1

I'm working with Tomcat and nginx as a reverse proxy and I'm trying to have a better understanding of how the traffic flows and of what the security issues are. Picture this as what I have in mind:

  1. Tomcat and a webapp are installed on server X, with ports 8080 (unsecure) and 8443 (secure) open.

  2. On another server which we'll call server Y, we have a nginx host whose role is only that of a reverse proxy to Tomcat (server X).

  3. On server Y, we have TLS enabled in nginx and all traffic going to https://domain.com is proxied to Tomcat on port 8443 on server X, which is then passed to the webapp which

With this setup, my understanding is that without any additional things set-up, traffic from the client (browser) to server Y where nginx is installed is encrypted via TLS. However, Tomcat wasn't "secured" in the sense that we didn't set up a trust store on it with a keypair. This is where my understanding stops and I'm just really confused about what this implies.

Here's the traffic flow that I have in mind:

  1. Client (browser) -> https://domain.com (server X)
  2. https://domain.com (server Y) -> tomcat (server X, port 8443)
  3. tomcat -> webapp
  4. webapp -> tomcat
  5. tomcat -> https://domain.com (server Y)
  6. https://domain.com -> client (browser)

Is this high level flow even valid or am I misunderstanding something crucial? If it's not valid, could you please explain where it's wrong?

Also, is there any reason one would set up a trust store on Tomcat in such a setup? From what I understand, setting up a trust store on Tomcat here could only help to prevent unsecured direct access to the webapp that Tomcat "handles", but I don't see any other use than that.

Hope my scenario is clear, thanks a lot in advance!

Improve this question
1
  • A trust store is about the certificates Tomcat trusts. Since Tomcat makes no HTTPS connections by its own (only accepts connection where it serves the local certificate but does not validate a remote certificate) the trust store is irrelevant.
    – Steffen Ullrich
    Jun 1, 2021 at 19:19

1 Answer 1

Reset to default
0

There is most likely a self signed local certificate n the trust store (since default setups do that sort of thing).

Which makes it like this:

  1. Client to nginx (tls on port 443) CERT valid for domain
  2. Nginx to tomcat server (tls on port 8443) CERT self signed for localhost.
  3. Tomcat internal routing to web app (NO TLS)
  4. Backtrack from tomcat to nginx (TLS)
  5. Backtrack from nginx to client (TLS)

I hope this helps you understand.

Improve this answer
2
  • Thanks, that does help. However, to make sure I don't misunderstand things: if we do NOT create a truststore there, the bidirectional traffic between nginx and tomcat could be sniffed on by whoever has access to either machines right? Because then there's no self signed certificate providing TLS.
    – SilentSib
    Jun 5, 2021 at 14:40
  • Indeed. But if that traffic is on the local machine you could also snif the traffic from the process itself.
    – LvB
    Jun 5, 2021 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .