Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #30578 > unrolled thread

Tomcat ssl certificates, any experience?

Back to article view | Back to comp.lang.java.programmer

Contents

  Tomcat ssl certificates, any experience? lipska the kat <lipskathekat@example.com> - 2014-12-17 19:37 +0000
    Re: Tomcat ssl certificates, any experience? Silvio <silvio@internet.com> - 2014-12-18 15:21 +0100
      Re: Tomcat ssl certificates, any experience? lipska the kat <lipskathekat@example.com> - 2014-12-18 16:32 +0000
        Re: Tomcat ssl certificates, any experience? Silvio <silvio@internet.com> - 2014-12-19 12:57 +0100
          Re: Tomcat ssl certificates, any experience? lipska the kat <lipskathekat@example.com> - 2014-12-19 19:05 +0000
            Re: Tomcat ssl certificates, any experience? Silvio <silvio@internet.com> - 2014-12-22 11:28 +0100
              Re: Tomcat ssl certificates, any experience? Silvio <silvio@internet.com> - 2014-12-22 11:36 +0100
      Re: Tomcat ssl certificates, any experience? Donkey Hottie <donkey@fredriksson.dy.fi> - 2014-12-21 00:19 +0200
        Re: Tomcat ssl certificates, any experience? Silvio <silvio@internet.com> - 2014-12-22 11:30 +0100
    Re: Tomcat ssl certificates, any experience? Roedy Green <see_website@mindprod.com.invalid> - 2014-12-18 13:45 -0800
      Re: Tomcat ssl certificates, any experience? lipska the kat <lipskathekat@example.com> - 2014-12-19 08:27 +0000
        Re: Tomcat ssl certificates, any experience? Joerg Meier <joergmmeier@arcor.de> - 2014-12-19 15:53 +0100
          Re: Tomcat ssl certificates, any experience? lipska the kat <lipskathekat@example.com> - 2014-12-19 19:08 +0000
            Re: Tomcat ssl certificates, any experience? Joerg Meier <joergmmeier@arcor.de> - 2014-12-19 22:28 +0100

#30578 — Tomcat ssl certificates, any experience?

Hello all

I don't know if anyone is still talking to me but what the heck, I'll 
give it a go :-)

Tomcat 7
Java 7
Linux (various but CentOS server)

I'm trying to convert my various commercial sites to be *all https* as 
the great demon Google is prioritizing sites that default to https in 
it's search results apparently.

I'm in the UK

Has anyone had any experience with a UK certification authority that has 
decent customer support and more importantly perhaps has anyone actually 
purchased an SSL certificate from a UK certification authority and 
installed it successfully in a standalone Tomcat server instance?

TIA
Lipska


-- 
lipska the kat - treacherous feline.
Proudly nominated for IPOTY 2014 - LIGAF
==================================================
Any GNU/Linux distribution that does not come with
the set of tools required to build its open source
kernel is incomplete. This is an opinion.
==================================================
GNU/Linux user #560883 - linuxcounter.net

[toc] | [next] | [standalone]

#30580

Never bought any outside the Netherlands but the root CA was mostly 
RapidSSL/GeoTrust. Also hardly use them in any other way than with a 
Jetty container. But Jetty uses a standard Java keystore file and I 
presume Tomcat could handle such a beast. Using standard JDK keytool for 
creating the keystore/private key, setting up a CSR and subsequently 
putting the certificate inside the keystore is pretty straightforward 
and howto's can be googled for easily.

Why do you want a UK CA? And what do you expect from customer support? 
My supplier here in the Netherlands has no idea whatsoever about how to 
use a certificate with Java. They may know a lot about using it with IIS 
or even Apache but I do neither.

Have you considered setting up a simple reverse proxy in front of your 
web server that handles the SSL part? It will have the additional 
advantage of giving you some load distribution options. NGINX would do 
fine and is a breeze to setup, including the SSL part.

