5.3

40 vFabric Web Server
40
Configuring vFabric Web Server
Instances
4. Restrict Communication With tc Runtime Instances to Known Clients
5. Configure vFabric Web Server to Authenticate Using a Specific Client Certificate
Important. It is assumed that you have already installed vFabric Web Server and vFabric tc Server, created instances, and set up
unsecured load balancing between them. If you have not already done this, see Configure Load Balancing Between vFabric Web
Server and vFabric tc Server.
Configure tc Runtime Instances to Use SSL
VMware recommends that you configure a tc Runtime instance to use SSL by specifying the bio-ssl template when you
create or modify an instance; this template adds the correct configuration to the conf/server.xml file and automatically
generates a keystore based on your inputs. You specify the bio-ssl template when you create a new tc Runtime instance using
the tcruntime-instance command. Additionally, as of version 2.8 of vFabric tc Server, you can also apply the template to
an existing instance.
The following example shows how to create a new tc Runtime instance that uses the bio-ssl template:
prompt$ ./tcruntime-instance.sh create instanceOne -t bio-ssl -i /var/opt/vmware/vfabric-tc-server-standard
In the preceding example, the tc Runtime instance will be located in the /var/opt/vmware/vfabric-tc-server-
standard directory and will use default values when creating the keystore. If you want to customize the keystore, use the --
interactive option and the command will prompt you for specific information:
prompt$ ./tcruntime-instance.sh create instanceOne -t bio-ssl -i /var/opt/vmware/vfabric-tc-server-standard --interactive
The following example shows how to apply the bio-ssl template to an existing tc Runtime instance called instanceTwo:
prompt$ ./tcruntime-instance.sh apply-template instanceOne -t bio-ssl -i /var/opt/vmware/vfabric-tc-server-standard
Note: The apply-template option of tcruntime-instance is available as of version 2.8 of vFabric tc Server.
To invoke an application deployed to the tc Runtime instance using HTTPS, specify the HTTPS port. The default HTTPS port is
8443, although you might have configured a different port for your particular instance. For example:
https://host:8443/my-app
See Create and Modify a tc Runtime Instance in the Getting Started with vFabric tc Server guide in this Documentation Center
for details.
If you chose not to use the bio-ssl template, you can create your own keystore using the keytool command, as shown in the
following example:
prompt$ keytool -genkey -alias tomcat -keyalg RSA -keystore CATALINA_BASE/conf/tomcat.keystore
In the preceding example, CATALINA_BASE refers to the instance directory, such as /var/opt/vmware/vfabric-tc-
server-standard/instanceOne.
Update the appropriate <Connector /> element in the instance's conf/server.xml file by adding the keyAlias,
keystoreFile, and keystorePass attributes, setting the values to those you specified when you created the keystore using
keytool as shown above. For example:
<Connector SSLEnabled="true"
acceptCount="100"
connectionTimeout="20000"
executor="tomcatThreadPool"
keyAlias="tomcat"
keystoreFile="${catalina.base}/conf/tomcat.keystore"
keystorePass="changeme"