Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/getOCSPInfo.template
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/getOCSPInfo.template	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/getOCSPInfo.template	(working copy)
@@ -21,7 +21,7 @@
    <title>Display CRL</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/AddCRL.html
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/AddCRL.html	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/AddCRL.html	(working copy)
@@ -20,7 +20,7 @@
 <HEAD>
 <TITLE>Add Certificate Revocation List</TITLE>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 </HEAD>
 
 <body bgcolor="#FFFFFF" link="#666699" vlink="#666699" alink="#333366">
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/CheckCert.html
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/CheckCert.html	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/CheckCert.html	(working copy)
@@ -20,7 +20,7 @@
 <HEAD>
 <TITLE>Check Certificate Status</TITLE>
 <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 </HEAD>
 
 <body bgcolor="#FFFFFF" link="#666699" vlink="#666699" alink="#333366">
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/AddCA.html
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/AddCA.html	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/AddCA.html	(working copy)
@@ -20,7 +20,7 @@
 <HEAD>
 <TITLE>Add Certificate Authority</TITLE>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 </HEAD>
 
 <body bgcolor="#FFFFFF" link="#666699" vlink="#666699" alink="#333366">
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/addCRL.template
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/addCRL.template	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/addCRL.template	(working copy)
@@ -21,7 +21,7 @@
    <title>Adding Certificate Revocation List</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/checkCert.template
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/checkCert.template	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/checkCert.template	(working copy)
@@ -21,7 +21,7 @@
    <title>Check Certificate Status</title>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/addCA.template
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/addCA.template	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/addCA.template	(working copy)
@@ -21,7 +21,7 @@
    <title>Adding Certificate Authority</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/getStats.template
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/getStats.template	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/getStats.template	(working copy)
@@ -21,7 +21,7 @@
    <title>Display CRL</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/removeCA.template
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/removeCA.template	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/removeCA.template	(working copy)
@@ -21,7 +21,7 @@
    <title>Removing Certificate Authority</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/listCAs.template
===================================================================
--- dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/listCAs.template	(revision 2154)
+++ dogtag/ocsp-ui/shared/webapps/ocsp/agent/ocsp/listCAs.template	(working copy)
@@ -21,7 +21,7 @@
    <title>List Certificate Authorities</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/kra-ui/shared/webapps/kra/agent/kra/GrantRecovery.html
===================================================================
--- dogtag/kra-ui/shared/webapps/kra/agent/kra/GrantRecovery.html	(revision 2154)
+++ dogtag/kra-ui/shared/webapps/kra/agent/kra/GrantRecovery.html	(working copy)
@@ -3,7 +3,7 @@
 <HEAD>
 <TITLE>Authorize Recovery (for Recovery Agents)</TITLE>
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 </SCRIPT>
 </HEAD>
 
Index: dogtag/kra-ui/shared/webapps/kra/agent/kra/processReq.template
===================================================================
--- dogtag/kra-ui/shared/webapps/kra/agent/kra/processReq.template	(revision 2154)
+++ dogtag/kra-ui/shared/webapps/kra/agent/kra/processReq.template	(working copy)
@@ -5,7 +5,7 @@
 </head>  
 <CMS_TEMPLATE>
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 //<!--
 
Index: dogtag/kra-ui/shared/webapps/kra/agent/kra/getStats.template
===================================================================
--- dogtag/kra-ui/shared/webapps/kra/agent/kra/getStats.template	(revision 2154)
+++ dogtag/kra-ui/shared/webapps/kra/agent/kra/getStats.template	(working copy)
@@ -4,7 +4,7 @@
    <title>Display CRL</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/tks-ui/shared/webapps/tks/agent/tks/getStats.template
===================================================================
--- dogtag/tks-ui/shared/webapps/tks/agent/tks/getStats.template	(revision 2154)
+++ dogtag/tks-ui/shared/webapps/tks/agent/tks/getStats.template	(working copy)
@@ -21,7 +21,7 @@
    <title>Display CRL</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT LANGUAGE="JavaScript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/queryCert.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/queryCert.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/queryCert.html	(working copy)
@@ -22,8 +22,8 @@
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<script LANGUAGE="JavaScript" SRC="/ee/cms-funcs.js"></script>
-<script LANGUAGE="JavaScript" SRC="/ee/helpfun.js"></script>
+<script LANGUAGE="JavaScript" SRC="../cms-funcs.js"></script>
+<script LANGUAGE="JavaScript" SRC="../helpfun.js"></script>
 </head>
 
 <body bgcolor="#FFFFFF" link="#666699" vlink="#666699" alink="#333366">
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/checkRequest.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/checkRequest.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/checkRequest.html	(working copy)
@@ -22,7 +22,7 @@
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<script LANGUAGE="JavaScript" SRC="/ee/helpfun.js"></script>
+<script LANGUAGE="JavaScript" SRC="../helpfun.js"></script>
 
 </head>
 
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/ObjSignPKCS10Enroll.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/ObjSignPKCS10Enroll.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/ObjSignPKCS10Enroll.html	(working copy)
@@ -56,7 +56,7 @@
 }
 </SCRIPT>
 
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 
 </SCRIPT>
 </head>
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/policyEnrollment/index.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/policyEnrollment/index.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/policyEnrollment/index.html	(working copy)
@@ -22,7 +22,7 @@
 <link rel="shortcut icon" href="/ca/ee/graphics/favicon.ico" />
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
 <script lang="javascript" src="/dynamicVars.js"></script>
-<script lang="javascript" src="/cms-funcs.js"></script>
+<script lang="javascript" src="../cms-funcs.js"></script>
 <script lang="javascript">
 <!--//
 function doResize() {
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/profileEnrollment/index.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/profileEnrollment/index.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/profileEnrollment/index.html	(working copy)
@@ -22,7 +22,7 @@
 <link rel="shortcut icon" href="/ca/ee/graphics/favicon.ico" />
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
 <script lang="javascript" src="/dynamicVars.js"></script>
-<script lang="javascript" src="/cms-funcs.js"></script>
+<script lang="javascript" src="../cms-funcs.js"></script>
 <script lang="javascript">
 <!--//
 function doResize() {
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/requestStatus.template
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/requestStatus.template	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/requestStatus.template	(working copy)
@@ -23,7 +23,7 @@
 </head>
 
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<script LANGUAGE="JavaScript" SRC="/ee/helpfun.js"></script>
+<script LANGUAGE="JavaScript" SRC="../helpfun.js"></script>
 
 <CMS_TEMPLATE>
 
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/NISUserEnroll.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/NISUserEnroll.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/NISUserEnroll.html	(working copy)
@@ -21,9 +21,9 @@
 <TITLE>NIS Based User Enrollment Form</TITLE>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/cms-funcs.js"> </SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js"> </SCRIPT>
-<SCRIPT LANGUAGE="JavaScript" SRC="/dynamicVars.js"> </SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../cms-funcs.js"> </SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js"> </SCRIPT>
+<SCRIPT LANGUAGE="JavaScript" SRC="/ca/ee/dynamicVars.js"> </SCRIPT>
 <SCRIPT>
 //<!--
 
