Apache Tomcat

Configure Luna HSM

Install Java Development Kit

Set up Gem Engine Toolkit

Set up Apache Tomcat

Ensure that the HSM is set up, initialized, provisioned, and ready for deployment. For more information, refer to Luna HSM documentation.

Create a partition that will be later on used by Apache Tomcat.

Create and exchange certificate between the Luna Network HSM and client system. Register client and assign partition to create an NTLS connection.

Initialize Crypto Officer and Crypto User roles for the registered partition.

Run the following command to verify that the partition has been successfully registered and configured:

/usr/safenet/lunaclient/bin/lunacm 

Upon successful execution, you should observe an output similar to the example provided below:

lunacm (64-bit) v10.4.0-417. Copyright (c) 2021 Thales Group. All rights reserved. 
Available HSMs:
Slot Id ->                           0
Label ->                             TPA01
Serial Number ->                     1312109862206
Model ->                             LunaSA 7.7.1
Firmware Version ->                  7.7.1
Bootloader Version  ->               1.1.2
Configuration ->                     Luna User Partition With SO (PW) Key Export With Cloning Mode
Slot Description ->                  Net Token Slot
FM HW Status ->                      Non-FM
Current Slot Id:                     0

Refer to Luna HSM documentation for detailed steps on creating NTLS connection, initializing the partitions, and assigning various user roles.

For proper configuration of a PED-based Luna HSM, it is recommended to activate partition policies 22 and 23, allowing for both activation and auto-activation.

Ensure that you possess sudo privileges on the client workstation.

Add a user to the hsmusers group using the command:

sudo gpasswd --add <username> hsmusers

Replace username with the actual username you want to include in the hsmusers group.

Confirm that you hold sudo privileges on the client workstation.

Eliminate a user from the hsmusers group using the command:

sudo gpasswd --add <username> hsmusers

Replace username with the specific username you want to exclude from the hsmusers group. To observe the changes, you will need to log in again.

Any user you remove will retain access to the HSM device until the client workstation is rebooted.

Configure Java for Luna HSM

Generate key materials on Luna HSM

Configure SSL for Apache Tomcat

Log on to the Apache Tomcat server as the root user or another user with administrative privileges.

Ensure that the JAVA_HOME and PATH variables are properly configured. If not, set the JAVA_HOME and PATH variables:

export JAVA_HOME=[JDK_installation_directory]
export PATH=$JAVA_HOME/bin:$PATH

Note for Windows Users: To set the JAVA_HOME and PATH system variables on Windows, navigate to System > Advanced system settings > Environment Variables... and add/edit the respective variables.

Edit the Java security configuration file java.security, located in the directory [JDK_installation_directory]/conf/security, and add the Luna Provider to the java.security file. Here's an example of how to add the Luna Provider:

security.provider.1=SUN
security.provider.2=com.safenetinc.luna.provider.LunaProvider
security.provider.3=SunRsaSign
security.provider.4=SunEC
security.provider.5=SunJSSE
security.provider.6=SunJCE
security.provider.7=SunJGSS
security.provider.8=SunSASL
security.provider.9=XMLDSig
security.provider.10=SunPCSC
security.provider.11=JdkLDAP
security.provider.12=JdkSASL
security.provider.13=SunPKCS11

Create a keystore configuration file named lunastore and include the following entry:

tokenlabel:[partition_label]

Replace [partition_label] with the label of your Luna HSM partition.

Save the file in the [Tomcat_Installation]/conf directory.

Use the Java keytool utility to generate a key pair in the keystore. The key pair will be generated on the registered partition of the Luna HSM.

keytool -genkeypair -alias [key_label] -keyalg [key_algorithm] -keysize [key_size] -sigalg [signing_algorithm] -keypass [key_password] -keystore lunastore -storetype Luna -storepass [partition_password] -providerpath "[luna_provider_jar_file]" -providerclass com.safenetinc.luna.provider.LunaProvider -J-Djava.library.path=[luna_JSP_lib_path] -J-cp -J[luna_provider_jar_file]

Replace the placeholders with appropriate values. When prompted, enter the details to generate the key and certificate. The key pair and certificate will be generated on the Luna HSM.

Use the following command to view the generated key materials and provide the keystore password:

keytool -list -v -keystore lunastore -storetype Luna -providerpath "[luna_provider_jar_file]" -providerclass com.safenetinc.luna.provider.LunaProvider -J-Djava.library.path=[luna_JSP_lib_path] -J-cp -J[luna_provider_jar_file]

Replace the placeholders with appropriate values. Enter the keystore password when prompted.

Generate a certificate request from a key in the keystore. The system will prompt you for the keystore password.

keytool -certreq -alias [key_alias] -sigalg SHA256withRSA -file [certreq_file] -keystore lunastore -storetype Luna -providerpath "[luna_provider_jar_file]" -providerclass com.safenetinc.luna.provider.LunaProvider -J-Djava.library.path=[luna_JSP_lib_path] -J-cp -J[luna_provider_jar_file]

Enter the keystore password when prompted. The certreq_file will be generated in the current directory.

Submit the CSR file to your Certification Authority (CA). The CA will authenticate the request and return a signed certificate or a certificate chain. Save the reply and the root certificate of the CA in the current working directory.

Import the CA's Root Certificate and Signed Certificate:

• To import the CA's Root certificate, execute the following command:

sh keytool -trustcacerts -importcert -alias rootca -file root.cer -keystore lunastore -storetype Luna -providerpath "[luna_provider_jar_file]" -providerclass com.safenetinc.luna.provider.LunaProvider -J-Djava.library.path=[luna_JSP_lib_path] -J-cp -J[luna_provider_jar_file] - To import the signed certificate reply or certificate chain, execute the following command:

keytool -trustcacerts -importcert -alias lunakey -file certchain.p7b -keystore lunastore -storetype Luna -providerpath "[luna_provider_jar_file]" -providerclass com.safenetinc.luna.provider.LunaProvider -J-Djava.library.path=[luna_JSP_lib_path] -J-cp -J[luna_provider_jar_file]

Enter the keystore password when prompted. Here, root.cer and certchain.p7b are the CA Root Certificate and Signed Certificate Chain, respectively.

Edit the Java security configuration file java.security, located in the directory [JDK_installation_directory]/conf/security, and add the Luna Provider to the java.security file:

security.provider.1=SUN
security.provider.2=SunEC
security.provider.3=SunJSSE
security.provider.4=SunJCE
security.provider.5=SunJGSS
security.provider.6=SunSASL
security.provider.7=XMLDSig
security.provider.8=SunPCSC
security.provider.9=JdkLDAP
security.provider.10=JdkSASL
security.provider.11=SunPKCS11
security.provider.12=com.safenetinc.luna.provider.LunaProvider
security.provider.13=SunRsaSign

Ensure that the Luna Provider (com.safenetinc.luna.provider.LunaProvider) is added as shown.

Stop the Apache Tomcat Server: If the server is running, execute the shutdown.bat (for Windows) or shutdown.sh (for Unix) script found in the bin folder of your Tomcat installation directory.

Open the server.xml file of the Tomcat server. You can either uncomment the existing connector and update it, or add the following code snippet as a new connector configuration without modifying the existing one:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
  sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
  maxThreads="150" scheme="https" secure="true" SSLEnabled="true"
  clientAuth="false" sslProtocol="TLS"
  keystoreType="Luna" keystoreFile="conf/lunastore" keyAlias="lunakey"
  keystorePass="userpin1" />

Save the server.xml file and close the text editor. Ensure that the keystore settings match your environment specifications accurately.

Create a file named setenv.sh in the $CATALINA_HOME/bin folder with the following entries:

#!/bin/sh
export CLASSPATH=/usr/safenet/lunaclient/jsp/lib/LunaProvider.jar
export CATALINA_OPTS="-Djava.library.path=/usr/safenet/lunaclient/jsp/lib/"

Start the Tomcat server using the batch file startup.bat (for Windows) or startup.sh (for UNIX) located under the bin directory of [Tomcat_installation_directory].

Verify the SSL Configuration: If the Tomcat starts successfully, you should be able to see the default page of Tomcat on the browser using HTTPS and port 8443:

https://[hostname_or_IP_Address]:8443/

The SSL certificate will be the same as the one that you generated and stored in the Luna Keystore.

Configure Java for Luna HSM

Generate key materials on Luna HSM

Configure SSL for Apache Tomcat

Log on to the Apache Tomcat server as root or another user with administrative privileges. Ensure that the JAVA_HOME and PATH variables are set. If not, set them using the following commands:

export JAVA_HOME=[JDK_installation_directory]
export PATH=$JAVA_HOME/bin:$PATH

Note for Windows users: Set the JAVA_HOME and PATH system variables by navigating to System > Advanced system settings > Environment Variables….

