主页
产品
Red Hat Certificate System
9
Planning, Installation, and Deployment Guide
13.5. web.xml

此内容没有您所选择的语言版本。

13.5. web.xml

13.5.1. Removing Unused Interfaces from web.xml (CA Only)
复制链接

Several legacy interfaces (for features like bulk issuance or the policy framework) are still included in the CA's web.xml file. However, since these features are deprecated and no longer in use, then they can be removed from the CA configuration to increase security.

Stop the CA.

systemctl stop pki-tomcatd@instance_name.service

# systemctl stop pki-tomcatd@instance_name.service

Copy to Clipboard

Toggle word wrap

OR (if using nuxwdog watchdog)

systemctl stop pki-tomcatd-nuxwdog@instance_name.service

# systemctl stop pki-tomcatd-nuxwdog@instance_name.service

Copy to Clipboard

Toggle word wrap

Open the web files directory for the CA. For example:
```
cd /var/lib/pki/instance_name/ca/webapps/ca/WEB-INF
```
```
# cd /var/lib/pki/instance_name/ca/webapps/ca/WEB-INF
```
Copy to Clipboard Toggle word wrap
Back up the current web.xml file.
```
cp web.xml web.xml.servlets
```
```
# cp web.xml web.xml.servlets
```
Copy to Clipboard Toggle word wrap

Edit the web.xml file and remove the entire <servlet> entries for each of the following deprecated servlets:

caadminEnroll
cabulkissuance
cacertbasedenrollment
caenrollment
caProxyBulkIssuance

For example, remove the caadminEnroll servlet entry:

<servlet>
      <servlet-name>  caadminEnroll  </servlet-name>
      <servlet-class> com.netscape.cms.servlet.cert.EnrollServlet
</servlet-class>
             <init-param><param-name>  GetClientCert  </param-name>
                         <param-value> false       </param-value> </init-param>
             <init-param><param-name>  successTemplate  </param-name>
                         <param-value> /admin/ca/EnrollSuccess.template
</param-value> </init-param>
             <init-param><param-name>  AuthzMgr    </param-name>
                         <param-value> BasicAclAuthz </param-value>
</init-param>
             <init-param><param-name>  authority   </param-name>
                         <param-value> ca          </param-value> </init-param>
             <init-param><param-name>  interface   </param-name>
                         <param-value> admin          </param-value>
</init-param>
             <init-param><param-name>  ID          </param-name>
                         <param-value> caadminEnroll </param-value>
</init-param>
             <init-param><param-name>  resourceID  </param-name>
                         <param-value> certServer.admin.request.enrollment
</param-value> </init-param>
             <init-param><param-name>  AuthMgr     </param-name>
                         <param-value> passwdUserDBAuthMgr </param-value>
</init-param>
   </servlet>

<servlet>
      <servlet-name>  caadminEnroll  </servlet-name>
      <servlet-class> com.netscape.cms.servlet.cert.EnrollServlet
</servlet-class>
             <init-param><param-name>  GetClientCert  </param-name>
                         <param-value> false       </param-value> </init-param>
             <init-param><param-name>  successTemplate  </param-name>
                         <param-value> /admin/ca/EnrollSuccess.template
</param-value> </init-param>
             <init-param><param-name>  AuthzMgr    </param-name>
                         <param-value> BasicAclAuthz </param-value>
</init-param>
             <init-param><param-name>  authority   </param-name>
                         <param-value> ca          </param-value> </init-param>
             <init-param><param-name>  interface   </param-name>
                         <param-value> admin          </param-value>
</init-param>
             <init-param><param-name>  ID          </param-name>
                         <param-value> caadminEnroll </param-value>
</init-param>
             <init-param><param-name>  resourceID  </param-name>
                         <param-value> certServer.admin.request.enrollment
</param-value> </init-param>
             <init-param><param-name>  AuthMgr     </param-name>
                         <param-value> passwdUserDBAuthMgr </param-value>
</init-param>
   </servlet>

Copy to Clipboard

Toggle word wrap

After removing the servlet entries, remove the corresponding <servlet-mapping> entries.

<servlet-mapping>
      <servlet-name>  caadminEnroll  </servlet-name>
      <url-pattern>   /admin/ca/adminEnroll  </url-pattern>
</servlet-mapping>

<servlet-mapping>
      <servlet-name>  caadminEnroll  </servlet-name>
      <url-pattern>   /admin/ca/adminEnroll  </url-pattern>
</servlet-mapping>

Copy to Clipboard

Toggle word wrap

Remove three <filter-mapping> entries for an end-entity request interface.

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /certbasedenrollment         </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /enrollment                  </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /profileSubmit               </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /certbasedenrollment         </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /enrollment                  </url-pattern>
   </filter-mapping>

   <filter-mapping>
      <filter-name>  EERequestFilter              </filter-name>
      <url-pattern>  /profileSubmit               </url-pattern>
   </filter-mapping>

Copy to Clipboard

Toggle word wrap

Start the CA again.

systemctl start pki-tomcatd@instance_name.service

# systemctl start pki-tomcatd@instance_name.service

Copy to Clipboard

Toggle word wrap

OR (if using nuxwdog watchdog)

systemctl start pki-tomcatd-nuxwdog@instance_name.service

# systemctl start pki-tomcatd-nuxwdog@instance_name.service

Copy to Clipboard

Toggle word wrap

返回顶部

此内容没有您所选择的语言版本。

13.5. web.xml

13.5.1. Removing Unused Interfaces from web.xml (CA Only)
复制链接

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

此内容没有您所选择的语言版本。

13.5. web.xml

13.5.1. Removing Unused Interfaces from web.xml (CA Only)复制链接链接已复制到粘贴板!

学习

尝试、购买和销售

社区

关于红帽文档

让开源更具包容性

關於紅帽

Theme

Red Hat legal and privacy links

Red Hat legal and privacy links

13.5.1. Removing Unused Interfaces from web.xml (CA Only)
复制链接