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/UserRevocation.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/UserRevocation.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/UserRevocation.html	(working copy)
@@ -20,7 +20,7 @@
 <head>
 <TITLE>User Certificate Revocation Form</TITLE>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-<SCRIPT LANGUAGE="JavaScript" SRC="/ee/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 </SCRIPT>
 </head>
 <body bgcolor="#FFFFFF">
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/ManServerEnroll.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/ManServerEnroll.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/ManServerEnroll.html	(working copy)
@@ -39,7 +39,7 @@
 }
 </SCRIPT>
 
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 
 </SCRIPT>
 </head>
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/ChallengeRevoke1.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/ChallengeRevoke1.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/ChallengeRevoke1.html	(working copy)
@@ -21,9 +21,9 @@
 <TITLE>Revoke a Certificate using a challenge password</TITLE>
 <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
 <SCRIPT LANGUAGE="JavaScript"></SCRIPT>
-<script LANGUAGE="JavaScript" SRC="/ee/cms-funcs.js"></script>
+<script LANGUAGE="JavaScript" SRC="../cms-funcs.js"></script>
 
-<script LANGUAGE="JavaScript" SRC="/ee/helpfun.js"></script>
+<script LANGUAGE="JavaScript" SRC="../helpfun.js"></script>
 
 <SCRIPT LANGUAGE="JavaScript">
 function validate(form)
@@ -51,7 +51,7 @@
 }
 </SCRIPT>
 
-<SCRIPT LANGUAGE="JavaScript" SRC="/ee/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 
 </SCRIPT>
 </head>
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/OCSPResponder.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/OCSPResponder.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/OCSPResponder.html	(working copy)
@@ -39,7 +39,7 @@
 }
 </SCRIPT>
 
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 
 </SCRIPT>
 </head>
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/ManCAEnroll.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/ManCAEnroll.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/ManCAEnroll.html	(working copy)
@@ -39,7 +39,7 @@
 }
 </SCRIPT>
 
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 
 </SCRIPT>
 </head>
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/CMCEnrollment.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/CMCEnrollment.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/CMCEnrollment.html	(working copy)
@@ -46,7 +46,7 @@
 }
 </SCRIPT>
 
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 
 </SCRIPT>
 </head>
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/ProfileSelect.template
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/ProfileSelect.template	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/ProfileSelect.template	(working copy)
@@ -282,7 +282,7 @@
   var uri = 'profileSubmit';
   if (typeof(authName) != "undefined") {
     if (authIsSSLClientRequired == 'true') {
-      uri = 'https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_CLIENT_AUTH_PORT]/[PKI_SUBSYSTEM_TYPE]/eeca/[PKI_SUBSYSTEM_TYPE]/profileSubmitSSLClient';
+      uri = 'https://[PKI_MACHINE_NAME]:[PKI_EE_SECURE_CLIENT_AUTH_PORT_UI]/[PKI_SUBSYSTEM_TYPE]/eeca/[PKI_SUBSYSTEM_TYPE]/profileSubmitSSLClient';
     }
   }
   if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ca-ui/shared/webapps/ca/ee/ca/ManRAEnroll.html
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/ee/ca/ManRAEnroll.html	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/ee/ca/ManRAEnroll.html	(working copy)
@@ -39,7 +39,7 @@
 }
 </SCRIPT>
 
-<SCRIPT LANGUAGE="JavaScript" SRC="/helpfun.js">
+<SCRIPT LANGUAGE="JavaScript" SRC="../helpfun.js">
 
 </SCRIPT>
 </head>
Index: dogtag/ca-ui/shared/webapps/ca/agent/ca/getOCSPInfo.template
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/agent/ca/getOCSPInfo.template	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/agent/ca/getOCSPInfo.template	(working copy)
@@ -20,7 +20,7 @@
 <head>
    <title>Display CRL</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-<SCRIPT type="text/javascript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT type="text/javascript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT type="text/javascript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ca-ui/shared/webapps/ca/agent/ca/displayCRL.template
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/agent/ca/displayCRL.template	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/agent/ca/displayCRL.template	(working copy)
@@ -20,7 +20,7 @@
 <head>
    <title>Display CRL</title>
    <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
-<SCRIPT type="text/javascript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT type="text/javascript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT type="text/javascript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: dogtag/ca-ui/shared/webapps/ca/agent/ca/getStats.template
===================================================================
--- dogtag/ca-ui/shared/webapps/ca/agent/ca/getStats.template	(revision 2154)
+++ dogtag/ca-ui/shared/webapps/ca/agent/ca/getStats.template	(working copy)
@@ -20,7 +20,7 @@
 <head>
    <title>Display CRL</title>
    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
-<SCRIPT type="text/javascript" SRC="/helpfun.js"></SCRIPT>
+<SCRIPT type="text/javascript" SRC="../helpfun.js"></SCRIPT>
 <SCRIPT type="text/javascript">
 <!--
 if (navigator.appName == "Microsoft Internet Explorer") {
Index: base/ca/shared/webapps/ca/WEB-INF/web.xml
===================================================================
--- base/ca/shared/webapps/ca/WEB-INF/web.xml	(revision 2154)
+++ base/ca/shared/webapps/ca/WEB-INF/web.xml	(working copy)
@@ -10,7 +10,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_AGENT_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -23,7 +29,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_ADMIN_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -40,7 +52,17 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_EE_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+        <init-param>
+            <param-name>proxy_http_port</param-name>
+            <param-value>[PKI_PROXY_UNSECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -53,7 +75,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_EE_SECURE_CLIENT_AUTH_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
Index: base/ca/shared/conf/server.xml
===================================================================
--- base/ca/shared/conf/server.xml	(revision 2154)
+++ base/ca/shared/conf/server.xml	(working copy)
@@ -209,10 +209,10 @@
                clientAuth="false" sslProtocol="TLS" />
     -->
 
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-<!--
-    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
--->
+    <!-- Define an AJP 1.3 Connector on port [PKI_AJP_PORT] -->
+[PKI_OPEN_AJP_PORT_COMMENT]
+    <Connector port="[PKI_AJP_PORT]" protocol="AJP/1.3" redirectPort="[PKI_AJP_REDIRECT_PORT]" />
+[PKI_CLOSE_AJP_PORT_COMMENT]
 