Edit the Java Security Configuration file java.security located in the [JDK_installation_directory]/jre/lib/security directory. Add the Luna Provider to the java.security file as shown in the example below:

security.provider.1=sun.security.provider.Sun
security.provider.2=sun.security.rsa.SunRsaSign
security.provider.3=sun.security.ec.SunEC
security.provider.4=com.sun.net.ssl.internal.ssl.Provider
security.provider.5=com.sun.crypto.provider.SunJCE
security.provider.6=com.safenetinc.luna.provider.LunaProvider
security.provider.7=sun.security.jgss.SunProvider
security.provider.8=com.sun.security.sasl.Provider
security.provider.9=org.jcp.xml.dsig.internal.dom.XMLDSigRI
security.provider.10=sun.security.smartcardio.SunPCSC
security.provider.11=sun.security.mscapi.SunMSCAPI

Copy the LunaAPI.dll (Windows) or libLunaAPI.so (UNIX) and LunaProvider.jar files from the [Luna_installation_directory]/jsp/lib folder to the [JDK_installation_directory]/jre/lib/ext directory.

Create a keystore configuration file named lunastore and add the following entry where [partition_label] is your Luna HSM partition label:

tokenlabel:

Save the file, preferably in the <Tomcat_Installation>/conf directory.

Use the Java keytool utility to generate a key pair. The key pair will be generated on the registered partition of Luna HSM.

keytool -genkeypair -alias [key_label] -keyalg [key_algorithm] -keysize [key_size] -sigalg [signing_algorithm] -keypass [partition_password] -keystore [keystore_name] -storepass [partition_password] -storetype luna

For example:

keytool -genkeypair -alias lunakey -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -keypass userpin1 -keystore lunastore -storepass userpin1 -storetype luna

Enter the details to generate the key and certificate in the Luna HSM and keystore in the current directory.

To display the generated key materials, use the following command:

keytool -list -v -storetype luna -keystore lunastore

To generate a certificate request from a key in the keystore, use the command below. You will be prompted to enter the keystore password.

keytool -certreq -alias lunakey -sigalg SHA256withRSA -file certreq_file -storetype luna -keystore lunastore

Enter the keystore password when prompted. This command will generate a file named certreq_file in the current directory.

Submit the certreq_file (CSR file) to your CA. The CA will authenticate the request and return a signed certificate or a certificate chain. Save the reply and the root certificate of the CA in the current working directory.

Import the CA’s root certificate and signed certificate or certificate chain into the keystore:

• To import the CA root certificate, execute the following command:

keytool -trustcacerts -importcert -alias rootca -file root.cer -keystore lunastore -storetype luna

• To import the signed certificate reply or certificate chain, execute the following command:

keytool -trustcacerts -importcert -alias lunakey -file certchain.p7b -keystore lunastore -storetype luna

Here, root.cer and certchain.p7b are the CA root certificate and signed certificate chain, respectively.

Stop the Tomcat server: If the Tomcat server is currently running, stop it by executing the appropriate script found in the bin folder of your Tomcat installation directory:

• For Windows: shutdown.bat

• For UNIX: shutdown.sh

Open the server.xml file of your Tomcat server. You can either uncomment and update the existing SSL connector configuration or add the following snippet as a new connector configuration without modifying the existing one:

   <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
    sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
    maxThreads="150" scheme="https" secure="true" SSLEnabled="true"
    clientAuth="false" sslProtocol="TLS" 
    keystoreType="Luna" keystoreFile="conf/lunastore" keyAlias="lunakey" 
    keystorePass="userpin1" />

Save the changes to the server.xml file and close the text editor. Make sure the keystore settings, such as keystoreType, keystoreFile, keyAlias, and keystorePass, accurately reflect your environment's specifications.

Start the Tomcat server by running the appropriate startup script found in the bin directory of your Tomcat installation directory:

• For Windows: startup.bat

• For UNIX/Linux: startup.sh

Verify SSL Configuration: Once the Tomcat server is running successfully, open a web browser and enter the following URL: https://[hostname or IP Address]:8443/.

(a) Replace [hostname or IP Address] with the actual hostname or IP address of your server.
(b) This URL will allow you to access the default page of Tomcat using the HTTPS (secure) protocol on port 8443.
(c) The SSL certificate used for the connection will be the one you generated and stored in the Luna Keystore.

Configure Java for Luna HSM

Migrate key materials from JKS to Luna Keystore

Reconfigure SSL for Apache Tomcat

Begin by crafting a keystore configuration file named lunastore. Within this file, include the following entry, substituting <Partition Name> with the designated label of your Luna HSM partition:

tokenlabel:[partition_label]

Store this file meticulously, preferably within the [Tomcat_Installation]/conf directory.

