@@ -62,11 +62,10 @@ class Tomcat extends ServerAbstract implements WorkerServer {
6262 this . cfgHost = (cfgHost) ?: ' '
6363 postInstallErrFile = new File (basedir, ' tomcatPostInstallErr.log' )
6464 postInstallOutFile = new File (basedir, ' tomcatPostInstallOut.log' )
65- String sslStringDir = PathHelper . join(platform. tmpDir, " ssl" , " self_signed " )
65+ String sslStringDir = PathHelper . join(platform. tmpDir, " ssl" , DefaultProperties . SELF_SIGNED_CERTIFICATE_RESOURCE )
6666 this . sslCertDir = new File (sslStringDir)
6767 this . sslCertificate = new File (sslCertDir, " server.crt" ). absolutePath
6868 this . sslKey = new File (sslCertDir, " server.key" ). absolutePath
69- this . keystorePath = new File (sslCertDir, " server.jks" ). absolutePath
7069
7170 }
7271
@@ -121,7 +120,7 @@ class Tomcat extends ServerAbstract implements WorkerServer {
121120 File f = new File (keystorePath)
122121 URL certUrl = f. toURI(). toURL()
123122 webClient. getOptions(). setUseInsecureSSL(true )
124- webClient. getOptions(). setSSLClientCertificate(certUrl, sslKeystorePassword, " jks " )
123+ webClient. getOptions(). setSSLClientCertificate(certUrl, sslKeystorePassword, keystoreType )
125124 serverUrl = this . getUrl(' ' , true )
126125 } else {
127126 serverUrl = this . getUrl()
@@ -192,6 +191,19 @@ class Tomcat extends ServerAbstract implements WorkerServer {
192191 }
193192 }
194193
194+ /**
195+ * Check log files for ERRORS and WARNINGS
196+ */
197+ List<String > verifyLogs () {
198+ final List<String > defaultFilteredLines = platform. isFips() ? Arrays . asList(
199+ " Creation of SecureRandom instance for session ID generation using \\ [.*\\ ] took \\ [" ,
200+ " Exception initializing random number generator using algorithm \\ [SHA1PRNG\\ ]" ,
201+ " ErrorReportValve\\ .java"
202+ ) : Arrays . asList(
203+ " Creation of SecureRandom instance for session ID generation using \\ [.*\\ ] took \\ [" )
204+ return super . verifyLogs(defaultFilteredLines)
205+ }
206+
195207 /**
196208 * Start the server Tomcat with JSVC wrapper
197209 */
@@ -636,9 +648,16 @@ class Tomcat extends ServerAbstract implements WorkerServer {
636648 def dummyComment = ' <!-- Define an AJP 1.3 Connector on port 8009 -->'
637649 def enableJavaSsl = ' <Connector port="' + this . mainHttpsPort. toString() + ' " protocol="HTTP/1.1" SSLEnabled="true"' + nl +
638650 ' maxThreads="150" scheme="https" secure="true"' + nl +
639- ' keystoreFile="' + this . keystorePath + ' " keystorePass="' + this . sslKeystorePassword + ' "' + nl +
651+ ' keystoreFile="' + this . keystorePath + ' " keystoreType=" ' + this . keystoreType + ' " keystorePass="' + this . sslKeystorePassword + ' "' + nl +
640652 ' clientAuth="false" sslProtocol="TLS" />'
641-
653+ if (platform. isFips()) {
654+ enableJavaSsl = ' <Connector port="' + this . mainHttpsPort. toString() + ' " protocol="HTTP/1.1"' + nl +
655+ ' SSLEnabled="true" maxThreads="150" scheme="https" secure="true"' + nl +
656+ ' clientAuth="false" sslEnabledProtocols="TLSv1.1+TLSv1.2"' + nl +
657+ ' keystorePass="' + this . sslKeystorePassword + ' "' + nl +
658+ ' keystoreType="' + this . keystoreType + ' "' + nl +
659+ ' ciphers="' + DefaultProperties . FIPS_140_2_CIPHERS + ' " />'
660+ }
642661 updateConfReplaceRegExp(' server.xml' , aprListener, commentAprListener, true , true )
643662 updateConfReplaceRegExp(' server.xml' , dummyComment, enableJavaSsl, true , true )
644663 }
@@ -651,8 +670,11 @@ class Tomcat extends ServerAbstract implements WorkerServer {
651670 ' maxThreads="200" scheme="https" secure="true"' + nl +
652671 ' SSLCertificateFile="' + this . sslCertificate + ' "' + nl +
653672 ' SSLCertificateKeyFile="' + this . sslKey + ' "' + nl +
654- ' SSLPassword="' + this . sslKeystorePassword + ' "' + nl +
655- ' />'
673+ ' SSLPassword="' + this . sslKeystorePassword + ' "' + nl
674+ if (platform. isFips()) {
675+ enableOpenSsl + = ' ciphers="' + DefaultProperties . FIPS_140_2_CIPHERS + ' "'
676+ }
677+ enableOpenSsl + = ' />'
656678
657679 updateConfReplaceRegExp(' server.xml' , dummyComment, enableOpenSsl, true , true )
658680 }
@@ -666,7 +688,13 @@ class Tomcat extends ServerAbstract implements WorkerServer {
666688 def enableNIOSsl = ' <Connector port="' + this . mainHttpsPort. toString() + ' " protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"' + nl +
667689 ' maxThreads="150" scheme="https" secure="true"' + nl +
668690 ' keystoreFile="' + this . keystorePath + ' " keystorePass="' + this . sslKeystorePassword + ' "' + nl +
669- ' clientAuth="false" sslProtocol="TLS" />'
691+ ' clientAuth="false" '
692+ if (platform. isFips()) {
693+ enableNIOSsl + = ' sslEnabledProtocols="TLSv1.1+TLSv1.2" '
694+ } else {
695+ enableNIOSsl + = ' sslProtocol="TLS" '
696+ }
697+ enableNIOSsl + = ' keystoreType="' + this . keystoreType + ' " />'
670698
671699 updateConfReplaceRegExp(' server.xml' , aprListener, commentAprListener, true , true )
672700 updateConfReplaceRegExp(' server.xml' , dummyComment, enableNIOSsl, true , true )
0 commit comments