dcm4chee SSL with certificate from a Certificate Authority

[leogrande]

dcm4chee 2.17.3

I successfully enabled a SSL in dcm4chee with the sef-signed certificate by using the keytool utility.

But it fails when I am trying to work with the keystore which contains:
1. ca certificate
2. intermediate certificate
3. ssl certificate (web server) class1 (pem file was created by converting p12 in openssl: certificate + private key)

I have imported these certificates into the keystore by using  keytool.
keytool -list -keystore my.keystore (all imported certificates are listed correctly).

The certificate chain works with other web servers, so I can't blame it.

server.xml is set up properly for the ssl communications (at least I hope so).

What I get when open https in my web browsers:
Firefox: An error occurred during a connection to <someaddress>::9443. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)
Chrome: Error code: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Is it really a "cyphers" problem? If so why does it work with the self-signed certificate (the same server.xml file)?

I am not a Jboss/tomcat expert and do not even know how to troubleshoot this SSL problem. I found this document but I have no idea where can I find those java.security errors if any.




 

[leogrande]

I have found the reason why it didn't work for me.

I have been trying to create a keystore based on the existing certificates and I thought that my private key is enough for creating  a keystore.

But I had to follow these or that instructions:

• Create a local Certificate Signing Request (CSR)
• Importing the Certificate

So I created a CSR, submitted it to CA, retrieved a certificate, imported a root ca certificate, imported an intermediate certificate and then imported an issued certificate.

It works now.

[stockhobo]

I successfully enabled a SSL on my website https://www.diagnostikweb.de with a certificate using comodo certificate.

I have a server.crt and server.key file. please, could you explain in more details, how you have installed your
running ssl with https://mydomain/dcm4chee/. . ??

[leogrande]

The easiest way to install a SSL certificate in Tomcat:


1. Create a PKCS#12 (PFX) file with your Comodo Control Panel. For this you will need your private key, your SSL certificate and the  password for your private key.


2.  Download a created PKCS12 file (this is a keystore that contains your SSL certificate, CA chain and your private key).


3. Copy this file (p12) to ..\server\default\conf\certificates


4. In ..\default\deploy\jboss-web.deployer/server.xml file make these changes:

 
<!-- Define a SSL HTTP/1.1 Connector on port 8443 <or whatever port you use>
        
This connector uses the JSSE configuration, when using APR, the connector should be using the OpenSSL style configuration described in the APR documentation -->
        
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true" address="${jboss.bind.address}" maxThreads="100" strategy="ms" maxHttpHeaderSize="8192"

 emptySessionPath="true" sslProtocol="TLS" scheme="https" secure="true" clientAuth="false"
        
keystoreFile="${jboss.server.home.dir}/conf/certificates/<your PKCS12 file name>"
keystorePass="<private key password>" keystoreType="pkcs12"    
/>

5.  Restart Tomcat.


 


 


 

[Lutrero]

Hi leogrnade

To enable SSL in dcm4che is necesary that you have all the certificates from the CA's (root, intermediate). Then put them in a single .PEM file.
With the .PEM file, your certificate and private key you make a PKCS12 you can use openssl for that like this:
openssl pkcs12 -export -chain -in yourCert.crt -inkey yourKey.key -out youOutput.p12 -name alias -CA
file yourPEMFile.pem -caname informalName.

With that pkcs you only need to follow the tls config document.
http://www.dcm4che.org/confluence/display/ee2/Setting+up+DCM4CHEE+with+TLS++encryption

I have my pacs working like that If you need more explanations just post them.
Best regards Luis

[shoban babu]

i need step by step ssl configuration steps please guide me .

[shoban babu]

Thank you for your email. 

--
You received this message because you are subscribed to the Google Groups "dcm4che" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dcm4che+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/dcm4che/be029b13-056f-4c0d-9f17-53295f93c4c7n%40googlegroups.com.

--

With Wishes,

Shoban babu.s Trainee Software Engineer Margy Tech Pvt Ltd +91 7010512081 | 0452 2902009