SSL Configuration Resin 4.0

Resin's HTTP server can use JSSE or OpenSSL for SSL connections.

http, protocol, cluster-port

<openssl> configures the port to use OpenSSL for SSL support (requires Resin Professional). OpenSSL is a fast C implementation of SSL security used by Apache. Resin's configuration is OpenSSL follows Apache's configuration, so any documentation on installing SSL certificates can use documentation for Apache.

The SSL section of the Security documentation provides a comprehensive overview of SSL.

ca-certificate-file Path to a CA certificate file for intermediate CA support optional ca-certificate-path Path to a directory of CA certificates for intermediate CA support optional ca-revocation-file Path to a list of revoked CA certificates optional ca-revocation-path Path to a directory of revoked CA certificates optional certificate-file Path to the server's SSL certificate required certificate-chain-file Path to the certificate chains for client validation. optional certificate-key-file Path to the server's SSL private key certificate required cipher-suite Additions and restrictions to the allowed cryptography ciphers see openssl-tags password Password protecting the public key see openssl-tags protocol Optional restrictions on the SSL protocol see openssl-tags session-cache Boolean enabling caching of SSL sessions for performance false session-cache-timeout Timeout for session cache values 30s unclean-shutdown Flag indicating that openssl sockets can be shutdown uncleanly false verify-client Options for client validation none verify-depth Depth of the client certificate chains to validate unlimited openssl

<password> configures the SSL private key certificate password.

 http, protocol, server

The <port> defines the TCP port the HTTP or protocol should bind to.

<resin xmlns="http://caucho.com/ns/resin"> <cluster id="web-tier"> <server id="web-a" address="192.168.1.1" port="6800"> <http address="10.0.1.1" port="80"/> <http address="192.168.1.1" port="8080"/> </server> ... </cluster> </resin> openssl

<protocol> configures the SSL allowed protocols.

 openssl

<session-cache> configures the SSL session cache.

 openssl

<session-cache> configures the SSL session cache timeout.

 openssl

<unclean-shutdown> configures the OpenSSL unclean shutdown on connection close.

 openssl

<verify-client> sets the client certificate configuration. If the certificate is available, it will be put in the javax.servlet.request.X509Certificate request attribute.

none do not ask for a client certificate (default) required require a client certificate optional ask for a client certificate if availiable optional-no-ca ask for a client certificate, but do not validate the Certificate Authority X509Certificate []certs = (X509Certificate []) request.getAttribute("javax.servlet.request.X509Certificate"); openssl

<verify-depth> configures the OpenSSL client verification depth.