Implement SSL on Tomcat (https)

[Former Member]

Hi experts,

I am considering to implement SSL on Tomcat (https).

It will open to users in internal network and in external network.

Internal Network and External network has different domain name (internal IP and public IP)

However when I use the keystore to create private key, it allows me to input one domain name only.

./keytool.exe -genkey -alias tomcat -keyalg RSA

If I use public IP as the common name (CN) of the key, internal users cannot access the server.

If I use internal IP, external users cannot access the server.

How can I implement the https so that both internal and external users can access the server successfully?

We do not allow "add exception" due to security policy.

Thanks & Regards,

Gordon Lo

[former_member136842 · Accepted solution]

Hi,

you need to deploy the Web Applications twice then. Use one Tomcat for internal access (with the internal SSL certificate) and one Tomcat for external access (with the external SSL certificate).

Regards

-Seb.

[Former Member · Accepted solution]

Hi Seb,

How can I deploy the web applications twice on the same Tomcat server?

Regards,

Gordon

[Former Member · Accepted solution]

Hi Gordon,

What I can suggest you to involve your network team to configure NAT to map External address to internal network.

So that Users accessing internally and externally have only one URL to access.

After doing so you can have SSL configured only using internal network.

Hope that helps.

Regards,

Tanveer

[Former Member · Accepted solution]

Hi Gordon,

I think what Seb is trying to say here is have 2 Tomcats. One for external users and one for internal users.

You could install an additional Tomcat instance on a separate drive.

You could then bring over the .war files from your BO Tomcat to the 2nd one and deploy them.

The "Web Application Deployment Guide" would contain additional information on how to deploy: http://help.sap.com/boall_en

Note: A unique port on each Tomcat would be needed to ensure isolation on the network.

The NAT option is also valid and saves adding a 2nd instance.

Regards,

Sid

[denis_konovalov]

Use regular DMZ deployment scenario,

Have Apache web server with SSL inside DMZ and regular tomcat inside your network. Tomcat can be with or without SSL.

External users access web server in DMZ and it redirects them to tomcat inside.
Internal users access tomcat directly.

this is the most secure solution.