How to configure Tomcat

This document provides information on how to configure the Tomcat publishing profile to make it possible to install and publish certificates.

Requirements

The Tomcat service on the server must be named tomcat. Segura® restarts Tomcat with systemctl stop tomcat and systemctl start tomcat, or with the service tomcat command, and the service name is fixed.

Publishing modes

Segura® publishes the certificate in one of two modes, depending on the fields you fill in:

• Keystore: if you fill in the Keystore name, Alias certificate, and Password keystore fields, Segura® publishes the certificate directly to the keystore and ignores the server.xml file.
• server.xml: if any of those fields is empty, the Configuration file path (server.xml) field is required.

Configure Tomcat

To configure Tomcat, see the following steps:

1. On Segura™, in the navigation bar, hover over the Products menu and select Certificate Manager.
2. In the side menu, select Publishing > Publishing profiles.
3. In the actions button, select Tomcat.
4. In the Settings tab, enter the following information:
   1. In the Profile name *, enter the profile's name.
   2. In the Credential username, enter the credentials' name.
   3. (Optional): Check the Use a registered credential to access all devices option and, in the Access credential registered in the system, select the access credential registered in Segura™ to be used.
5. Click Continue.
6. In the Tomcat tab, enter the following fields:
   1. In the Keystore name field, enter the full path of the keystore. For example: /opt/tomcat9/keystore.jks. If the keystore does not exist, it is created automatically.
   2. In the Alias certificate field, enter the certificate alias. If the alias does not exist, it is created automatically.
   3. In the Password keystore field, select the credential that has the keystore password. The credential needs to be previously created in Segura™.
   4. Optional: In the Way of the intermediate certificate field, enter the path of the intermediate certificate.
   5. In the Configuration file path (server.xml) field, enter the path of the configuration file.
   6. In the Tomcat version field, select the Tomcat version.
   7. Optional: In the Port field, enter the port Segura® uses to check the server after publication. Enter digits only, from 1 to 65535. If you leave the field empty, Segura® skips the check. See Post-publication check.
7. Click Continue.
8. In the Devices tab, select the Tomcat server.
   1. The device must be previously registered in Segura™.
   2. The Devices and Review tabs include a read-only Network Connector column that shows Yes or No, depending on whether the device has its own Network Connector configured.
9. In the Review tab, review all information entered previously, and click Save.

Post-publication check

If you entered a port in the Port field, Segura® connects to the server on that port after installing the certificate and compares the fingerprint of the certificate the server presents with the fingerprint of the published certificate. If the server does not respond, Segura® retries after 5, 10, 15, 15, 15, and 15 seconds.

• If the fingerprints match, the publication succeeds.
• If the fingerprints differ, the publication fails.
• If the server does not respond after all retries, the publication still ends successfully, and the execution log records a warning.

If you left the Port field empty, the execution log records TLS verification skipped: no port configured.

The execution details do not display the keystore password.

Network Connector behavior

Tomcat publishing uses the device's Network Connector for both the installation and the post-publication check. Through a Network Connector, the check connects without SNI.