Home
Products
Red Hat Certificate System
9
Planning, Installation, and Deployment Guide
13.5. web.xml

13.5. web.xml

13.5.1. Removing Unused Interfaces from web.xml (CA Only)

Several legacy interfaces (for features like bulk issuance or the policy framework) are still included in the CA's web.xml file. However, since these features are deprecated and no longer in use, then they can be removed from the CA configuration to increase security.

Stop the CA.

Copy to Clipboard Toggle word wrap

systemctl stop pki-tomcatd@instance_name.service

# systemctl stop pki-tomcatd@instance_name.service

OR (if using nuxwdog watchdog)

Copy to Clipboard Toggle word wrap

systemctl stop pki-tomcatd-nuxwdog@instance_name.service

# systemctl stop pki-tomcatd-nuxwdog@instance_name.service

Open the web files directory for the CA. For example:
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
```
cd /var/lib/pki/instance_name/ca/webapps/ca/WEB-INF
```
```
# cd /var/lib/pki/instance_name/ca/webapps/ca/WEB-INF
```
Back up the current web.xml file.
Copy to Clipboard Copied! Toggle word wrap Toggle overflow
```
cp web.xml web.xml.servlets
```
```
# cp web.xml web.xml.servlets
```

Edit the web.xml file and remove the entire <servlet> entries for each of the following deprecated servlets:

caadminEnroll
cabulkissuance
cacertbasedenrollment
caenrollment
caProxyBulkIssuance

For example, remove the caadminEnroll servlet entry:

Copy to Clipboard Toggle word wrap

<servlet>
      <servlet-name>  caadminEnroll  </servlet-name>
      <servlet-class> com.netscape.cms.servlet.cert.EnrollServlet
</servlet-class>
             <init-param><param-name>  GetClientCert  </param-name>
                         <param-value> false       </param-value> </init-param>
             <init-param><param-name>  successTemplate  </param-name>
                         <param-value> /admin/ca/EnrollSuccess.template
</param-value> </init-param>
             <init-param><param-name>  AuthzMgr    </param-name>
                         <param-value> BasicAclAuthz </param-value>
</init-param>
             <init-param><param-name>  authority   </param-name>
                         <param-value> ca          </param-value> </init-param>
             <init-param><param-name>  interface   </param-name>
                         <param-value> admin          </param-value>
</init-param>
             <init-param><param-name>  ID          </param-name>
                         <param-value> caadminEnroll </param-value>
</init-param>
             <init-param><param-name>  resourceID  </param-name>
                         <param-value> certServer.admin.request.enrollment
</param-value> </init-param>
             <init-param><param-name>  AuthMgr     </param-name>
                         <param-value> passwdUserDBAuthMgr </param-value>
</init-param>
   </servlet>

<servlet>
      <servlet-name>  caadminEnroll  </servlet-name>
      <servlet-class> com.netscape.cms.servlet.cert.EnrollServlet
</servlet-class>
             <init-param><param-name>  GetClientCert  </param-name>
                         <param-value> false       </param-value> </init-param>
             <init-param><param-name>  successTemplate  </param-name>
                         <param-value> /admin/ca/EnrollSuccess.template
</param-value> </init-param>
             <init-param><param-name>  AuthzMgr    </param-name>
                         <param-value> BasicAclAuthz </param-value>
</init-param>
             <init-param><param-name>  authority   </param-name>
                         <param-value> ca          </param-value> </init-param>
             <init-param><param-name>  interface   </param-name>
                         <param-value> admin          </param-value>
</init-param>
             <init-param><param-name>  ID          </param-name>
                         <param-value> caadminEnroll </param-value>
</init-param>
             <init-param><param-name>  resourceID  </param-name>
                         <param-value> certServer.admin.request.enrollment
</param-value> </init-param>
             <init-param><param-name>  AuthMgr     </param-name>
                         <param-value> passwdUserDBAuthMgr </param-value>
</init-param>
   </servlet>

After removing the servlet entries, remove the corresponding <servlet-mapping> entries.

Copy to Clipboard Toggle word wrap

<servlet-mapping>
      <servlet-name>  caadminEnroll  </servlet-name>
      <url-pattern>   /admin/ca/adminEnroll  </url-pattern>
</servlet-mapping>

<servlet-mapping>
      <servlet-name>  caadminEnroll  </servlet-name>
      <url-pattern>   /admin/ca/adminEnroll  </url-pattern>
</servlet-mapping>

Remove three <filter-mapping> entries for an end-entity request interface.

Copy to Clipboard Toggle word wrap

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /certbasedenrollment         </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /enrollment                  </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /profileSubmit               </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /certbasedenrollment         </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /enrollment                  </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /profileSubmit               </url-pattern>
   </filter-mapping>

Start the CA again.

Copy to Clipboard Toggle word wrap

systemctl start pki-tomcatd@instance_name.service

# systemctl start pki-tomcatd@instance_name.service

OR (if using nuxwdog watchdog)

Copy to Clipboard Toggle word wrap

systemctl start pki-tomcatd-nuxwdog@instance_name.service

# systemctl start pki-tomcatd-nuxwdog@instance_name.service

13.5. web.xml

13.5.1. Removing Unused Interfaces from web.xml (CA Only)

Learn

Try, buy, & sell

Communities

About Red Hat Documentation

Making open source more inclusive

About Red Hat

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links