13.5. web.xml
13.5.1. Removing Unused Interfaces from web.xml (CA Only)
Several legacy interfaces (for features like bulk issuance or the policy framework) are still included in the CA's
web.xml file. However, since these features are deprecated and no longer in use, then they can be removed from the CA configuration to increase security.
- Stop the CA.
# systemctl stop pki-tomcatd@instance_name.service
OR (if usingnuxwdog watchdog)# systemctl stop pki-tomcatd-nuxwdog@instance_name.service
- Open the web files directory for the CA. For example:
# cd /var/lib/pki/instance_name/ca/webapps/ca/WEB-INF
- Back up the current
web.xmlfile.# cp web.xml web.xml.servlets
- Edit the
web.xmlfile and remove the entire<servlet>entries for each of the following deprecated servlets:- caadminEnroll
- cabulkissuance
- cacertbasedenrollment
- caenrollment
- caProxyBulkIssuance
For example, remove thecaadminEnrollservlet entry:<servlet> <servlet-name> caadminEnroll </servlet-name> <servlet-class> com.netscape.cms.servlet.cert.EnrollServlet </servlet-class> <init-param><param-name> GetClientCert </param-name> <param-value> false </param-value> </init-param> <init-param><param-name> successTemplate </param-name> <param-value> /admin/ca/EnrollSuccess.template </param-value> </init-param> <init-param><param-name> AuthzMgr </param-name> <param-value> BasicAclAuthz </param-value> </init-param> <init-param><param-name> authority </param-name> <param-value> ca </param-value> </init-param> <init-param><param-name> interface </param-name> <param-value> admin </param-value> </init-param> <init-param><param-name> ID </param-name> <param-value> caadminEnroll </param-value> </init-param> <init-param><param-name> resourceID </param-name> <param-value> certServer.admin.request.enrollment </param-value> </init-param> <init-param><param-name> AuthMgr </param-name> <param-value> passwdUserDBAuthMgr </param-value> </init-param> </servlet> - After removing the servlet entries, remove the corresponding
<servlet-mapping>entries.<servlet-mapping> <servlet-name> caadminEnroll </servlet-name> <url-pattern> /admin/ca/adminEnroll </url-pattern> </servlet-mapping> - Remove three
<filter-mapping>entries for an end-entity request interface.<filter-mapping> <filter-name> EERequestFilter </filter-name> <url-pattern> /certbasedenrollment </url-pattern> </filter-mapping> <filter-mapping> <filter-name> EERequestFilter </filter-name> <url-pattern> /enrollment </url-pattern> </filter-mapping> <filter-mapping> <filter-name> EERequestFilter </filter-name> <url-pattern> /profileSubmit </url-pattern> </filter-mapping> - Start the CA again.
# systemctl start pki-tomcatd@instance_name.service
OR (if usingnuxwdog watchdog)# systemctl start pki-tomcatd-nuxwdog@instance_name.service
