Liferay Tomcat SSL Configuration: Keystore and SSLCertificateFile

Liferay Tomcat HTTPs Configuration

Keystore and SSLCertificateFile Approaches

Overview

This article explains how to configure HTTPs/SSL for Liferay bundled with Tomcat, using two different approaches: 

• “Keystore” approach - for the generated “self-signed” certificates;

• “SSLCertificateFile” approach - for certificates obtained externally.

SSL Configuration with Keystore

Use this approach, when you don’t have a real SSL certificate, but you need to enable the HTTPs for your Tomcat server (e.g. on a local machine or the development server). 

1. Generate keystore

First, you need to generate a keystore with the keytool command:

cd $JAVA_HOME/bin

keytool -genkey -alias ALIAS -keyalg RSA keystore PATH_TO_KEYSTORE/.keystore 

ALIAS - alias for you certificate;

PATH_TO_KEYSTORE - path to the directory, where .keystore will be created

2. Export keystore:

keytool -export -alias ALIAS -keystore PATH_TO_KEYSTORE/.keystore -file server.crt

3. Import keystore:

keytool -import -alias ALIAS -file server.crt -keystore $JAVA_HOME/jre/lib/cacerts

4. Configure SSL in Tomcat

Go to ${TOMCAT}/conf directory, and modify server.xml file.

Comment the following line:

<!--<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />-->

Uncomment the SSL Connector code:

<!-- <Connector port="8443" ...

and configure it in this way:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"

          maxThreads="150" scheme="https" secure="true"

          clientAuth="false" sslProtocol="TLS"

          keystoreFile="PATH_TO_KEYSTORE"

          keystorePass="KEYSTORE_PASSWORD"

/>

, where PATH_TO_KEYSTORE - path to generated .keystore file, 

PASSWORD - keystore password.

5. Restart TOMCAT, check URL in browser: https://localhost:8443

SSL Configuration with Certificate Files

Use this approach, if you have SSL certificate files, and need to configure HTTPs for your Tomcat server using those certificates.

Note: this article describes instructions for Linux, they may differ for Windows/MacOS.

1. Copy certificates

You should have two files:

• xxx.crt - certificate file;

• xxx.key - private key file.

Copy them both into the TOMCAT/conf folder.

2. Install the following libraries (if missing):

sudo apt-get install libtcnative-1

sudo apt-get install libapr1-dev libssl-dev 

sudo apt-get install gcc

sudo apt-get install make

3. Apache Portable Runtime (APR) Configuration

3.1. Download APR from https://apr.apache.org/download.cgi

(download link: https://www2.apache.paket.ua//apr/apr-1.7.0.tar.gz )

3.2. Unpack apr-1.7.0.tar.gz to the TOMCAT/bin folder.

3.3. Run the configure command:

sudo ./configure

Note: it you have “rm: cannot remove XXX” error during the command above - modify the “configure” file and change $RM "$cfgfile" to $RM -f "$cfgfile" and run the command again.

3.3. Run make commands:

sudo make

sudo make install 

4. Tomcat Native Configuration

4.1. Go to TOMCAT/bin folder.

4.2 Unpack the tomcat-native:

tar xf tomcat-native.tar.gz

4.3. Go to tomcat-native-src/native folder:

cd tomcat-native-1.2.24-src/native

4.4. Run the configure command

./configure --with-apr=/usr/bin/apr-1-config \

            --with-java-home=/home/user/java/jdk1.8.0_144/ \

            --with-ssl=yes \

            --prefix=/home/user/liferay/tomcat-9.0.37

(change Java and Tomcat paths to your ones)

4.4. Run make commands:

sudo make

sudo make install 

4.5. The following files should be generated in TOMCAT/lib folder:

    libtcnative-1.a

    libtcnative-1.la

    libtcnative-1.so 

    libtcnative-1.so.0 

    libtcnative-1.so.0.2.24

4.6. Copy generated files to the TOMCAT/bin folder, verify permissions on them.

5. Tomcat Configuration

5.1. Modify TOMCAT/bin/setenv.sh in the following way:

CATALINA_OPTS="$CATALINA_OPTS -Djava.library.path=/home/user/liferay/tomcat-9.0.37/bin ..."

export LD_LIBRARY_PATH='$LD_LIBRARY_PATH:/usr/local/apr/lib'

export JAVA_HOME=/home/user/java/jdk1.8.0_144

export JRE_HOME=/home/user/java/jdk1.8.0_144/jre

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/apr/lib

export LD_RUN_PATH=$LD_RUN_PATH:/usr/local/apr/lib

- add -Djava.library.path param pointing to TOMCAT/bin;

- export LD_LIBRARY_PATH / JAVA_HOME / JRE_HOME / LD_LIBRARY_PATH / LD_RUN_PATH variables.

5.2. Modify TOMCAT/conf/server.xml file.

Make sure AprLifecycleListener is enabled:

<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />

Add SSL Connector configuration:

<Connector

       protocol="org.apache.coyote.http11.Http11AprProtocol"

       port="8443" maxThreads="200"

       scheme="https" secure="true" SSLEnabled="true"

       SSLCertificateFile="PATH_TO_CERT/my-cert.crt"

       SSLCertificateKeyFile="PATH_TO_CERT/my-cert.key"

       SSLVerifyClient="optional" SSLProtocol="TLSv1+TLSv1.1+TLSv1.2" />

, where PATH_TO_CERT - path to folder with your certificates.

5.3. Restart TOMCAT, check URL in browser: https://localhost:8443

Enjoy 😏