Securing Netbeans 6.7 tomcat manager URL with HTTPS

0
votes

This is for Tomcat 6.0.18 in Netbeans 6.7

I have implemented self signed SSL in tomcat. However, when I enter tomcat manager url such as http://localhost:8080/manager/html it is not redirecting to https://localhost:8443/manager/html.

I have made changes in Tomcat's server.xml from Netbeans at location C:\Documents and Settings\user\.netbeans\6.7\apache-tomcat-6.0.18_base\conf

<Connector 
    port="8443" 
    protocol="HTTP/1.1" 
    SSLEnabled="true" 
    keystoreFile="c:/ssl/keystore"
    keystorePass="myPassword" 
    maxThreads="150" 
    scheme="https" 
    secure="true" 
    clientAuth="false"
    sslProtocol="TLS" />

and in web.xml I have added following at C:\Documents and Settings\user\.netbeans\6.7\apache-tomcat-6.0.18_base\conf

<security-constraint>
<web-resource-collection>
<web-resource-name>Entire Application</web-resource-name>
<url-pattern>/*</url-pattern>
</web-resource-collection>
<user-data-constraint>
<transport-guarantee>CONFIDENTIAL</transport-guarantee>
</user-data-constraint>
</security-constraint>

Am I missing anything?

2
javatomcatsslnetbeans

2 Answers

1
votes

You have to edit two files -

Open server.xml typically found in tomcat/conf and change:

Connector port="8080"
 enableLookups="false"
 redirectPort="8443"

to

Connector port="8080"
 enableLookups="false"
 redirectPort="<strong>443</strong>"

Secondly, add this snippet in web.xml

<security-constraint>
 <web-resource-collection>
 <web-resource-name>Protected Context</web-resource-name>
 <url-pattern>/*</url-pattern>
 </web-resource-collection>
 <user-data-constraint>
 <transport-guarantee>CONFIDENTIAL</transport-guarantee>
 </user-data-constraint>
 </security-constraint>

That's all. Restart the server. All pages will be redirected to https from now on.

0
votes

In addition to updating server.xml and web.xml for tomcat SSl self signed certificate, I updated security-constraint in web.xml of tomcat manager webapp just before ends as follows

<security-constraint>
........
........
........
........
    <user-data-constraint>
    <transport-guarantee>CONFIDENTIAL</transport-guarantee>
    </user-data-constraint>
</security-constraint>

With this when I enter http://localhost:8080/manager/html it redirects to https port always.

Thanks,

Wap Rau