Cheers,

Silvio


On 12/17/2014 08:37 PM, lipska the kat wrote:
> Hello all
>
> I don't know if anyone is still talking to me but what the heck, I'll
> give it a go :-)
>
> Tomcat 7
> Java 7
> Linux (various but CentOS server)
>
> I'm trying to convert my various commercial sites to be *all https* as
> the great demon Google is prioritizing sites that default to https in
> it's search results apparently.
>
> I'm in the UK
>
> Has anyone had any experience with a UK certification authority that has
> decent customer support and more importantly perhaps has anyone actually
> purchased an SSL certificate from a UK certification authority and
> installed it successfully in a standalone Tomcat server instance?
>
> TIA
> Lipska
>
>

[toc] | [prev] | [next] | [standalone]

#30585

On 18/12/14 14:21, Silvio wrote:
> Never bought any outside the Netherlands but the root CA was mostly
> RapidSSL/GeoTrust. Also hardly use them in any other way than with a
> Jetty container. But Jetty uses a standard Java keystore file and I
> presume Tomcat could handle such a beast. Using standard JDK keytool for
> creating the keystore/private key, setting up a CSR and subsequently
> putting the certificate inside the keystore is pretty straightforward
> and howto's can be googled for easily.
>
> Why do you want a UK CA?

It just helps to have someone to talk to when things go wrong but I 
think I've figured the geeky stuff out now. I'm using keytool to 
generate a keystore and a CSR. I have the redirect to https sorted as 
well (actually a simple security-constraint in web.xml does the job). 
I'm not a sysadmin really I just do what I have to to keep things 
running and I know Tomcat well as I have been using it for years. Better 
stick to what you know I guess. I focus my time and effort on design and 
development, I'm only a one man band these days and do everything 
myself, application and database design and development, server 
maintenance, security, photography, product sourcing etc etc. I don't 
use any third party stuff like shopping carts or whatever, I do it all 
myself and any time I can save on stuff like this is good for my sanity.

Anyway, there seems to be no way to avoid paying well over UKP100.00 per 
year for a certificate because of a decree from bloody Google that 'it 
shall be so'

Ho Hum

<snip>

-- 
lipska the kat - treacherous feline.
Proudly nominated for IPOTY 2014 - LIGAF
==================================================
Any GNU/Linux distribution that does not come with
the set of tools required to build its open source
kernel is incomplete. This is an opinion.
==================================================
GNU/Linux user #560883 - linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#30593

A bit on the expensive side. I pay about 30 euros for a plain 
certificate. Wildcard certificates covering any subdomain cost about 100 
euros. That is for domain-validation only so I will not be playing bank 
any-time soon.

I do all my stuff myself as well, be it that we are with four guys. The 
geeky stuff regarding keytool is known best among Java developers. You 
can always come here for assistance.

Cheers,

Silvio



On 12/18/2014 05:32 PM, lipska the kat wrote:
> On 18/12/14 14:21, Silvio wrote:
>> Never bought any outside the Netherlands but the root CA was mostly
>> RapidSSL/GeoTrust. Also hardly use them in any other way than with a
>> Jetty container. But Jetty uses a standard Java keystore file and I
>> presume Tomcat could handle such a beast. Using standard JDK keytool for
>> creating the keystore/private key, setting up a CSR and subsequently
>> putting the certificate inside the keystore is pretty straightforward
>> and howto's can be googled for easily.
>>
>> Why do you want a UK CA?
>
> It just helps to have someone to talk to when things go wrong but I
> think I've figured the geeky stuff out now. I'm using keytool to
> generate a keystore and a CSR. I have the redirect to https sorted as
> well (actually a simple security-constraint in web.xml does the job).
> I'm not a sysadmin really I just do what I have to to keep things
> running and I know Tomcat well as I have been using it for years. Better
> stick to what you know I guess. I focus my time and effort on design and
> development, I'm only a one man band these days and do everything
> myself, application and database design and development, server
> maintenance, security, photography, product sourcing etc etc. I don't
> use any third party stuff like shopping carts or whatever, I do it all
> myself and any time I can save on stuff like this is good for my sanity.
>
> Anyway, there seems to be no way to avoid paying well over UKP100.00 per
> year for a certificate because of a decree from bloody Google that 'it
> shall be so'
>
> Ho Hum
>
> <snip>
>

[toc] | [prev] | [next] | [standalone]

#30598

On 19/12/14 11:57, Silvio wrote:
> A bit on the expensive side. I pay about 30 euros for a plain
> certificate. Wildcard certificates covering any subdomain cost about 100
> euros. That is for domain-validation only so I will not be playing bank
> any-time soon.
>
> I do all my stuff myself as well, be it that we are with four guys. The
> geeky stuff regarding keytool is known best among Java developers. You
> can always come here for assistance.
>
> Cheers,
>
> Silvio

Good to know, thanks, who is your CA (provider)




-- 
lipska the kat - treacherous feline.
Proudly nominated for IPOTY 2014 - LIGAF
==================================================
Any GNU/Linux distribution that does not come with
the set of tools required to build its open source
kernel is incomplete. This is an opinion.
==================================================
GNU/Linux user #560883 - linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#30608

On 12/19/2014 08:05 PM, lipska the kat wrote:
> On 19/12/14 11:57, Silvio wrote:
>> A bit on the expensive side. I pay about 30 euros for a plain
>> certificate. Wildcard certificates covering any subdomain cost about 100
>> euros. That is for domain-validation only so I will not be playing bank
>> any-time soon.
>>
>> I do all my stuff myself as well, be it that we are with four guys. The
>> geeky stuff regarding keytool is known best among Java developers. You
>> can always come here for assistance.
>>
>> Cheers,
>>
>> Silvio
>
> Good to know, thanks, who is your CA (provider)
>
>
>
>

GeoTrust. I use the RapidSSL certificate line, they may have some 
additional options.

[toc] | [prev] | [next] | [standalone]

#30610

On 12/22/2014 11:28 AM, Silvio wrote:
> On 12/19/2014 08:05 PM, lipska the kat wrote:
>> On 19/12/14 11:57, Silvio wrote:
>>> A bit on the expensive side. I pay about 30 euros for a plain
>>> certificate. Wildcard certificates covering any subdomain cost about 100
>>> euros. That is for domain-validation only so I will not be playing bank
>>> any-time soon.
>>>
>>> I do all my stuff myself as well, be it that we are with four guys. The
>>> geeky stuff regarding keytool is known best among Java developers. You
>>> can always come here for assistance.
>>>
>>> Cheers,
>>>
>>> Silvio
>>
>> Good to know, thanks, who is your CA (provider)
>>
>>
>>
>>
>
> GeoTrust. I use the RapidSSL certificate line, they may have some
> additional options.

Bought a wildcard certificate for one year last Friday. It cost me 95 euros.

[toc] | [prev] | [next] | [standalone]

#30603

On 18.12.2014 16:21, Silvio wrote:
> Have you considered setting up a simple reverse proxy in front of your
> web server that handles the SSL part? It will have the additional
> advantage of giving you some load distribution options. NGINX would do
> fine and is a breeze to setup, including the SSL part.

That works fine, or Pound, which is a dedicated reverse proxy and
application firewall. I have implemented SSL on Java servers using
Pound, and my colleague has done it using nginx. Both work fine.

[toc] | [prev] | [next] | [standalone]

#30609

On 12/20/2014 11:19 PM, Donkey Hottie wrote:
> On 18.12.2014 16:21, Silvio wrote:
>> Have you considered setting up a simple reverse proxy in front of your
>> web server that handles the SSL part? It will have the additional
>> advantage of giving you some load distribution options. NGINX would do
>> fine and is a breeze to setup, including the SSL part.
>
> That works fine, or Pound, which is a dedicated reverse proxy and
> application firewall. I have implemented SSL on Java servers using
> Pound, and my colleague has done it using nginx. Both work fine.
>
>

Yes, Pound works fine as well, I have used that for a couple of years 
somewhere around 2007.

Unfortunately we had some load distribution/balancing requirements Pound 
could not handle so I ended up doing a reverse proxy in Java. That has 
worked extremely well for us since then.

[toc] | [prev] | [next] | [standalone]

#30590

On Wed, 17 Dec 2014 19:37:40 +0000, lipska the kat
<lipskathekat@example.com> wrote, quoted or indirectly quoted someone
who said :

>Has anyone had any experience with a UK certification authority that has 
>decent customer support and more importantly perhaps has anyone actually 
>purchased an SSL certificate from a UK certification authority and 
>installed it successfully in a standalone Tomcat server instance?

