Home / user-74899

hooknc's questions

Martin Hope
hooknc
Asked: 2014-03-15 09:56:43 +0800 CST
  • -1

Internally, how does traceroute make its requests, by hostname of ip address?

I know that the traceroute command can either take a hostname or an ip address, but when a hostname is entered is that hostname used for each progressive request or does traceroute perform a dns lookup on that hostname and then use the ip address for each progressive request?

I am attempting to debug a connection issue with a client of ours and it seems to be a dns issue, but I'm not sure.

Thank you for your time.

networking
Martin Hope
hooknc
Asked: 2011-03-22 10:29:57 +0800 CST
  • 9

I am attempting to use the mod_proxy SSLCACertificatePath directive, but I'm a tad bit confused on how to use it properly.

Here are two links explaining the SSLCACertificatePath directive:
http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#sslcacertificatepath
http://www.modssl.org/docs/2.8/ssl_reference.html#ToC13

I'm not positive on how to create the hashed symbolic links. The second link states to use the apache make file, but I'm quite clueless on what is exactly being said there.

Any friendly guidance would be greatly appreciated.

Thank you for your time.

UPDATE

The goal of my question was to figure out how to handle multiple CAs for validating end user Client Certificates. I didn't realize that multiple pem certificates could be using in one file, which, in my case is clearly the right way to move forward.

apache-2.2 ssl mod-ssl
Martin Hope
hooknc
Asked: 2011-03-18 14:12:04 +0800 CST
  • 4

I am having difficulties getting a client x509 certificate to be forwarded to Tomcat from Apache using mod_proxy.

From observations and reading a few logs it does seem as though the client x509 certificate is being accepted by Apache. But, when Apache makes an SSL request to Tomcat (which has clientAuth="want"), it doesn't look like the client x509 certificate is passed during the ssl handshake.

Is there a reasonable way to see what Apache is doing with the client x509 certificate during its handshake with Tomcat?

Here is the environment I'm working with: Apache/2.2.3 Tomcat/6.0.29 Java/6.0_23 OpenSSL 0.9.8e

Here is my Apache VirtualHost SSL config:

<VirtualHost xxx.xxx.xxx.xxx:443>

ServerName xxx
ServerAlias xxx

SSLEngine On 
SSLProxyEngine on
ProxyRequests Off
ProxyPreserveHost On

ErrorLog logs/ssl_error_log
TransferLog logs/ssl_access_log
LogLevel debug

SSLProtocol all -SSLv2
SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW

SSLCertificateFile /usr/local/certificates/xxx.crt
SSLCertificateKeyFile /usr/local/certificates/xxx.key

SSLCertificateChainFile /usr/local/certificates/xxx.crt

SSLVerifyClient optional_no_ca
SSLOptions +ExportCertData

CustomLog logs/ssl_request_log \
          "%t %h %{SSL_PROTOCOL}x %{SSL_CIPHER}x \"%r\" %b"

<Proxy *>
  AddDefaultCharset Off
  Order deny,allow
  Allow from all
</Proxy>

ProxyPass / https://xxx.xxx.xxx.xxx:8443/
ProxyPassReverse / https://xxx.xxx.xxx.xxx:8443/

</VirtualHost>

Then here is my Tomcat SSL Connector:

 <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" address="xxx.xxx.xxx.xxx"
                maxThreads="150" scheme="https" secure="true"
                keystoreFile="/usr/local/certificates/xxx.jks" keypass="xxx_pwd"
                clientAuth="want" sslProtocol="TLSv1" proxyName="xxx.xxx.xxx.xxx" proxyPort="443"
 />

Could there possibly be issues with SSL Renegotiation?

Could there be problems with the Truststore in our Tomcat instance? (We are using a non-standard Truststore that has partner organization CAs.)

Is there better logging for what is happening internally with Apache for SSL? Like what is happening to the client cert or why it isn't forwarding the certificate when tomcats asks for one?

Any reasonable assistance would be greatly appreciated.

Thank you for your time.

tomcat apache-2.2 ssl x509