 
     <!-- An Engine represents the entry point (within Catalina) that processes
Index: base/ca/shared/conf/proxy.conf
===================================================================
--- base/ca/shared/conf/proxy.conf	(revision 0)
+++ base/ca/shared/conf/proxy.conf	(revision 0)
@@ -0,0 +1,34 @@
+ProxyRequests Off
+
+# matches for ee port
+<LocationMatch "^/ca/ee/*|^/ca/renewal|^/ca/certbasedenrollment|^/ca/ocsp|^/ca/enrollment|^/ca/profileSubmit|^/ca/cgi-bin/pkiclient.exe">
+    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
+    NSSVerifyClient none
+    ProxyPassMatch ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+    ProxyPassReverse ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+</LocationMatch>
+
+# matches for admin port 
+<LocationMatch "^/ca/admin/*|^/ca/auths|^/ca/acl|^/ca/server|^/ca/caadmin|^/ca/caprofile|^/ca/jobsScheduler|^/ca/capublisher|^/ca/log|^/ca/ug">
+    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
+    NSSVerifyClient none
+    ProxyPassMatch ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+    ProxyPassReverse ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+</LocationMatch>
+
+# matches for agent port and eeca port
+<LocationMatch "^/ca/agent/*|^/ca/ca/getCertFromRequest|^/ca/ca/GetBySerial|^/ca/ca/connector|/ca/ca/displayCertFromRequest|^/ca/doRevoke|^/ca/eeca/*">
+    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
+    NSSVerifyClient require
+    ProxyPassMatch ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+    ProxyPassReverse ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+</LocationMatch>
+
+# static content
+<LocationMatch "^/graphics/*">
+    NSSOptions +StdEnvVars +ExportCertData +StrictRequire +OptRenegotiate
+    NSSVerifyClient none
+    ProxyPassMatch ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+    ProxyPassReverse ajp://[PKI_MACHINE_NAME]:[PKI_AJP_PORT]/
+</LocationMatch>
+
Index: base/ca/shared/conf/CS.cfg.in
===================================================================
--- base/ca/shared/conf/CS.cfg.in	(revision 2154)
+++ base/ca/shared/conf/CS.cfg.in	(working copy)
@@ -20,6 +20,8 @@
 preop.product.version=@VERSION@
 preop.system.name=CA
 preop.system.fullname=Certificate Authority
+proxy.securePort=[PKI_PROXY_SECURE_PORT]
+proxy.unsecurePort=[PKI_PROXY_UNSECURE_PORT]
 cs.state._000=##
 cs.state._001=## cs.state=0 (pre-operational)
 cs.state._002=## cs.state=1 (running)
Index: base/selinux/src/pki.if
===================================================================
--- base/selinux/src/pki.if	(revision 2154)
+++ base/selinux/src/pki.if	(working copy)
@@ -22,6 +22,7 @@
                 type rpm_var_lib_t;
                 type rpm_exec_t;
 		type setfiles_t;
+                type httpd_t;
 	')
 	########################################
 	#
@@ -192,6 +193,9 @@
        # allow writing to the kernel keyring
        allow $1_t self:key { write read };
 
+       #forward and reverse proxy
+       corenet_tcp_connect_pki_ca_port(httpd_t)
+       corenet_tcp_connect_dogtag_port(pki_ca_t)
 
 ')
 
Index: base/selinux/src/pki.te
===================================================================
--- base/selinux/src/pki.te	(revision 2154)
+++ base/selinux/src/pki.te	(working copy)
@@ -1,4 +1,4 @@
-policy_module(pki,1.0.24)
+policy_module(pki,1.0.25)
 
 attribute pki_ca_config;
 attribute pki_ca_executable;
Index: base/common/src/com/netscape/cms/servlet/filter/AdminRequestFilter.java
===================================================================
--- base/common/src/com/netscape/cms/servlet/filter/AdminRequestFilter.java	(revision 2154)
+++ base/common/src/com/netscape/cms/servlet/filter/AdminRequestFilter.java	(working copy)
@@ -26,6 +26,7 @@
     private static final String HTTPS_SCHEME = "https";
     private static final String HTTPS_PORT = "https_port";
     private static final String HTTPS_ROLE = "Admin";
+    private static final String PROXY_PORT = "proxy_port";
 
     private FilterConfig config;
     
@@ -51,6 +52,7 @@
 
         String request_port = null;
         String param_https_port = null;
+        String param_proxy_port = null;
         String msg = null;
         String param_active = null;
 
@@ -84,22 +86,39 @@
                 return;
             }
 
+            param_proxy_port = config.getInitParameter(PROXY_PORT);
+            boolean bad_port = false;
+
             // Compare the request and param "https" ports
             if( ! param_https_port.equals( request_port ) ) {
-                String uri = ((HttpServletRequest) request).getRequestURI(); 
-                msg = "Use HTTPS port '" + param_https_port
-                    + "' instead of '" + request_port
-                    + "' when performing " + HTTPS_ROLE + " tasks!";
-                CMS.debug( filterName + ":  " + msg );
-                CMS.debug( filterName + ": uri is " + uri);
-                if ((param_active != null) &&(param_active.equals("false"))) {
-                    CMS.debug("Filter is disabled .. continuing");
+                String uri = ((HttpServletRequest) request).getRequestURI();
+                if (param_proxy_port != null) {  
+                    if (!param_proxy_port.equals(request_port)) {
+                        msg = "Use HTTPS port '" + param_https_port
+                            + "' or proxy port '" + param_proxy_port
+                            + "' instead of '" + request_port
+                            + "' when performing " + HTTPS_ROLE + " tasks!";
+                        bad_port = true;
+                    }
                 } else {
-                    resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
-                    return;
+                    msg = "Use HTTPS port '" + param_https_port
+                        + "' instead of '" + request_port
+                        + "' when performing " + HTTPS_ROLE + " tasks!";
+                    bad_port = true;
                 }
+                if (bad_port) {
+                    CMS.debug( filterName + ":  " + msg );
+                    CMS.debug( filterName + ": uri is " + uri);
+                    if ((param_active != null) &&(param_active.equals("false"))) {
+                        CMS.debug("Filter is disabled .. continuing");
+                    } else {
+                        resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
+                        return;
+                    }
+                }
             }
         }
+
         // CMS.debug("Exiting the admin filter");
 
         chain.doFilter( request, response );
Index: base/common/src/com/netscape/cms/servlet/filter/EERequestFilter.java
===================================================================
--- base/common/src/com/netscape/cms/servlet/filter/EERequestFilter.java	(revision 2154)
+++ base/common/src/com/netscape/cms/servlet/filter/EERequestFilter.java	(working copy)
@@ -29,6 +29,8 @@
     private static final String HTTPS_SCHEME = "https";
     private static final String HTTPS_PORT = "https_port";
     private static final String HTTPS_ROLE = "EE";
+    private static final String PROXY_PORT = "proxy_port";
+    private static final String PROXY_HTTP_PORT = "proxy_http_port";
 
     private FilterConfig config;
     
@@ -55,6 +57,8 @@
         String request_port = null;
         String param_http_port = null;
         String param_https_port = null;
+        String param_proxy_port = null;
+        String param_proxy_http_port = null;
         String msg = null;
         String param_active = null;
 
@@ -100,6 +104,10 @@
                 return; 
             }
 
+            param_proxy_http_port = config.getInitParameter(PROXY_HTTP_PORT);
+            param_proxy_port = config.getInitParameter(PROXY_PORT);
+            boolean bad_port = false;
+
             // If the scheme is "http", compare
             // the request and param "http" ports;
             // otherwise, if the scheme is "https", compare
@@ -107,32 +115,61 @@
             if( scheme.equals( HTTP_SCHEME ) ) {
                 if( ! param_http_port.equals( request_port ) ) {
                     String uri = ((HttpServletRequest) request).getRequestURI();
-                    msg = "Use HTTP port '" + param_http_port
-                        + "' instead of '" + request_port
-                        + "' when performing " + HTTP_ROLE + " tasks!";
-                    CMS.debug( filterName + ":  " + msg );
-                    CMS.debug( filterName + ": uri is " + uri);
-                    if ((param_active != null) &&(param_active.equals("false"))) {
-                        CMS.debug("Filter is disabled .. continuing");
+                    if (param_proxy_http_port != null) {  
+                        if (!param_proxy_http_port.equals(request_port)) {
+                            msg = "Use HTTP port '" + param_http_port
+                                + "' or proxy port '" + param_proxy_http_port
+                                + "' instead of '" + request_port
+                                + "' when performing " + HTTP_ROLE + " tasks!";
+                            bad_port = true;
+                        }
                     } else {
-                        resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
-                        return;
+                        msg = "Use HTTP port '" + param_http_port
+                            + "' instead of '" + request_port
+                            + "' when performing " + HTTP_ROLE + " tasks!";
+                        bad_port = true;
                     }
+                    if (bad_port) {
+                        CMS.debug( filterName + ":  " + msg );
+                        CMS.debug( filterName + ": uri is " + uri);
+                        if ((param_active != null) &&(param_active.equals("false"))) {
+                            CMS.debug("Filter is disabled .. continuing");
+                        } else {
+                            resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
+                            return;
+                        }
+                    }
                 }
             } else if( scheme.equals( HTTPS_SCHEME ) ) {
                 if( ! param_https_port.equals( request_port ) ) {
-                    msg = "Use HTTPS port '" + param_https_port
-                        + "' instead of '" + request_port
-                        + "' when performing " + HTTPS_ROLE + " tasks!";
-                    CMS.debug( filterName + ":  " + msg );
-                    if ((param_active != null) &&(param_active.equals("false"))) {
-                        CMS.debug("Filter is disabled .. continuing");
+                    String uri = ((HttpServletRequest) request).getRequestURI();
+                    if (param_proxy_port != null) {  
+                        if (!param_proxy_port.equals(request_port)) {
+                            msg = "Use HTTPS port '" + param_https_port
+                                + "' or proxy port '" + param_proxy_port
+                                + "' instead of '" + request_port
+                                + "' when performing " + HTTPS_ROLE + " tasks!";
+                            bad_port = true;
+                        }
                     } else {
-                        resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
-                        return;
+                        msg = "Use HTTPS port '" + param_https_port
+                            + "' instead of '" + request_port
+                            + "' when performing " + HTTPS_ROLE + " tasks!";
+                        bad_port = true;
                     }
+                    if (bad_port) {
+                        CMS.debug( filterName + ":  " + msg );
+                        CMS.debug( filterName + ": uri is " + uri);
+                        if ((param_active != null) &&(param_active.equals("false"))) {
+                            CMS.debug("Filter is disabled .. continuing");
+                        } else {
+                            resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
+                            return;
+                        }
+                    }
                 }
             }
+
         }
         // CMS.debug("Exiting the EE filter");
 
Index: base/common/src/com/netscape/cms/servlet/filter/EEClientAuthRequestFilter.java
===================================================================
--- base/common/src/com/netscape/cms/servlet/filter/EEClientAuthRequestFilter.java	(revision 2154)
+++ base/common/src/com/netscape/cms/servlet/filter/EEClientAuthRequestFilter.java	(working copy)
@@ -26,6 +26,7 @@
     private static final String HTTPS_SCHEME = "https";
     private static final String HTTPS_PORT = "https_port";
     private static final String HTTPS_ROLE = "EE Client Auth";
+    private static final String PROXY_PORT = "proxy_port";
 
     private FilterConfig config;
     
@@ -53,6 +54,7 @@
         String param_https_port = null;
         String msg = null;
         String param_active = null;
+        String param_proxy_port = null;
 
         // CMS.debug("Entering the EECA filter");
         param_active = config.getInitParameter( "active");
@@ -84,20 +86,36 @@
                 return;
             }
 
+            param_proxy_port = config.getInitParameter(PROXY_PORT);
+            boolean bad_port = false;
+
             // Compare the request and param "https" ports
             if( ! param_https_port.equals( request_port ) ) {
                 String uri = ((HttpServletRequest) request).getRequestURI();
-                msg = "Use HTTPS port '" + param_https_port
-                    + "' instead of '" + request_port
-                    + "' when performing " + HTTPS_ROLE + " tasks!";
-                CMS.debug( filterName + ":  " + msg );
-                CMS.debug( filterName + ": uri is " + msg);
-                if ((param_active != null) &&(param_active.equals("false"))) {
-                    CMS.debug("Filter is disabled .. continuing");
+                if (param_proxy_port != null) {
+                    if (!param_proxy_port.equals(request_port)) {
+                        msg = "Use HTTPS port '" + param_https_port
+                            + "' or proxy port '" + param_proxy_port
+                            + "' instead of '" + request_port
+                            + "' when performing " + HTTPS_ROLE + " tasks!";
+                        bad_port = true;
+                    }
                 } else {
-                    resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
-                    return;
+                    msg = "Use HTTPS port '" + param_https_port
+                        + "' instead of '" + request_port
+                        + "' when performing " + HTTPS_ROLE + " tasks!";
+                    bad_port = true;
                 }
+                if (bad_port) {
+                    CMS.debug( filterName + ":  " + msg );
+                    CMS.debug( filterName + ": uri is " + uri);
+                    if ((param_active != null) &&(param_active.equals("false"))) {
+                        CMS.debug("Filter is disabled .. continuing");
+                    } else {
+                        resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
+                        return;
+                    }
+                }
             }
         }
        // CMS.debug("exiting the EECA filter");
Index: base/common/src/com/netscape/cms/servlet/filter/AgentRequestFilter.java
===================================================================
--- base/common/src/com/netscape/cms/servlet/filter/AgentRequestFilter.java	(revision 2154)
+++ base/common/src/com/netscape/cms/servlet/filter/AgentRequestFilter.java	(working copy)
@@ -26,6 +26,7 @@
     private static final String HTTPS_SCHEME = "https";
     private static final String HTTPS_PORT = "https_port";
     private static final String HTTPS_ROLE = "Agent";
+    private static final String PROXY_PORT = "proxy_port";
 
     private FilterConfig config;
     
@@ -51,6 +52,7 @@
 
         String request_port = null;
         String param_https_port = null;
+        String param_proxy_port = null;
         String msg = null;
 
         String param_active = null;
@@ -85,20 +87,36 @@
                 return;
             }
 
+            param_proxy_port = config.getInitParameter(PROXY_PORT);
+            boolean bad_port = false;
+
             // Compare the request and param "https" ports
             if( ! param_https_port.equals( request_port ) ) {
                 String uri = ((HttpServletRequest) request).getRequestURI();
-                msg = "Use HTTPS port '" + param_https_port
-                    + "' instead of '" + request_port
-                    + "' when performing " + HTTPS_ROLE + " tasks!";
-                CMS.debug( filterName + ":  " + msg );
-                CMS.debug( filterName + ": uri is " + uri);
-                if ((param_active != null) &&(param_active.equals("false"))) {
-                    CMS.debug("Filter is disabled .. continuing");
+                if (param_proxy_port != null) {
+                    if (!param_proxy_port.equals(request_port)) {
+                        msg = "Use HTTPS port '" + param_https_port
+                            + "' or proxy port '" + param_proxy_port 
+                            + "' instead of '" + request_port
+                            + "' when performing " + HTTPS_ROLE + " tasks!";
+                        bad_port = true;
+                    }
                 } else {
-                    resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
-                    return;
+                    msg = "Use HTTPS port '" + param_https_port
+                        + "' instead of '" + request_port
+                        + "' when performing " + HTTPS_ROLE + " tasks!";
+                    bad_port = true;
                 }
+                if (bad_port) {
+                    CMS.debug( filterName + ":  " + msg );
+                    CMS.debug( filterName + ": uri is " + uri);
+                    if ((param_active != null) &&(param_active.equals("false"))) {
+                        CMS.debug("Filter is disabled .. continuing");
+                    } else {
+                        resp.sendError( HttpServletResponse.SC_NOT_FOUND, msg );
+                        return;
+                    }
+                }
             }
         }
         // CMS.debug("Exiting the Agent filter");
Index: base/common/src/com/netscape/cms/servlet/csadmin/ImportCAChainPanel.java
===================================================================
--- base/common/src/com/netscape/cms/servlet/csadmin/ImportCAChainPanel.java	(revision 2154)
+++ base/common/src/com/netscape/cms/servlet/csadmin/ImportCAChainPanel.java	(working copy)
@@ -101,8 +101,8 @@
         IConfigStore cs = CMS.getConfigStore();
         try {
             context.put("machineName", cs.getString("machineName"));
-            context.put("https_port", CMS.getEESSLPort());
-            context.put("http_port", CMS.getEENonSSLPort());
+            context.put("https_port", cs.getString("pkicreate.ee_secure_port"));
+            context.put("http_port", cs.getString("pkicreate.unsecure_port"));
         } catch (EBaseException e) {}
 
 
@@ -150,8 +150,8 @@
         IConfigStore cs = CMS.getConfigStore();
         try {
             context.put("machineName", cs.getString("machineName"));
-            context.put("https_port", CMS.getEESSLPort());
-            context.put("http_port", CMS.getEENonSSLPort());
+            context.put("https_port", cs.getString("pkicreate.ee_secure_port"));
+            context.put("http_port", cs.getString("pkicreate.unsecure_port"));
             context.put("title", "Import CA's Certificate Chain");
             context.put("panel", "admin/console/config/importcachainpanel.vm");
         } catch (EBaseException e) {}
Index: base/common/src/com/netscape/cmscore/apps/CMSEngine.java
===================================================================
--- base/common/src/com/netscape/cmscore/apps/CMSEngine.java	(revision 2154)
+++ base/common/src/com/netscape/cmscore/apps/CMSEngine.java	(working copy)
@@ -323,6 +323,7 @@
             }
         }
         parseServerXML();
+        fixProxyPorts();
     }
 
     /**
@@ -543,6 +544,26 @@
            }
     }
 
+    private void fixProxyPorts() {
+        try {
+            String port = mConfig.getString("proxy.securePort", "");
+            if (!port.equals("")) {
+                info[EE_SSL][PORT] = port;
+                info[ADMIN][PORT] = port;
+                info[AGENT][PORT] = port;
+                info[EE_CLIENT_AUTH_SSL][PORT] = port;
+            }
+
+            port = mConfig.getString("proxy.unsecurePort", "");
+            if (!port.equals("")) {
+                info[EE_NON_SSL][PORT] = port;
+            }
+        } catch (Exception e) {
+            CMS.debug("CMSEngine: fixProxyPorts exception: " + e.toString());
+        }   
+    }
+
+
     public IConfigStore createFileConfigStore(String path) throws EBaseException {
         try {
           /* if the file is not there, create one */
Index: base/setup/pkicreate
===================================================================
--- base/setup/pkicreate	(revision 2154)
+++ base/setup/pkicreate	(working copy)
@@ -221,6 +221,7 @@
 my $velocity_prop_base_name       = "velocity.properties";    # CA, KRA, OCSP, TKS
 my $web_xml_base_name             = "web.xml";                # CA, KRA, OCSP, TKS
 my $profile_select_base_name      = "ProfileSelect.template"; # CA
+my $proxy_conf_base_name          = "proxy.conf";             # CA
 
 my $registry_template_base_name   = "registry_instance";      # CA, KRA, OCSP, TKS, RA, TPS
 my $pki_apache_initscript_base_name = "pki_apache_initscript"; # RA, TPS
@@ -291,6 +292,7 @@
 my $PKI_SECURE_PORT_SLOT                = "PKI_SECURE_PORT";
 my $PKI_EE_SECURE_PORT_SLOT             = "PKI_EE_SECURE_PORT";
 my $PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT = "PKI_EE_SECURE_CLIENT_AUTH_PORT";
+my $PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT = "PKI_EE_SECURE_CLIENT_AUTH_PORT_UI";
 my $PKI_AGENT_SECURE_PORT_SLOT          = "PKI_AGENT_SECURE_PORT";
 my $PKI_ADMIN_SECURE_PORT_SLOT          = "PKI_ADMIN_SECURE_PORT";
 my $PKI_SERVER_XML_CONF                 = "PKI_SERVER_XML_CONF";
@@ -322,6 +324,14 @@
 my $PKI_CLOSE_SEPARATE_PORTS_COMMENT_SERVER_SLOT       = "PKI_CLOSE_SEPARATE_PORTS_SERVER_COMMENT";
 my $PKI_OPEN_SEPARATE_PORTS_COMMENT_WEB_SLOT           = "PKI_OPEN_SEPARATE_PORTS_WEB_COMMENT";
 my $PKI_CLOSE_SEPARATE_PORTS_COMMENT_WEB_SLOT          = "PKI_CLOSE_SEPARATE_PORTS_WEB_COMMENT";
+my $PKI_OPEN_AJP_PORT_COMMENT_SLOT                     = "PKI_OPEN_AJP_PORT_COMMENT";
+my $PKI_CLOSE_AJP_PORT_COMMENT_SLOT                    = "PKI_CLOSE_AJP_PORT_COMMENT";
+my $PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT                 = "PKI_OPEN_ENABLE_PROXY_COMMENT";
+my $PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT                = "PKI_CLOSE_ENABLE_PROXY_COMMENT";
+my $PKI_AJP_REDIRECT_PORT_SLOT                         = "PKI_AJP_REDIRECT_PORT";
+my $PKI_AJP_PORT_SLOT                                  = "PKI_AJP_PORT";
+my $PROXY_SECURE_PORT_SLOT                             = "PKI_PROXY_SECURE_PORT";
+my $PROXY_UNSECURE_PORT_SLOT                           = "PKI_PROXY_UNSECURE_PORT";
 my $PKI_UNSECURE_PORT_NAME                  = "Unsecure";
 my $PKI_AGENT_SECURE_PORT_NAME              = "Agent";
 my $PKI_ADMIN_SECURE_PORT_NAME              = "Admin";
@@ -347,6 +357,11 @@
 my $SELINUX_PORT_DEFINED         = 1;
 my $SELINUX_PORT_WRONGLY_DEFINED = 2;
 
+#proxy defaults
+my $PROXY_SECURE_PORT_DEFAULT   = "443";
+my $PROXY_UNSECURE_PORT_DEFAULT = "80";
+my $AJP_PORT_DEFAULT            = "9447";
+
 ##############################################################
 # Local Data Structures
 ##############################################################
@@ -376,6 +391,10 @@
 my $ee_secure_port             = -1;
 my $ee_secure_client_auth_port = -1;
 my $admin_secure_port          = -1;
+my $proxy_secure_port          = -1;
+my $proxy_unsecure_port        = -1;
+my $ajp_port                   = -1;
+my $enable_proxy               = undef;
 my $username                   = undef;
 my $groupname                  = undef;
 my $redirected_conf_path       = undef;
@@ -526,8 +545,10 @@
 my $webinf_instance_path                         = undef;  # CA, KRA, OCSP, TKS
 my $webinf_lib_instance_path                     = undef;  # CA, KRA, OCSP, TKS
 my $webinf_subsystem_path                        = undef;  # CA, KRA, OCSP, TKS
-my $profile_select_template_subsystem_file_path  = undef; #CA
+my $profile_select_template_subsystem_file_path  = undef;  #CA
 my $profile_select_template_instance_file_path   = undef;  #CA
+my $proxy_conf_subsystem_file_path               = undef;  #CA
+my $proxy_conf_instance_file_path                = undef;  #CA
 
 # PKI init script variables
 my $pki_registry_initscript                   = undef;  # CA, KRA, OCSP, TKS, RA, TPS
@@ -668,6 +689,25 @@
           -tomcat_server_port=<tomcat_server_port> # Unique port for each
                                                    # Tomcat instance
 
+          #####################################################################
+          ###  proxy configuration                                          ###
+          ###  if -enable_proxy is set, ajp_port, proxy_secure_port, and    ###
+          ###  proxy_unsecure_port are also set.                            ###
+          #####################################################################
+
+          [-enable_proxy]                            #enable proxy configuration
+          [-ajp_port=<ajp_port>]                     #AJP port, default 9447
+
+          [-proxy_secure_port=<proxy_secure_port>]   # Proxy secure port, 
+                                                     # default 443
+
+          [-proxy_unsecure_port=<unsecure_port>]     # Proxy unsecure port,
+                                                     # default 80
+
+          #####################################################################
+          ###   END proxy configuration                                     ###
+          #####################################################################
+
           [-user=<username>]                       # User ownership
                                                    # (must ALSO specify
                                                    #  group ownership)
@@ -916,6 +956,9 @@
     my $l_ee_secure_port     = -1;
     my $l_ee_secure_client_auth_port     = -1;
     my $l_admin_secure_port  = -1;
+    my $l_proxy_secure_port  = -1;
+    my $l_proxy_unsecure_port  = -1;
+    my $l_ajp_port  = -1;
     my $show_help            = 0;
 
     my $result = GetOptions("help"                         => \$show_help,
@@ -930,6 +973,10 @@
                             "ee_secure_client_auth_port:i" => \$l_ee_secure_client_auth_port,
                             "admin_secure_port:i"          => \$l_admin_secure_port, 
                             "tomcat_server_port:i"         => \$l_tomcat_server_port,
+                            "proxy_secure_port:i"          => \$l_proxy_secure_port,
+                            "proxy_unsecure_port:i"        => \$l_proxy_unsecure_port,
+                            "ajp_port:i"                   => \$l_ajp_port,
+                            "enable_proxy"                 => \$enable_proxy,
                             "user=s"                       => \$username,
                             "group=s"                      => \$groupname,
                             "verbose+"                     => \$verbose,
@@ -1186,8 +1233,23 @@
         }
     }
 
+    if ($enable_proxy) {
+
+        $proxy_secure_port = ($l_proxy_secure_port >= 0) ? $l_proxy_secure_port : 
+            $PROXY_SECURE_PORT_DEFAULT;
+        emit("    proxy_secure_port   $proxy_secure_port\n");
+
+        $proxy_unsecure_port = ($l_proxy_unsecure_port >= 0) ? $l_proxy_unsecure_port : 
+            $PROXY_UNSECURE_PORT_DEFAULT;
+        emit("    proxy_unsecure_port   $proxy_unsecure_port\n");
+
+        $ajp_port = ($l_ajp_port >= 0) ? $l_ajp_port : $AJP_PORT_DEFAULT;  
+        emit("    ajp_port   $ajp_port\n");
+    }
+ 
     if (!AreConnectorPortsValid($secure_port,$unsecure_port,$agent_secure_port,
-         $ee_secure_port,$ee_secure_client_auth_port, $admin_secure_port))
+         $ee_secure_port,$ee_secure_client_auth_port, $admin_secure_port, 
+         $proxy_secure_port, $proxy_unsecure_port))
     {
         usage();
         emit("Invalid port numbers submitted!\n","error");
@@ -1547,6 +1609,9 @@
         $profile_select_template_instance_file_path = $webapps_subsystem_instance_path
                                                      . "/ee/". $subsystem_type 
                                                      . "/" . $profile_select_base_name;
+
+        $proxy_conf_subsystem_file_path             = $conf_subsystem_path 
+                                                     . "/" . $proxy_conf_base_name;
     }
 
     ## Initialize subdirectory paths (RA, TPS subsystems)
@@ -1901,6 +1966,8 @@
                                           . "/" . $pfile_base_name;
         $pki_cfg_instance_file_path       = $conf_instance_path
                                           . "/" . $pki_cfg_base_name;
+        $proxy_conf_instance_file_path    = $conf_instance_path
+                                          . "/" . $proxy_conf_base_name;
         $catalina_properties_instance_file_path = $conf_instance_path
                                                 . "/" . $catalina_properties_base_name;
 
