2

I have a .NET MVC Application which is hosted in IIS. Users of the Application will be company only and it will be access so it will be on the intranet - app wont be exposed via internet. Within IIS I created a new Certificate Request (though I wasnt asked to enter a private key at all doing this from the wizard within IIS) - our company signed that with our trusted root CA and then I completed that Certificate Request in IIS and when I hit my IIS server I get my application coming up fine.

What I need to do now is set up 2 way mutual authentication with another application which is also hosted internally within the company but is hosted on a Tomcat Server.

So there is a RESTful service on the application that is hosted on Tomcat that I need to hit from my MVC controller action. So from my HomeController Index action I need to hit a RESTful service on the Tomcat application. The authentication I need to have in place between .NET app and Tomcat App is 2 way mutual authentication with certificates. Can anyone advise on the correct way to set up this two way mutual auth with certs between IIS and Tomcat. Should I give the admin of the Tomcat sever the CSR I created and they will give me the certificate they have generated for their app on Tomcat? Im not sure what I should do with the certificate I get from the Tomcat App - should it be installed within MMC?

And what is the correct way to connect to teh RESTful Service on Tomcat using the certs we both have in place to make sure that both Applications trust each other?

Improve this question
2
  • Are you asking for the the .net app to authenticate to the tomcat app via a client side certificate?
    – k1DBLITZ
    Dec 8, 2014 at 14:12
  • yeah - I need the .NET app to have a 2 way mutual authentication with the RESTful service which is hosted on Tomcat
    – whiteknight
    Dec 8, 2014 at 16:26

1 Answer 1

Reset to default
1

It sounds to me like you need to configure the Tomcat service to request a client side certificate for authentication.

I'm wise in the ways of IIS, but unfortunately Tomcat is not my forte.

DO NOT give the admin of Tomcat your CSR.

I recommend referencing Configure SSL Mutual (Two-way) Authentication

Ideally you would use your internal CA to sign a client certificate as opposed to generating this from Tomcat/OpenSSL

From what I recall, Tomcat does not use the Windows certificate store, so you'll want to make sure the appropriate root and intermediate certs (if there are any) are also loaded into the Tomcat/Java keystore.

enter image description here Image from: http://www.codeproject.com/Articles/326574/An-Introduction-to-Mutual-SSL-Authentication

Improve this answer
2
  • The admin of Tomcat is a person within the company - dont we have to exchange certificates in order for both our applications to trust each other - i.e - I give them my certificate to install in tomcat keystore and he gives me cert to install in mmc?
    – whiteknight
    Dec 8, 2014 at 19:34
  • 1
    It doesn't quite work that way. Please reference the diagram I added to the answer which will hopefully clarify things a bit. The Tomcat server will indeed have a server certificate signed by your corporate CA. The tomcat server will also generate a client side certificate. This client side certificate is what you install/embed within your .net server/application. The tomcat server should be configured to grant access only to users/entities who present a client side certificate issued by the tomcat server.
    – k1DBLITZ
    Dec 8, 2014 at 22:11

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .