How to Configure AT-TLS for CCS Apache Tomcat

Products

• Common Components and Services for z/OS

Issue/Introduction

This guide provides the steps to configure AT-TLS (Application Transparent Transport Layer Security) for the CCS Apache Tomcat region.

By configuring AT-TLS, encryption is offloaded from the Tomcat application to the z/OS Communications Server, allowing Tomcat to run in a non-secure (HTTP) mode while traffic is encrypted transparently.

Environment

• Product: Common Components and Services for z/OS (CCS)
• Version: 15.0 and later

Cause

When offloading encryption to z/OS AT-TLS, the Tomcat region must be configured to listen for plain HTTP traffic on a specific port.

This requires converting the Tomcat configuration from a secure (HTTPS) setup to a non-secure (HTTP) setup.

Resolution

1. Prepare the Tomcat Configuration Convert the server.xml file to a non-secure configuration. Replace the TOMSVXML member in ®NHLQ.TOMCAT.CAW0OPTV with the server.xml.unsecure.portoverride file.
   
   
2. Update Environment Variables In the ®NHLQ.TOMCAT.CAW0OPTV(TOMENVPR) member, uncomment and set the connector port:
   IJO="$IJO -Dconnector.port=port" (Replace port with the value designated for SSL, e.g., 8443).
   
   
3. Apply AT-TLS Policy Configure the AT-TLS rule. Use the following sample policy as a template:

TTLSRule CCS_Tomcat_Rule {
    LocalPortRange <YOUR TOMCAT_PORT> eg: 8080
    JobName <YOUR TOMCAT_STC> eg: CAHVTOM*
    Direction Inbound
    TTLSGroupActionRef CCS_Grp_Act
    TTLSEnvironmentActionRef CCS_Env_Act
}

TTLSGroupAction CCS_Grp_Act {
    TTLSEnabled On
}

TTLSEnvironmentAction CCS_Env_Act {
    HandshakeRole Server
    TTLSKeyringParms {
        Keyring <YOUR KEYRING_NAME> eg: TOMCAT_RING
    }
    TTLSEnvironmentAdvancedParms {
        TLSv1.2 On
        TLSv1.3 On
        ApplicationControlled Off
    }
}

# Note highlighted values need to be replaced

Additional Information

Change the CCS Apache Tomcat Region to Non-Secure for AT-TLS Security

Configure the CCS Apache Tomcat Region