X509 authn under Jetty

[Ian Bobbitt]

On 8/23/16 11:47 AM, Cantor, Scott wrote:
> On 8/23/16 11:27 AM, Ian Bobbitt wrote:
>> Is there a better way to do it? Am I missing something obvious?
> 
> I have no idea. I didn't find a way to make Jetty honor the security
> constraint unless I configured the connector, but since my goal was
> "test my code" and not "do something useful", it wasn't something I
> needed to figure out the answer to.
> 

Fair enough. I'd love to hear from someone actively using X509 authentication who can share their experience and
relevant configuration.

>> From reading docs <https://tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support_-_SSLHostConfig>,
>> Tomcat does appear to support what I want:
>>
>> certificateVerification: [...] A none value (which is the default) will not
>> require a certificate chain unless the client requests a resource
> protected
>> by a security constraint that uses CLIENT-CERT authentication.
> 
> That's renegotiation, which as I said seems to be viewed as a "bad
> thing" by lots of people these days. I don't know enough to know the
> truth about it.
> 

If you're talking about what I think you're talking about (CVE-2009-3555), it's been fixed in the JRE for quite a while
(since 6u22 <http://www.oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html>)

> -- Scott
>