Employ the keytool utility to orchestrate the migration of the Java keystore to the Luna keystore, incorporating the SSL certificate and key. This process relocates the certificate and key to the registered partition of the Luna HSM.

keytool -importkeystore -srckeystore [source_keystore_name] -srcstorepass [source_keystore_password] -srcalias [source_key_label] -destalias [destination_key_label] –destkeystore [destination_keystore_name] -deststorepass [partition_password] -deststoretype [luna_keystore]

Example:

keytool -importkeystore -srckeystore mykeystore.jks -srcstorepass changeit -srcalias tomcat_key -destalias tomcat_migrated_key –destkeystore lunastore –deststorepass userpin1 -deststoretype luna

Ensure prompt response to any requests for the partition password.

Validate the successful generation of key materials by executing the subsequent command:

keytool -list -v –alias tomcat_migrated_key -storetype luna -keystore lunastore

Again, supply the partition password if prompted.

Stop the Apache Tomcat Server: If the server is currently running, halt its operation. Execute the shutdown.bat (for Windows) or shutdown.sh (for Unix/Linux) script found in the bin folder of your Apache Tomcat installation directory.

Navigate to the server.xml file located within the Tomcat server configuration directory. Modify the [Connector] element as shown below:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
maxThreads="150" scheme="https" secure="true" SSLEnabled="true"
clientAuth="false" sslProtocol="TLS" 
keystoreType="Luna" keystoreFile="conf/lunastore" 
keyAlias="tomcat_migrated_key"  keystorePass="userpin1" />

Ensure that the keystoreFile, keyAlias, and keystorePass attributes are correctly configured based on your environment.

Launch the Tomcat server by executing the startup.bat (for Windows) or startup.sh (for UNIX/Linux) script located in the bin directory of your Apache Tomcat installation. Upon successful startup, you should be able to access the default Tomcat page via HTTPS on port 8443:

https://[hostname or IP Address]:8443/

The SSL certificate presented will mirror the one migrated and stored in the Luna Keystore.

Install Gem Engine and OpenSSL

Install Apache Tomcat

Install Apr and Apr-Util

Install Tomcat Native

Configure SSL in Apache Tomcat

Run Apache Tomcat with non-root user

Install required packages: Ensure that the make and gcc compiler packages are installed on your system.

Create a directory to store all the necessary files for the installation:

mkdir -p /export/home

Download the OpenSSL tarball and save it in the directory you just created. Use wget for this task:

wget https://www.openssl.org/source/openssl-1.1.1k.tar.gz

For using the HSM in Non-FIPS mode, OpenSSL version 1.1.1x is suitable. For FIPS mode HSM, use OpenSSL version 1.0.2x with the FIPS module.

Extract the Gem Engine toolkit in the /export/home directory:

tar xf 610-012987-004_SW_OPENSSL_TOOLKIT_GemEngine_v1.4_RevA.tar -C /export/home

Rename the extracted gemengine-1.4 directory to gemengine:

mv /export/home/gemengine-1.4 /export/home/gemengine

Extract the OpenSSL source files from the downloaded tarball:

tar xvfz /export/home/openssl-1.1.1k.tar.gz -C /export/home

Rename the extracted openssl-1.1.1k directory to openssl:

mv /export/home/openssl-1.1.1k /export/home/openssl

Change to the gemengine directory:

cd /export/home/gemengine/

Configure the Gem Engine with the specified options:

./gembuild config --openssl-source=/export/home/openssl --prefix=/usr/local --config-bits=64

If you are using OpenSSL version 1.0.2x, add the --compat-102 option to the above command.

Use the following command to build the OpenSSL libraries:

./gembuild openssl-build

If you are using OpenSSL version 1.0.2x, you must build and install the OpenSSL FIPS module before running this step. Refer to the gemengine/docs/README-GEMBUILD file for detailed instructions.

Install the OpenSSL libraries using this command:

./gembuild openssl-install

Update the PATH and LD_LIBRARY_PATH environment variables to include the directories where the OpenSSL binaries and libraries are installed:

export PATH=/usr/local/ssl/bin:$PATH
export LD_LIBRARY_PATH=/usr/local/ssl/lib:$LD_LIBRARY_PATH

Confirm that the OpenSSL installation was successful by verifying the installed version:

openssl version -a

Compile the Gem dynamic engine with the following command:

./gembuild engine-build

Use the following command to install the Gem dynamic engine:

./gembuild engine-install

Run the command below to verify that the GemEngine is correctly installed:

openssl engine gem -v

The expected output should be:

(gem) Gem engine support
enginearg, openSession, closeSession, login, logout, engineinit,
CONF_PATH, ENGINE_INIT, ENGINE2_INIT, engine2init, DisableCheckFinalize,
SO_PATH, GET_HA_STATE, SET_FINALIZE_PENDING, SKIP_C_INITIALIZE,
IntermediateProcesses

Open the /etc/Chrystoki.conf file and add the following GemEngine section. Replace <slot_label> with the appropriate partition label:

GemEngine = {
LibPath64 = /opt/safenet/lunaclient/lib/libCryptoki2_64.so;
LibPath = /opt/safenet/lunaclient/lib/libCryptoki2_64.so;
EnableDsaGenKeyPair = 1;
EnableRsaGenKeyPair = 1;
DisablePublicCrypto = 1;
EnableRsaSignVerify = 1;
EnableLoadPubKey = 1;
EnableLoadPrivKey = 1;
DisableCheckFinalize = 1;
IntermediateProcesses = 0;
DisableEcdsa = 1;
DisableDsa = 0;
DisableRand = 0;
DisableSessionCache = 0;
EngineInit = "[slot_label]":0:0:passfile=/tmp/passfile;
EnableLoginInit = 1;
}

Create a text file and store the partition password in it:

echo [partition_password] > /tmp/passfile

Run the following command to test the Gem engine:

openssl engine gem -t

The output should indicate that the Gem engine is available.

Download and install the supported Java version for Tomcat.

Export the JAVA_HOME environment variable:

export JAVA_HOME=/export/home/jdk1.8.0_152/

Create a group for Tomcat:

groupadd tomcat

Create a user for Tomcat and set its password:

useradd -s /bin/bash -g tomcat -m tomcat
passwd tomcat

Create a directory for the Tomcat installation:

mkdir /usr/local/tomcat9

Change to the newly created Tomcat installation directory:

cd /usr/local/tomcat9/

Download the Apache Tomcat tarball:

wget https://archive.apache.org/dist/tomcat/tomcat-9/v9.0.20/bin/apache-tomcat-9.0.20.tar.gz

Extract the downloaded tarball:

tar -xf apache-tomcat-9.0.20.tar.gz

Change the ownership of the Tomcat installation directory to the Tomcat user and group:

chown -R tomcat:tomcat /usr/local/tomcat9/

Export the CATALINA_HOME and CATALINA_BASE environment variables:

export CATALINA_HOME="/usr/local/tomcat9"
export CATALINA_BASE="/usr/local/tomcat9"

Change to the /export/home/ directory:

cd /export/home/

Download the APR tarball using wget:

wget https://apachemirror.wuchna.com/apr/apr-1.7.0.tar.bz2

Extract the tarball:

tar -xjvf apr-1.7.0.tar.bz2

Change to the apr-1.7.0 directory:

cd apr-1.7.0/

Create an empty file named libtoolT:

touch libtoolT

Configure the build environment. Use the appropriate command based on your operating system:

• On RHEL 7/8:

./configure

• On Solaris 11:

CFLAGS="-m64" ./configure

Run make to compile and make install to install APR:

make
make install

Change back to the /export/home/ directory:

cd /export/home/

Download the APR-Util tarball using wget:

wget https://apachemirror.wuchna.com/apr/apr-util-1.6.1.tar.gz

Extract the APR-Util tarball:

tar -zxvf apr-util-1.6.1.tar.gz

Configure the build environment for APR-Util. Use the appropriate command based on your operating system:

• On RHEL 7/8:

./configure --with-apr=/usr/local/apr

• On Solaris 11:

CFLAGS="-m64" ./configure --with-apr=/usr/local/apr

Run make to compile and make install to install APR-Util:

make
make install

Update the LD_LIBRARY_PATH environment variable to include the directory where APR libraries are installed:

export LD_LIBRARY_PATH=/usr/local/apr/lib:$LD_LIBRARY_PATH

Change to the /usr/local/tomcat9/bin directory:

cd /usr/local/tomcat9/bin

Download the tomcat-native-1.2.28-src tarball if it is not already present:

wget https://archive.apache.org/dist/tomcat/tomcat-connectors/native/1.2.28/source/tomcat-native-1.2.28-src.tar.gz

Extract the tarball:

tar -zxvf tomcat-native-1.2.28-src.tar.gz

Change to the tomcat-native-1.2.28-src/native/ directory:

cd tomcat-native-1.2.28-src/native/

Configure the build environment. Use the appropriate command based on your operating system:

• On RHEL 7/8:

./configure --with-apr=/usr/local/apr --with-java-home=/export/home/jdk1.8.0_152/ --with-ssl=/usr/local/ssl/

• On Solaris 11:

CFLAGS="-m64" ./configure --with-apr=/usr/local/apr --with-java-home=/export/home/jdk1.8.0_152/ --with-ssl=/usr/local/ssl/

Run make to compile and make install to install Tomcat Native:

make
make install

Create a file named setenv.sh in the /usr/local/tomcat9/bin directory and add the following line to it:

echo 'export LD_LIBRARY_PATH=/usr/local/ssl/lib:/usr/local/apr/lib:/usr/local/tomcat9/lib:$LD_LIBRARY_PATH' > /usr/local/tomcat9/bin/setenv.sh

Execute the following command to generate keys. This will also save the certificate request and key reference:

openssl req -engine gem -new -newkey rsa:2048 -nodes -sha256 -keyout server.key -out server.csr

Run the following command to verify the generated key pair. You’ll be prompted to enter the partition password:

/opt/safenet/lunaclient/bin/cmu list

Submit the CSR file (server.csr) to a CA. Once authenticated, the CA will provide a signed certificate or certificate chain. Save the CA-signed certificate as servercert.cer in the system directory.

For demonstration, create a self-signed certificate servercert.cer using a test key server.key:

openssl genrsa -engine gem -out server.key 2048
openssl req -engine gem -new -x509 -days 365 -key server.key -out servercert.cer

This integration uses self-signed certificates in a test environment only. For a production environment, we recommend using a more secure method such as a certificate authority to issue the certificate.

Copy the generated server.key and servercert.cer files to the Tomcat configuration directory:

cp server.key /usr/local/tomcat9/conf/
cp servercert.cer /usr/local/tomcat9/conf/

Open the /usr/local/tomcat9/conf/server.xml file and make the following changes:

a. Locate the AprLifecycleListener and add SSLEngine="gem":

b. Add the following configuration to enable SSL support:

<Connector
    protocol="org.apache.coyote.http11.Http11AprProtocol"
    port="8443"
    maxThreads="150"
    SSLEnabled="true">
    <SSLHostConfig>
        <Certificate
            certificateKeyFile="/usr/local/tomcat9/conf/server.key"
            certificateFile="/usr/local/tomcat9/conf/servercert.cer"
            type="RSA"/>
    </SSLHostConfig>
</Connector>

Change the ownership of the /usr/local/tomcat9/ directory to the tomcat user and group:

chown -R tomcat:tomcat /usr/local/tomcat9/

Start the Tomcat service:

/usr/local/tomcat9/bin/catalina.sh start

Open any web browser and access the Tomcat server over SSL:

https://[apache_tomcat_server_ip]:8443

If the Apache Tomcat server is running, stop it using the following command:

/usr/local/tomcat9/bin/catalina.sh stop

Log in as the tomcat user.

Set the necessary environment variables for Java and Tomcat:

export JAVA_HOME=/export/home/jdk1.8.0_152
export CATALINA_HOME="/usr/local/tomcat9"
export CATALINA_BASE="/usr/local/tomcat9"
export PATH=/export/home/jdk1.8.0_152/bin:/usr/local/ssl/bin:$PATH
export LD_LIBRARY_PATH=/usr/local/ssl/lib:/usr/local/apr/lib:/usr/local/tomcat9/lib:$LD_LIBRARY_PATH

Start the Tomcat service using the following command:

/usr/local/tomcat9/bin/catalina.sh start

Open any web browser and access the Tomcat server over SSL:

https://[apache_tomcat_server_ip]:8443

Navigate to the gemengine directory and open the gembuild file.

cd /path/to/gemengine
vi gembuild

Go to line number 339 and make the following changes:

LUNA_CFG_TGT=solaris64-sparcv9-cc
LUNA_CFG_TGT=solaris64-sparcv9-gcc

Open the configure file located in the gemengine/engine directory.

cd /path/to/gemengine/engine
vi configure

Go to line number 51 and make the following changes:

CFLAGS1="-xarch=v9 -fpic"
LDFLAGS1="-xarch=v9 -G -h $LDSO -fpic"