key corresponding to the certificate to decrypt the client generated random key. This client generated random key is encrypted with the server\\u2019s public key (which is part of the certificate) by the client, so it can be safely transmitted to your server. Your server decrypts the symmetric key with the private key and now both parties have the symmetric key that is actually used to encrypt the communication between them. If you want to know more about HTTPS, \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://robertheaton.com/2014/03/27/how-does-https-actually-work/\"\n  }), \"check out Robert Heaton\\u2019s post\"), \". Anyway, now you know why we grabbed \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"fullchain.pem\"), \" and \", mdx(\"strong\", {\n    parentName: \"p\"\n  }, \"privkey.pem\"), \" earlier. However we can\\u2019t tell Tomcat to just use the PEM files we got from the Let\\u2019s Encrypt client. So what we will do is to put the full certificate chain and the private key all together inside one Java Key Store (JKS).\"), mdx(\"h2\", {\n    \"id\": \"create-a-keystore-for-tomcat\"\n  }, \"Create a keystore for Tomcat\"), mdx(\"p\", null, \"Basically there are only two steps required to get our fullchain.pem and privkey.pem inside a JKS. First we bundle both our fullchain\\xA0and the private key in a PKCS12 keystore. We do this, because apparently Java\\u2019s keytool (which we use to create our JKS) is not able to import pre-existing keys and certificates into a JKS, as described \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://stackoverflow.com/a/8224863\"\n  }), \"here\"), \". So open up your terminal and do something like this:\"), mdx(\"pre\", null, mdx(\"code\", _extends({\n    parentName: \"pre\"\n  }, {}), \" `$ openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out fullchain_and_key.p12 -name tomcat` \\n\\n\")), mdx(\"p\", null, \"You will be asked to provide a password (called \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"yourPKCS12pass\"), \" in the following). Do not forget it. You will need it for our second step. Now that we have our PKCS12 keystore, we can use Java\\u2019s keytool to generate a JKS from our PKCS12 file like so:\"), mdx(\"pre\", null, mdx(\"code\", _extends({\n    parentName: \"pre\"\n  }, {}), \" `$ keytool -importkeystore -deststorepass _yourJKSpass_ -destkeypass _yourKeyPass_ -destkeystore MyDSKeyStore.jks -srckeystore fullchain_and_key.p12 -srcstoretype PKCS12 -srcstorepass _yourPKCS12pass_ -alias tomcat` \\n\\n\")), mdx(\"p\", null, \"This will give you a file called \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"MyDSKeyStore.jks\"), \". Now you are ready to configure Tomcat for HTTPS.\"), mdx(\"h2\", {\n    \"id\": \"configure-tomcat-for-https\"\n  }, \"Configure Tomcat for HTTPS\"), mdx(\"p\", null, \"Now that we have the required JKS, we configure Tomcat\\u2019s SSL Connector to use the generated JKS\\xA0the way\\xA0it is documented \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html\"\n  }), \"here\"), \" and\\xA0\", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support\"\n  }), \"here\"), \". For this we need to edit Tomcat\\u2019s \", mdx(\"em\", {\n    parentName: \"p\"\n  }, \"server.xml\"), \" file found in  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"$CATALINA_BASE/conf/\"), \" . For DiskStations users this should look something like this:  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"/volume1/@appstore/Tomcat7/src/conf/\"), \"  Open that file and find the block starting with  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"<Connector port=\\\"8443\\\" protocol=\\\"org.apache.coyote.http11.Http11Protocol\\\"\"), \" . Uncomment that block and add your details to the connector. The result should look something like this: \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \" \"), mdx(Connector, {\n    port: \"8443\",\n    protocol: \"org.apache.coyote.http11.Http11Protocol\",\n    URIEncoding: \"UTF-8\",\n    maxThreads: \"150\",\n    SSLEnabled: \"true\",\n    scheme: \"https\",\n    secure: \"true\",\n    clientAuth: \"false\",\n    sslProtocol: \"TLS\",\n    keystoreFile: \"/volume1/NetBackup/myds_certs/**MyDSKeyStore.jks**\",\n    keystorePass: \"**yourJKSpass**\",\n    keyAlias: \"**tomcat**\",\n    keyPass: \"**yourKeyPass**\",\n    mdxType: \"Connector\"\n  }), mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \" \"), \" Note the sections in bold. Make sure you point to your JKS file and that the other values correspond to the values you used when creating the JKS file. The careful reader might have noticed that I added  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"URIEncoding=\\\"UTF-8\\\"\"), \"  to the connector. This is for GitBlit and Jenkins. Without that setting, if you use non-ASCII characters as a git repository name or as a Jenkins job name, it\\xA0will cause problems. See \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://wiki.jenkins-ci.org/display/JENKINS/Containers\"\n  }), \"Containers\"), \" and \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://wiki.jenkins-ci.org/display/JENKINS/Tomcat#Tomcat-i18n\"\n  }), \"Tomcat i18n\"), \" for Jenkins and \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"http://gitblit.com/faq.html#H11\"\n  }), \"GitBlit FAQ\"), \" for more details. Anyway, we are all set! Restart Tomcat (I use DSM\\u2019s Package Center for that) and access Tomcat through HTTPS, which would look something like this:  \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"https://yourDomain:8443\"), \"  You should see the Tomcat landing page and you can test that everything is setup correctly by providing your URL to \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://cryptoreport.websecurity.symantec.com/checker/views/certCheck.jsp\"\n  }), \"Symantec CryptoReport\"), \" (\", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://www.ssllabs.com/ssltest/\"\n  }), \"SSL Labs\"), \" does not support ports other than 443).\"), mdx(\"h2\", {\n    \"id\": \"note-of-thanks\"\n  }, \"Note of Thanks\"), mdx(\"p\", null, \"I did not come up with this solution on my own. Actually it was quite a ride until I figured out how this might work. Gladly the \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://community.letsencrypt.org/t/how-to-use-the-certificate-for-tomcat\"\n  }), \"Let\\u2019s Encrypt Community\"), \" is a wonderful place to ask questions, find people trying to overcome the same obstacles and to help each other. So I want to thank the Let\\u2019s Encrypt Community for helping me out to get my Tomcat server up and running with HTTPS! This opens up quite a few interesting usecases. One of them: Running GitBlit in Tomcat on my DiskStation and thus having a HTTPS accessible private Git server. In case you are interested in that, be sure to check back soon. I will definitely write a blog post about how to \", mdx(\"a\", _extends({\n    parentName: \"p\"\n  }, {\n    \"href\": \"https://melo.myds.me/wordpress/turn-diskstation-into-self-hosted-git-server/\"\n  }), \"turn your DiskStation into a private Git server\"), \" for you and your team in the near future.\"));\n}\n;\nMDXContent.isMDXComponent = true;","slug":"/lets-encrypt-for-tomcat-7-on-ds/","title":"HTTPS for Tomcat 7 with Let's Encrypt","tags":[],"keywords":[],"date":"February 13, 2016"},"previous":{"__typename":"MdxBlogPost","id":"fc826d5e-b7dd-534f-ba51-b58e5b7fdecb","excerpt":"From the moment I got my DiskStation and made it available online, I wanted to try HTTPS. Organizations that issue certificates to use for…","slug":"/get-https-on-diskstation-with-lets-encrypt/","title":"Get HTTPS on DiskStation with Let's Encrypt","date":"January 28, 2016"},"next":{"__typename":"MdxBlogPost","id":"463055a3-2f1f-5867-afd2-a4366a50bb37","excerpt":"One of the things I almost instantly wanted to do after purchasing my DiskStation was to use it as a private Git server. I thought I was in…","slug":"/turn-diskstation-into-self-hosted-git-server/","title":"Turn your DiskStation into a self-hosted Git server","date":"March 05, 2016"}},"pageContext":{"isCreatedByStatefulCreatePages":false,"id":"703f4203-112a-57c0-9975-ecd2b70d909c","previousId":"fc826d5e-b7dd-534f-ba51-b58e5b7fdecb","nextId":"463055a3-2f1f-5867-afd2-a4366a50bb37"}}}