@@ -1948,6 +2015,8 @@
                                           . "/" . $pfile_base_name;
         $pki_cfg_instance_file_path       = $redirected_conf_path
                                           . "/" . $pki_cfg_base_name;
+        $proxy_conf_instance_file_path    = $redirected_conf_path
+                                          . "/" . $proxy_conf_base_name;
         $catalina_properties_instance_file_path = $redirected_conf_path
                                                 . "/" . $catalina_properties_base_name;
 
@@ -2346,6 +2415,7 @@
             $slot_hash{$PKI_AGENT_SECURE_PORT_SLOT} = $agent_secure_port;
             $slot_hash{$PKI_EE_SECURE_PORT_SLOT}    = $ee_secure_port; 
             $slot_hash{$PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT}    = $ee_secure_client_auth_port; 
+            $slot_hash{$PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT} = $ee_secure_client_auth_port; 
             $slot_hash{$PKI_ADMIN_SECURE_PORT_SLOT} = $admin_secure_port;
 
             # Comment "Port Separation" appropriately
@@ -2378,7 +2448,8 @@
             $slot_hash{$PKI_SECURE_PORT_SLOT}       = $secure_port;
             $slot_hash{$PKI_AGENT_SECURE_PORT_SLOT} = $secure_port;
             $slot_hash{$PKI_EE_SECURE_PORT_SLOT}    = $secure_port; 
-            $slot_hash{$PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT}    = $secure_port; 
+            $slot_hash{$PKI_EE_SECURE_CLIENT_AUTH_PORT_SLOT}       = $secure_port; 
+            $slot_hash{$PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT}    = $secure_port; 
             $slot_hash{$PKI_ADMIN_SECURE_PORT_SLOT} = $secure_port;
 
             # Comment "Shared Ports" appropriately
@@ -2398,8 +2469,32 @@
             # Comment out the "Admin/Agent/EE" Filters
             $slot_hash{$PKI_OPEN_SEPARATE_PORTS_COMMENT_WEB_SLOT}  = $PKI_OPEN_COMMENT;
             $slot_hash{$PKI_CLOSE_SEPARATE_PORTS_COMMENT_WEB_SLOT} = $PKI_CLOSE_COMMENT;
-        } 
+        }
 
+        if ($enable_proxy) {
+            if ($use_port_separation) {
+                $slot_hash{$PKI_AJP_REDIRECT_PORT_SLOT}  = $ee_secure_port;
+            } else {
+                $slot_hash{$PKI_AJP_REDIRECT_PORT_SLOT}  = $secure_port;
+            }
+            $slot_hash{$PKI_EE_SECURE_CLIENT_AUTH_PORT_UI_SLOT} = $proxy_secure_port; 
+            $slot_hash{$PKI_AJP_PORT_SLOT}                      = $ajp_port;
+            $slot_hash{$PKI_OPEN_AJP_PORT_COMMENT_SLOT}         = "";
+            $slot_hash{$PKI_CLOSE_AJP_PORT_COMMENT_SLOT}        = "";
+            $slot_hash{$PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT}     = "";
+            $slot_hash{$PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT}    = "";
+        } else {
+            $slot_hash{$PKI_OPEN_AJP_PORT_COMMENT_SLOT}      = $PKI_OPEN_COMMENT;
+            $slot_hash{$PKI_CLOSE_AJP_PORT_COMMENT_SLOT}     = $PKI_CLOSE_COMMENT;
+            $slot_hash{$PKI_OPEN_ENABLE_PROXY_COMMENT_SLOT}  = $PKI_OPEN_COMMENT;
+            $slot_hash{$PKI_CLOSE_ENABLE_PROXY_COMMENT_SLOT} = $PKI_CLOSE_COMMENT;
+        }
+
+        $slot_hash{$PROXY_SECURE_PORT_SLOT}   = ($proxy_secure_port >=0) ? 
+            $proxy_secure_port : "";
+        $slot_hash{$PROXY_UNSECURE_PORT_SLOT} = ($proxy_unsecure_port>=0) ? 
+            $proxy_unsecure_port : "";
+
         $slot_hash{$PKI_WEBAPPS_NAME}          = $webapps_base_subsystem_dir; 
         $slot_hash{$PKI_FLAVOR_SLOT}           = $pki_flavor;
         $slot_hash{$TOMCAT_SERVER_PORT_SLOT}   = $tomcat_server_port;
@@ -2470,7 +2565,12 @@
                                            $profile_select_template_subsystem_file_path,
                                            $profile_select_template_instance_file_path,
                                            \%slot_hash);
-     }
+        # process proxy.conf file
+        return 0 if !process_file_template("proxy_conf",
+                                           $proxy_conf_subsystem_file_path,
+                                           $proxy_conf_instance_file_path,
+                                           \%slot_hash);
+    }
 
 
     ## Process templates (RA, TPS instances)
@@ -3073,6 +3173,9 @@
     if ($admin_secure_port != -1) {
         add_selinux_port($setype_p, $admin_secure_port, \$semanage_cmds);
     }
+    if ($ajp_port != -1) {
+        add_selinux_port($setype_p, $ajp_port, \$semanage_cmds);
+    }
 
     # now run the selinux commands in batch mode
     if ($semanage_cmds ne "") {
Index: base/setup/pkicommon.pm
===================================================================
--- base/setup/pkicommon.pm	(revision 2154)
+++ base/setup/pkicommon.pm	(working copy)
@@ -1214,7 +1214,8 @@
 {
     # parse parameters
     my ($secure_port, $unsecure_port, $agent_secure_port, 
-        $ee_secure_port, $admin_secure_port) = @_;
+        $ee_secure_port, $admin_secure_port, $proxy_secure_port, 
+        $proxy_unsecure_port) = @_;
 
 
     if ($secure_port == -1 && $agent_secure_port == -1)
@@ -1244,6 +1245,29 @@
         return 0;
     }
 
+    # Make sure proxy ports are not the same as any of the other ports
+    if ($proxy_secure_port >=0) {
+        if (($proxy_secure_port == $agent_secure_port) ||
+            ($proxy_secure_port == $admin_secure_port) ||
+            ($proxy_secure_port == $ee_secure_port) ||
+            ($proxy_secure_port == $secure_port) ||
+            ($proxy_secure_port == $unsecure_port) ||
+            ($proxy_secure_port == $proxy_unsecure_port)) {
+            return 0;
+        }
+    }
+
+    if ($proxy_unsecure_port >=0) {
+        if (($proxy_unsecure_port == $agent_secure_port) ||
+            ($proxy_unsecure_port == $admin_secure_port) ||
+            ($proxy_unsecure_port == $ee_secure_port) ||
+            ($proxy_unsecure_port == $secure_port) ||
+            ($proxy_unsecure_port == $unsecure_port) ||
+            ($proxy_unsecure_port == $proxy_secure_port)) {
+            return 0;
+        }
+    }
+
     return 1;
     
