| Panel | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| ||||||||||
This page has been superceded by https://wiki.jasig.org/display/CASUM/SSL+Troubleshooting+and+Reference+Guide and will eventually be removed. |
CAS Server requires SSL. Newcomers to deploying secure web applications (and even old hands) sometimes have difficulty configuring the SSL certificates. This page is intended to provide links and help with troubleshooting SSL in the context of deploying an instance of the Central Authentication Service server.
Generating a certificate
I am gussing guessing that you have a certificate that is either not properly generated or is not installed in your jks keystore.
...
| No Format |
|---|
%JAVA_HOME%\bin\keytool -delete -alias tomcat -keypass changeit %JAVA_HOME%\bin\keytool -genkey -alias tomcat -keypass changeit -keyalg RSA %JAVA_HOME%\bin\keytool -export -alias tomcat -keypass changeit -file %FILE_NAME%server.crt %JAVA_HOME%\bin\keytool -import -file server.crt -keypass changeit -keystore %JAVA_HOME%/jre/lib/security/cacerts %JAVA_HOME%\bin\keytool -import -file server.crt -keystore %JAVA_HOME%\jre\lib\security\cacert |
World-readability
...
cacerts
|
Expiration Date of Certificate
If you want the certificate to be valid for longer than the default amount of time, you can provide an option parameter in the following format:
| No Format |
|---|
-validity numberOfDays
|
which allows you specify the number of days a certificate is valid for. So in the above example you would use the following command to create the certificate and have it valid for 365 days:
| No Format |
|---|
%JAVA_HOME%\bin\keytool -genkey -alias tomcat -keypass changeit -keyalg RSA -validity 365
|
World-readability
Public certificate files must be world-readable, as noted in the README.
...
How do I use a self-signed certificate?
...
DummyTrustManager for development
Joakim Recht suggested on the CAS list that in development you can avoid the need to install your self-signed CAS server certificate on your CAS clients (and your CAS client certificate on your CAS server when the clients need to be securely accessed for CAS to give them Proxy Tickets) by using the DummyTrustManager from here .. (See this JavaWorld article.)
This accepts all certificates, including self-signed.
...
Where can I learn more about the keytool?
At the keytool page.Thanks to Joakim Rect for originally suggesting DummyTrustManager on the CAS list.
A readme
You could try the readme included in this zip, which accompanies this article about CAS.
...