Embedded Tomcat in Eclipse could not start after mvn clean - solved

Web server could not start in Eclipse (or Spring Tool Suite, STS) after doing mvn clean on your project.

Solution is in 2 steps:
1. Change Server path / Deploy path as described here: http://stackoverflow.com/questions/16340711/tomcat-http-status-404
Key moments on this step:
1.1. server has to be stopped
1.2. to ensure full stop, just restart Eclipse
1.3. you have to mark Tomcat Installation

2. Ensure Eclipse uses JDK, not JRE. I dont know why by default Eclipse ignore JAVA_HOME and uses JRE. Solution is described here: http://stackoverflow.com/questions/13259866/why-does-maven-want-to-use-jre7-instead-of-jdk-against-all-adjustments
In short:
2.1. Window -> Preferences
2.2. Java -> Installed JREs
2.3. add base path of JDK (with includes files src.xip and foldersbin, db...)
2.4. deactivate old and activate new one

Client authentication with SSL certificates in Tomcat

Place something like this in server.xml file:

      <Connector port="8443" 
           protocol="HTTP/1.1" 
           SSLEnabled="true"
           maxThreads="150" 
           scheme="https" 
           secure="true"
           sslProtocol="TLS"
           keystorePass="pass"
           keystoreFile="/data/abcd/someserver/server1.jks"
           truststoreFile="/data/abcd/eshop/AbcdRootCa.jks"
           truststorePass="pass"
           keyAlias="www.google.com"
           clientAuth="want"
           SSLVerifyClient="optional"
           SSLCACertificateFile="/data/abcd/someserver/AbcdRootCA.pem"
       />


Attention: clientAuth parameter, in Tomcat 6.0 can get value "want", so it accepts connections with and wothout certificates. The application could decide what to do with the two types of clients internally. Take attention Tomcat 6.0 COULD NOT understand option clientAuth="optional". I suppose it was valid sometime, but now it is not.

Getting HTTPS SSL certificates from HttpRequest in Java

Such an easy solution:

java.security.cert.X509Certificate cert[] =
(java.security.cert.X509Certificate[]) httpServletRequest.getAttribute
("javax.servlet.request.X509Certificate");


The result is the whole certificate chain.

The client could or could not send its certificate. A client certificate can be send in SSL version 3 and in TLS. You have to set an option to the web application server to want ant to accept client certificates. In jetty, the option is named wantClientAuth. Later I will extend the article with the name for Tomcat.