Configure HTTPS

To authenticate to clients, the Collaborator server must have a certificate that serves as proof of identity. Certificates come in two forms: Certificate Authority (CA) signed certificates and self-signed certificates. CA-signed certificates provide an additional level of security because they can be automatically verified and do not rely on human verification. By providing you a certificate, the certificate authority is vouching for your identity. Software systems such as web browsers and the Java Runtime Environment (JRE) include the public keys of the trusted certificate authorities that are used to verify server certificates were vouched for by a trusted CA. To acquire a CA-signed certificate, contact the appropriate person in your IT department.

Self-signed certificates have the advantages of being free and easy to generate. The disadvantage of self-signed certificates is that they cannot be automatically verified. Instead, their security relies on users verifying the certificate signature against a signature obtained through another, ideally secure, channel.

A keystore is a mechanism for storing cryptographic keys and certificates in Java. The persistent form of a keystore is a password-protected file on disk. A keystore may contain key entries that allow applications with access to the keystore to authenticate themselves to users or other services. A keystore is also used to store trusted certificate entries that contain the public keys of services that are trusted and certificate authorities that are trusted to vouch for services.

To enable HTTPS in Collaborator, you will need to create a keystore with the certificate of the server (either CA, or self-signed). For CA-signed certificates – the chain certificate the certificate authority. Follow the instructions below to create a keystore with the type of certificate you will be using to secure Collaborator.

To get started, you must use the Java keytool command (located in <Java home directory>/bin). Running keytool as follows will create a new private key and install a self-signed certificate:

You will be prompted to answer a series of questions. When you are prompted to enter your first and last name, enter the host and domain name you intend to use to address the Collaborator server instead. For example:

Once you complete the rest of the prompts and assigned a password to the keystore, you have created a private key and a self-signed certificate. Make sure to remember the keystore password you set, as you must include it in your server configuration.

For many organizations, this is sufficient to guarantee security. However, web browsers and the Collaborator client will request confirmation from end users, unless the certificate is not signed by an existing certificate authority.

If you wish to have a certificate authority sign your server certificate, please follow the steps described in Create Certificate Signing Request.

After the steps described above, you can create a certificate-signing request with the following command:

You will be prompted to enter the keystore password. This should create a file named tomcat.csr which you will need to provide to your signing authority. This may be Verisign, Thawte, another certificate vendor, or a group internal to your organization. Once they have verified the information provided, the signing authority will send you a certificate file.

If you are using a CA-signed certificate, you will need the server certificate and the chain certificate of the certificate authority (or root certificate). The CA chain certificates are publicly available, but the instructions for acquiring them vary by certificate authority. To get the CA chain certificate, ask the IT person in your organization responsible for procuring SSL certificates for services. Once you have the certificates, import them into a new keystore using the Java keytool program (located in <Java home directory>/bin).

To import the CA chain certificate:

To import the server certificate:

Remember the keystore password you select, as you will need this when configuring the Collaborator server.

Some popular signature authorities now provide both a primary and intermediate certificate. The steps below may work more effectively in those cases than the steps above.

First, assemble a single file containing all of the certificates (primary, intermediate, and server) provided to you by your signature authority:

• On UNIX systems – Use the following code line:

  cat primary.cert intermediate.cert tomcat.cert > combined.txt

• On Windows systems – In Notepad, copy and paste all the provided certificates into a single file, then save it as combined.txt. After that, run the following command:

  keytool -importcert -alias tomcat -trustcacerts -file combined.txt

  This will import all three (or more) certificates at the same time, establishing the correct chain of trust.