See http://mindprod.com/certificatevendors.html

It might help you find one to suit your needs.  You could then ask
about a specific candidate. 
-- 
Roedy Green Canadian Mind Products http://mindprod.com
Software is a gas; it expands to fill its container.
~ Nathan Myhrvold (born: 1959-08-03 age: 55) Nathan’s First Law

[toc] | [prev] | [next] | [standalone]

#30592

On 18/12/14 21:45, Roedy Green wrote:
> On Wed, 17 Dec 2014 19:37:40 +0000, lipska the kat
> <lipskathekat@example.com> wrote, quoted or indirectly quoted someone
> who said :
>
>> Has anyone had any experience with a UK certification authority that has
>> decent customer support and more importantly perhaps has anyone actually
>> purchased an SSL certificate from a UK certification authority and
>> installed it successfully in a standalone Tomcat server instance?
>
> See http://mindprod.com/certificatevendors.html
>
> It might help you find one to suit your needs.  You could then ask
> about a specific candidate.

Would be useful if I could find it!

Not Found

The requested URL /certificatevendors.html was not found on this server.


-- 
lipska the kat - treacherous feline.
Proudly nominated for IPOTY 2014 - LIGAF
==================================================
Any GNU/Linux distribution that does not come with
the set of tools required to build its open source
kernel is incomplete. This is an opinion.
==================================================
GNU/Linux user #560883 - linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#30596

On Fri, 19 Dec 2014 08:27:53 +0000, lipska the kat wrote:

> On 18/12/14 21:45, Roedy Green wrote:
>> On Wed, 17 Dec 2014 19:37:40 +0000, lipska the kat
>> <lipskathekat@example.com> wrote, quoted or indirectly quoted someone
>> who said :
>>> Has anyone had any experience with a UK certification authority that has
>>> decent customer support and more importantly perhaps has anyone actually
>>> purchased an SSL certificate from a UK certification authority and
>>> installed it successfully in a standalone Tomcat server instance?
>> See http://mindprod.com/certificatevendors.html

>> It might help you find one to suit your needs.  You could then ask
>> about a specific candidate.
> Would be useful if I could find it!

> Not Found

> The requested URL /certificatevendors.html was not found on this server.

Try

<http://mindprod.com/jgloss/certificatevendors.html>

Liebe Gruesse,
		Joerg

-- 
Ich lese meine Emails nicht, replies to Email bleiben also leider
ungelesen.

[toc] | [prev] | [next] | [standalone]

#30599

On 19/12/14 14:53, Joerg Meier wrote:
> On Fri, 19 Dec 2014 08:27:53 +0000, lipska the kat wrote:
>
>> On 18/12/14 21:45, Roedy Green wrote:
>>> On Wed, 17 Dec 2014 19:37:40 +0000, lipska the kat
>>> <lipskathekat@example.com> wrote, quoted or indirectly quoted someone
>>> who said :
>>>> Has anyone had any experience with a UK certification authority that has
>>>> decent customer support and more importantly perhaps has anyone actually
>>>> purchased an SSL certificate from a UK certification authority and
>>>> installed it successfully in a standalone Tomcat server instance?
>>> See http://mindprod.com/certificatevendors.html
>
>>> It might help you find one to suit your needs.  You could then ask
>>> about a specific candidate.
>> Would be useful if I could find it!
>
>> Not Found
>
>> The requested URL /certificatevendors.html was not found on this server.
>
> Try
>
> <http://mindprod.com/jgloss/certificatevendors.html>
>
> Liebe Gruesse,
> 		Joerg

That's the one, cheers Joerg.
Any idea why the prices are blocked out?


-- 
lipska the kat - treacherous feline.
Proudly nominated for IPOTY 2014 - LIGAF
==================================================
Any GNU/Linux distribution that does not come with
the set of tools required to build its open source
kernel is incomplete. This is an opinion.
==================================================
GNU/Linux user #560883 - linuxcounter.net

[toc] | [prev] | [next] | [standalone]

#30600

On Fri, 19 Dec 2014 19:08:17 +0000, lipska the kat wrote:

> On 19/12/14 14:53, Joerg Meier wrote:
>> On Fri, 19 Dec 2014 08:27:53 +0000, lipska the kat wrote:
>>> Would be useful if I could find it!

>>> Not Found
>> Try

>> <http://mindprod.com/jgloss/certificatevendors.html>
> That's the one, cheers Joerg.
> Any idea why the prices are blocked out?

I'm not sure what you mean. I see prices for many of the entries. But
considering many say they were last updated in 2007 or 2009, I wouldn't pay
much attention to the prices anyways.

Liebe Gruesse,
		Joerg

-- 
Ich lese meine Emails nicht, replies to Email bleiben also leider
ungelesen.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.java.programmer

csiph-web