Question
Accenture Pte. Ltd.
Accenture Pte. Ltd.
SG
Accenture Pte. Ltd.
Posted: Mar 3, 2019
Last activity: Apr 26, 2019
Last activity: 26 Apr 2019 6:09 EDT
Closed
Configuring Two way SSL in Pega 7.4 (Apache Tomcat)
Hi everyone,
I would like to know if Two way SSL can be setup in Pega 7.4 hosted using Apache Tomcat 9?
If yes, how this can be achieved? What would be the necessary changes I should do in my Tomcat?
Thanks in advance.
Regards,
Adhava Ram
***Edited by Moderator Marissa to update platform capability tags****
Posted: 5 years ago
Pegasystems Inc.
IN
Kindly go through following links, these should help you:
https://tomcat.apache.org/tomcat-8.5-doc/ssl-howto.html
https://dailyraaga.wordpress.com/2016/08/09/tomcat-2-way-ssl-configuration-step-by-step/
Posted: 5 years ago
PEGA
Pegasystems Inc.
IN
Hi Ram,
Please refer below articles to set up two way ssl in 7.4.
https://pdn.pega.com/system-operations/how-to-configure-the-application-server-to-support-ssltls-in-prpc
https://community.pega.com/sites/default/files/help_v63sp1/Default.htm;
https://pdn.pega.com/security/how-to-set-up-two-way-ssl-for-soap-over-http-using-rule-connect-soap
Hope it helps!!!
Thanks,
Abhinav
To see attachments, please log in.
Posted: 5 years ago
Vodafone GmbH
Vodafone GmbH
DE
Hi,
we are using two-way-ssl (Client Certificate authentication) for our REST service.
1. Create Java Keystore which contains the private key that represents your server, like Pega Platform -> serveridentity.jks
2. Create Java Keystore for the client
3. Import the certificates from the client rather root certificates into a trust store (Client must send its client certifcate and has its own identity keystore) -> servertruststore.jks
4.
Show More
Hi,
we are using two-way-ssl (Client Certificate authentication) for our REST service.
1. Create Java Keystore which contains the private key that represents your server, like Pega Platform -> serveridentity.jks
2. Create Java Keystore for the client
3. Import the certificates from the client rather root certificates into a trust store (Client must send its client certifcate and has its own identity keystore) -> servertruststore.jks
4. Modify web.xml of prweb.war as follows:
<security-constraint>
<web-resource-collection>
<web-resource-name>SecurePages</web-resource-name>
<description>Security constraint for resources in the secure directory</description>
<url-pattern>/PRRestService/PersonPackage/1/PersonManager</url-pattern>
<http-method>POST</http-method>
<http-method>GET</http-method>
<http-method>PUT</http-method>
<http-method>DELETE</http-method>
</web-resource-collection>
<auth-constraint>
<description>only let the system user login</description>
<role-name>Certificate</role-name>
</auth-constraint>
<user-data-constraint>
<description>For SSL</description>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>
<login-config>
<auth-method>CLIENT-CERT</auth-method>
<realm-name>myrealm</realm-name>
</login-config>
<security-role>
<description>The Secure ROLE</description>
<role-name>Certificate</role-name>
</security-role>
<!--
<login-config>
<auth-method>BASIC</auth-method>
<realm-name>PegaRULES</realm-name>
</login-config>-->
5. Maybe redeployment neccessary
6. Modify conf/server.xml of Tomcat as follows
<Connector
protocol="org.apache.coyote.http11.Http11NioProtocol"
port="8443" maxThreads="200"
scheme="https" secure="true" SSLEnabled="true" keyAlias="server"
keystoreFile="conf/serveridentity.jks" keystorePass="***"
clientAuth="true" sslProtocol="TLS" truststoreFile="conf/servertruststore.jks" truststorePass="***"/>
For a complete list of properties check: https://tomcat.apache.org/tomcat-8.0-doc/config/http.html#SSL_Support
7. In step 2 you create the keystore for the client the complete distinguish name of the certificate and the role "Certificate" has to be registered in conf/tomcat-users.xml
<role rolename="Certificate"/>
<user username="EMAILADDRESS= Proprietary information hidden, CN=client, OU=ae, O=test, L=hollywood, ST=ca, C=us" password="" roles="Certificate"/>
8. restart Server (Pega)
9. I used SOAP-UI to test it. There you can configure the client keystore which is used for the SSL-Handshake rather authentication
Andre
Show Less