 }
Index: base/tks/shared/webapps/tks/WEB-INF/web.xml
===================================================================
--- base/tks/shared/webapps/tks/WEB-INF/web.xml	(revision 2154)
+++ base/tks/shared/webapps/tks/WEB-INF/web.xml	(working copy)
@@ -14,7 +14,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_AGENT_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -27,7 +33,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_ADMIN_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -44,7 +56,17 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_EE_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+        <init-param>
+            <param-name>proxy_http_port</param-name>
+            <param-value>[PKI_PROXY_UNSECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
Index: base/tks/shared/conf/server.xml
===================================================================
--- base/tks/shared/conf/server.xml	(revision 2154)
+++ base/tks/shared/conf/server.xml	(working copy)
@@ -191,10 +191,10 @@
                clientAuth="false" sslProtocol="TLS" />
     -->
 
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-<!--
-    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
--->
+    <!-- Define an AJP 1.3 Connector on port [PKI_AJP_PORT] -->
+[PKI_OPEN_AJP_PORT_COMMENT]
+    <Connector port="[PKI_AJP_PORT]" protocol="AJP/1.3" redirectPort="[PKI_AJP_REDIRECT_PORT]" />
+[PKI_CLOSE_AJP_PORT_COMMENT]
 
 
     <!-- An Engine represents the entry point (within Catalina) that processes
Index: base/tks/shared/conf/CS.cfg.in
===================================================================
--- base/tks/shared/conf/CS.cfg.in	(revision 2154)
+++ base/tks/shared/conf/CS.cfg.in	(working copy)
@@ -25,6 +25,8 @@
 preop.product.name=CS
 preop.product.version=@VERSION@
 preop.system.fullname=Token Key Service
+proxy.securePort=[PKI_PROXY_SECURE_PORT]
+proxy.unsecurePort=[PKI_PROXY_UNSECURE_PORT]
 tks.cert.list=sslserver,subsystem,audit_signing
 tks.cert.sslserver.certusage=SSLServer
 tks.cert.subsystem.certusage=SSLClient
Index: base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml
===================================================================
--- base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml	(revision 2154)
+++ base/ocsp/shared/webapps/ocsp/WEB-INF/web.xml	(working copy)
@@ -14,7 +14,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_AGENT_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -27,7 +33,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_ADMIN_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -44,7 +56,17 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_EE_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+        </init-param>
+        <init-param>
+            <param-name>proxy_http_port</param-name>
+            <param-value>[PKI_PROXY_UNSECURE_PORT]</param-value>
+        </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
Index: base/ocsp/shared/conf/server.xml
===================================================================
--- base/ocsp/shared/conf/server.xml	(revision 2154)
+++ base/ocsp/shared/conf/server.xml	(working copy)
@@ -191,10 +191,10 @@
                clientAuth="false" sslProtocol="TLS" />
     -->
 
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-<!--
-    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
--->
+    <!-- Define an AJP 1.3 Connector on port [PKI_AJP_PORT] -->
+[PKI_OPEN_AJP_PORT_COMMENT]
+    <Connector port="[PKI_AJP_PORT]" protocol="AJP/1.3" redirectPort="[PKI_AJP_REDIRECT_PORT]" />
+[PKI_CLOSE_AJP_PORT_COMMENT]
 
 
     <!-- An Engine represents the entry point (within Catalina) that processes
Index: base/ocsp/shared/conf/CS.cfg.in
===================================================================
--- base/ocsp/shared/conf/CS.cfg.in	(revision 2154)
+++ base/ocsp/shared/conf/CS.cfg.in	(working copy)
@@ -26,6 +26,8 @@
 preop.product.version=@VERSION@
 preop.system.name=OCSP
 preop.system.fullname=OCSP Responder
+proxy.securePort=[PKI_PROXY_SECURE_PORT]
+proxy.unsecurePort=[PKI_PROXY_UNSECURE_PORT]
 preop.configModules.module0.userFriendlyName=NSS Internal PKCS #11 Module
 preop.configModules.module0.commonName=NSS Internal PKCS #11 Module
 preop.configModules.module0.imagePath=../img/clearpixel.gif
Index: base/kra/shared/webapps/kra/WEB-INF/web.xml
===================================================================
--- base/kra/shared/webapps/kra/WEB-INF/web.xml	(revision 2154)
+++ base/kra/shared/webapps/kra/WEB-INF/web.xml	(working copy)
@@ -10,7 +10,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_AGENT_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+         </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -23,7 +29,13 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_ADMIN_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+         </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
@@ -40,7 +52,17 @@
             <param-name>https_port</param-name>
             <param-value>[PKI_EE_SECURE_PORT]</param-value>
         </init-param>
+[PKI_OPEN_ENABLE_PROXY_COMMENT]
         <init-param>
+            <param-name>proxy_port</param-name>
+            <param-value>[PKI_PROXY_SECURE_PORT]</param-value>
+         </init-param>
+        <init-param>
+            <param-name>proxy_http_port</param-name>
+            <param-value>[PKI_PROXY_UNSECURE_PORT]</param-value>
+         </init-param>
+[PKI_CLOSE_ENABLE_PROXY_COMMENT]
+        <init-param>
             <param-name>active</param-name>
             <param-value>true</param-value>
         </init-param>
Index: base/kra/shared/conf/server.xml
===================================================================
--- base/kra/shared/conf/server.xml	(revision 2154)
+++ base/kra/shared/conf/server.xml	(working copy)
@@ -191,10 +191,10 @@
                clientAuth="false" sslProtocol="TLS" />
     -->
 
-    <!-- Define an AJP 1.3 Connector on port 8009 -->
-<!--
-    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
--->
+    <!-- Define an AJP 1.3 Connector on port [PKI_AJP_PORT] -->
+[PKI_OPEN_AJP_PORT_COMMENT]
+    <Connector port="[PKI_AJP_PORT]" protocol="AJP/1.3" redirectPort="PKI_AJP_REDIRECT_PORT]" />
+[PKI_CLOSE_AJP_PORT_COMMENT]
 
 
     <!-- An Engine represents the entry point (within Catalina) that processes
Index: base/kra/shared/conf/CS.cfg.in
===================================================================
--- base/kra/shared/conf/CS.cfg.in	(revision 2154)
+++ base/kra/shared/conf/CS.cfg.in	(working copy)
@@ -19,6 +19,8 @@
 preop.product.version=@VERSION@
 preop.system.name=DRM
 preop.system.fullname=Data Recovery Manager
+proxy.securePort=[PKI_PROXY_SECURE_PORT]
+proxy.unsecurePort=[PKI_PROXY_UNSECURE_PORT]
 cs.state=0
 cs.type=KRA
 admin.interface.uri=kra/admin/console/config/wizard
