Thax - Wiki Development
Windows Binaries of OpenSSLhttp://www.slproweb.com/products/Win32OpenSSL.html
OpenSSL
SSL Client Auth with tomcat
http://web.mit.edu/mmoretti/www/tomcatcertshowto/
Also mentions directory level protection
More client auth stuff from http://tomcat.apache.org/tomcat-5.0-doc/ssl-howto.html
Set this value to true if you want Tomcat to require all SSL clients to present a client Certificate in order to use this socket. Set this value to want if you want Tomcat to request a client Certificate, but not fail if one isn't presented.
More things about the cert that was presented to the Server in a Client-Auth session
http://www.servlets.com/archive/servlet/ReadMsg?msgId=436068&listName=servletexec-interest
Keytool and client auth
http://www.mindreef.com/support/soapscope/4.1/help/sslcerts.html
Tomcat and CRL checking
Looks like only tomcat 5.5.10??
http://jack.godau.googlepages.com/jbosscertificatesandopenssl
http://marc2.theaimsgroup.com/?l=tomcat-user&m=113338021522111&w=2
Articles
- The New Face of Phishing - Mentions SSL use (Equifax)
- Phollow the Phlopping Phish (as above)
- VeriSign issues false Microsoft digital certificates - March 22, 2001 3:43 pm PT