Encrypting Tomcat passwords in the server.xml file

You can add extra security to your Crowd instance by encrypting passwords used to configure the connectors in the Tomcat’s server.xml file.


This solution is an obfuscation, which doesn’t assure real security. Crowd still needs to use the plain-text passwords to connect to your database, so your configuration will contain all the information needed to decrypt the password. An attacker could act as Crowd to obtain the password. We recommend that you additionally secure the server where Crowd and its database reside.

Protocols used by Crowd

Crowd provides the following protocols that extend the Tomcat protocols with support for password encryption. You will need to choose one of those protocols in the server.xml file.

Select to view the list of protocols...

Crowd protocol

Tomcat protocol on which the Crowd protocol is based


  • KeystorePass

  • KeyPass

  • SSLPassword

  • TruststorePass

  • KeystorePass

  • KeyPass

  • SSLPassword

  • TruststorePass

  • KeystorePass

  • KeyPass

  • SSLPassword

  • TruststorePass

  • シークレット

  • シークレット

  • シークレット

Encrypt and use the passwords in the server.xml file

Complete the following steps to encrypt your passwords, and then use them in the server.xml file.

Encrypt your passwords

To encrypt your passwords:

  1. <Crowd-installation-directory>/apache-tomcat/lib に移動します。

  2. 次のコマンドを実行します。 

    java -jar crowd-tomcat-encryption-utils-<your Crowd version>.jar
  3. When prompted, enter the password you want to encrypt.


The encryption tool will generate two files: encryptedPassword and encryptionKey. Move those files to a safe location accessible by Crowd. If you’re running a multi-node Crowd configuration, the files must be in a directory accessible by all nodes, for example <Crowd-home-directory>/shared/.

Reusing the encryption key

All encrypted passwords that you’ll provide for a single connector in the server.xml file need to be encrypted using the same encryptionKey. To reuse the encryptionKey created by the encryption tool, you can run the following command:

java -jar crowd-tomcat-encryption-utils-<your crowd version>.jar <path to encryptionKey>

This command will also prompt you for a password and then encrypt this password using the same encryptionKey

Use your encrypted passwords in the server.xml file

To use the encrypted passwords in your Tomcat configuration, you need to specify the following properties for the connector:

  • protocol - use one of the protocols listed above

  • encryptionKey - specify a path to the encryptionKey file

Then, you can provide the path to the encrypted password files instead of plain-text passwords in the Tomcat configuration.

The following snippet shows an example configuration that uses the Http11NioProtocolWithPasswordEncryption protocol with the encrypted keystore and key passwords:



keystorePass=<path to keystorePass file encrypted using encryptionKey>
keyPass=<path to keyPass file encrypted using encryptionKey>
encryptionKey=<path to encryptionKey file>

Note that, as mentioned earlier, you must use the same encryptionKey to encrypt all passwords used for a specific connector, as you can specify only one encryption key. Different connectors can use different keys and protocols.

最終更新日 2023 年 9 月 29 日


Powered by Confluence and Scroll Viewport.