Tomcat 10.1.19 · org.apache.catalina.valves.SSLValve

When using mod_proxy_http, the client SSL information is not included in the protocol (unlike mod_jk and mod_proxy_ajp). To make the client SSL information available to Tomcat, some additional configuration is required. In httpd, mod_headers is used to add the SSL information as HTTP headers. In Tomcat, this valve is used to read the information from the HTTP headers and insert it into the request.

Note

Ensure that the headers are always set by httpd for all requests to prevent a client spoofing SSL information by sending fake headers.

In httpd.conf add the following:

<IfModule ssl_module>
  RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
  RequestHeader set SSL_CIPHER "%{SSL_CIPHER}s"
  RequestHeader set SSL_SESSION_ID "%{SSL_SESSION_ID}s"
  RequestHeader set SSL_CIPHER_USEKEYSIZE "%{SSL_CIPHER_USEKEYSIZE}s"
</IfModule>

In server.xml, configure this valve under the Engine element in server.xml:

<Engine ...>
  <Valve className="org.apache.catalina.valves.SSLValve" />
  <Host ... />
</Engine>

Modifier and Type	Field and Description
private static final Log	log Hides org.apache.catalina.util.LifecycleMBeanBase.log.
private String	sslCipherHeader
private String	sslCipherUserKeySizeHeader
private String	sslClientCertHeader
private String	sslClientEscapedCertHeader
private String	sslSessionIdHeader

Access	Constructor and Description
public	SSLValve()

Modifier and Type	Method and Description
public String	getSslCipherHeader()
public String	getSslCipherUserKeySizeHeader()
public String	getSslClientCertHeader()
public String	getSslClientEscapedCertHeader()
public String	getSslSessionIdHeader()
public void	invoke(Request The servlet request to be processed request, Response The servlet response to be created response) Implements org.apache.catalina.Valve.invoke. Perform request processing as required by this Valve.
public String	mygetHeader(Request request, String header)
public void	setSslCipherHeader(String sslCipherHeader)
public void	setSslCipherUserKeySizeHeader(String sslCipherUserKeySizeHeader)
public void	setSslClientCertHeader(String sslClientCertHeader)
public void	setSslClientEscapedCertHeader(String sslClientEscapedCertHeader)
public void	setSslSessionIdHeader(String sslSessionIdHeader)

log	back to summary
private static final Log log Hides org.apache.catalina.util.LifecycleMBeanBase.log.

sslCipherHeader	back to summary
private String sslCipherHeader

sslCipherUserKeySizeHeader	back to summary
private String sslCipherUserKeySizeHeader

sslClientCertHeader	back to summary
private String sslClientCertHeader

sslClientEscapedCertHeader	back to summary
private String sslClientEscapedCertHeader

sslSessionIdHeader	back to summary
private String sslSessionIdHeader

SSLValve	back to summary
public SSLValve()

Method Detail

getSslCipherHeader	back to summary
public String getSslCipherHeader()

getSslCipherUserKeySizeHeader	back to summary
public String getSslCipherUserKeySizeHeader()

getSslClientCertHeader	back to summary
public String getSslClientCertHeader()

getSslClientEscapedCertHeader	back to summary
public String getSslClientEscapedCertHeader()

getSslSessionIdHeader	back to summary
public String getSslSessionIdHeader()

invoke back to summary

invoke	back to summary
public void invoke(Request request, Response response) throws IOException, ServletException Implements org.apache.catalina.Valve.invoke. Doc from org.apache.catalina.Valve.invoke. Perform request processing as required by this Valve. An individual Valve MAY perform the following actions, in the specified order: Examine and/or modify the properties of the specified Request and Response. Examine the properties of the specified Request, completely generate the corresponding Response, and return control to the caller. Examine the properties of the specified Request and Response, wrap either or both of these objects to supplement their functionality, and pass them on. If the corresponding Response was not generated (and control was not returned, call the next Valve in the pipeline (if there is one) by executing `getNext().invoke()`. Examine, but not modify, the properties of the resulting Response (which was created by a subsequently invoked Valve or Container). A Valve MUST NOT do any of the following things: Change request properties that have already been used to direct the flow of processing control for this request (for instance, trying to change the virtual host to which a Request should be sent from a pipeline attached to a Host or Context in the standard implementation). Create a completed Response AND pass this Request and Response on to the next Valve in the pipeline. Consume bytes from the input stream associated with the Request, unless it is completely generating the response, or wrapping the request before passing it on. Modify the HTTP headers included with the Response after the `getNext().invoke()` method has returned. Perform any actions on the output stream associated with the specified Response after the `getNext().invoke()` method has returned. Parameters request:Request The servlet request to be processed response:Response The servlet response to be created Annotations @Override Exceptions IOException: if an input/output error occurs, or is thrown by a subsequently invoked Valve, Filter, or Servlet ServletException: if a servlet error occurs, or is thrown by a subsequently invoked Valve, Filter, or Servlet

public void invoke(Request request, Response response) throws IOException, ServletException

Implements org.apache.catalina.Valve.invoke.

Doc from org.apache.catalina.Valve.invoke.

Perform request processing as required by this Valve.

An individual Valve MAY perform the following actions, in the specified order:

Examine and/or modify the properties of the specified Request and Response.
Examine the properties of the specified Request, completely generate the corresponding Response, and return control to the caller.
Examine the properties of the specified Request and Response, wrap either or both of these objects to supplement their functionality, and pass them on.
If the corresponding Response was not generated (and control was not returned, call the next Valve in the pipeline (if there is one) by executing getNext().invoke().
Examine, but not modify, the properties of the resulting Response (which was created by a subsequently invoked Valve or Container).

A Valve MUST NOT do any of the following things:

Change request properties that have already been used to direct the flow of processing control for this request (for instance, trying to change the virtual host to which a Request should be sent from a pipeline attached to a Host or Context in the standard implementation).
Create a completed Response AND pass this Request and Response on to the next Valve in the pipeline.
Consume bytes from the input stream associated with the Request, unless it is completely generating the response, or wrapping the request before passing it on.
Modify the HTTP headers included with the Response after the getNext().invoke() method has returned.
Perform any actions on the output stream associated with the specified Response after the getNext().invoke() method has returned.

Parameters

request:Request: The servlet request to be processed
response:Response: The servlet response to be created

Annotations

@Override

Exceptions

IOException:: if an input/output error occurs, or is thrown by a subsequently invoked Valve, Filter, or Servlet
ServletException:: if a servlet error occurs, or is thrown by a subsequently invoked Valve, Filter, or Servlet

mygetHeader	back to summary
public String mygetHeader(Request request, String header)

setSslCipherHeader	back to summary
public void setSslCipherHeader(String sslCipherHeader)

setSslCipherUserKeySizeHeader	back to summary
public void setSslCipherUserKeySizeHeader(String sslCipherUserKeySizeHeader)

setSslClientCertHeader	back to summary
public void setSslClientCertHeader(String sslClientCertHeader)

setSslClientEscapedCertHeader	back to summary
public void setSslClientEscapedCertHeader(String sslClientEscapedCertHeader)

setSslSessionIdHeader	back to summary
public void setSslSessionIdHeader(String sslSessionIdHeader)

public Class SSLValve

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail