This week's book giveaway is in the OO, Patterns, UML and Refactoring forum. We're giving away four copies of Refactoring for Software Design Smells: Managing Technical Debt and have Girish Suryanarayana, Ganesh Samarthyam & Tushar Sharma on-line! See this thread for details.
I have an app in a tomcat server, and I'm trying to read a client certificate. It's the first time I work with SSL, so probably I am doing something wrong. I don't want client validation, I just need to read the certificate content and send it to a webservice for validation and info retrieval. The problem is that I am unable to read the certificate content.
I already created a keystore and self-signed certificate for the server. The user certificate is on the browser (The user certificate is a valid one, not self-signed). The ssl connector configuration in server.xml is:
If I try to get the cipher suite : , I get the value TLS_DHE_DSS_WITH_AES_128_CBC_SHA
But when I try to read the certificates with , I just get a null value.
I have googled a little, and I read things such as that an Apache server is needed to retrieve the certificate, and then send it to Tomcat server. Is the Apache server really needed, or is Tomcat enough? In any case, what should I do to read the client certificates?