Enabling Tomcat server for Smart card Authentication

If necessary, you can set up smart card authentication in the Tomcat server. In this case, an administrator who wants to access the eperi sEcure Admin Console must additionally authenticate via smart card.

1. Upload the keystores containing the server and client certificates to the eperi sEcure Platform server in the following directory: /opt/eperi/gateway/tomcat.
2. Enable the Tomcat server to ask for certification as follows:
   1. Open the file server.xml in the editor:

      sudo vi /etc/eperi/gateway/tomcat/server.xml

   2. Within the file server.xml, search for the section <Service name="Catalina">.
      Immediately below this, you should see <Connector port "8080" />.
   3. Add the following after the <Connector Port "8080" /> section:

      <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
      keystoreFile="/opt/eperi/gateway/tomcat/serverssl-keystore.jks"
      keystorePass=">yourpassword<"
      keystoreType="PKCS12"
      
      truststoreFile="/opt/eperi/gateway/tomcat/client-truststore.jks"
      truststorePass=">yourpassword<"
      clientAuth="true"
      
      maxThreads="150" scheme="https" secure="true"
      sslEnabledProtocols="TLSv1.2+TLSv1.3"
      ciphers="TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,ECDHE-ECDSA-AES128
      -GCM-SHA256,ECDHE-RSA-AES128-GCM-SHA256,ECDHE-ECDSA-AES256-GCM-SHA384,ECDHE-RSA-AES256-GCM-SHA384,
      ECDHE-ECDSA-CHACHA20-POLY1305,ECDHE-RSA-CHACHA20-POLY1305,DHE-RSA-AES128-GCM-SHA256,DHE-RSA-AES256
      -GCM-SHA384"
      />

   4. Adapt the above configuration according to the actual file names, paths and passwords of the truststores.
   5. Save your changes.
3. Restart the eperi sEcure Platform services:
   Important: Before you (re)start the Postfix SMTP Relay, please make sure that the eperi sEcure Platform is up and running. This is the case if you can access the log-in page of the eperi sEcure Platform Admin Console.

   sudo systemctl restart eperi-gateway
   sudo systemctl restart postfix
   sudo systemctl restart eperi-milter

   Important: In a cluster setup, the changes must be made on every eperi sEcure Platform instance and each eperi sEcure Platform instance must be restarted.
4. Import the client certificate file into your web browser.
5. Try connecting to the eperi sEcure Admin Console over HTTPS, e.g. https://demo.eperi-cdp.com:8443.