Why is tomcat having trouble loading a self signed SSL certificate?

I'm having trouble getting tomcat to load a self signed certificate. I followed the instructions at this site to the letter, modified my connectors in the server.xml file, added the security constraint to my tomcat.conf file. The following is an out put of my catalina.out:

Using CATALINA_BASE: /usr/share/tomcat5 Using CATALINA_HOME: /usr/share/tomcat5 Using CATALINA_TMPDIR: /usr/share/tomcat5/temp Using JRE_HOME: /usr/lib/jvm/jre Created MBeanServer with ID: -hnoxxr:gj0olj3z.0:s15425714.domainepardefaut.fr:1 17-Jan-11 2:13:25 AM org.apache.catalina.core.AprLifecycleListener lifecycleEvent INFO: The Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: /usr/lib64/gcj-4.1.2 17-Jan-11 2:13:25 AM org.apache.coyote.http11.Http11BaseProtocol init INFO: Initializing Coyote HTTP/1.1 on http-8081 17-Jan-11 2:13:26 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore java.security.KeyStoreException: JKS at java.security.KeyStore.getInstance(libgcj.so.7rh) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so) at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so) at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:26 AM org.apache.coyote.http11.Http11BaseProtocol init SEVERE: Error initializing endpoint java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so) at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so) at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load SEVERE: Catalina.start LifecycleException: Protocol handler initialization failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load INFO: Initialization processed in 744 ms 17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardService start INFO: Starting service Catalina 17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardEngine start INFO: Starting Servlet Engine: Apache Tomcat/5.5.23 17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardHost start INFO: XML validation disabled 17-Jan-11 2:13:26 AM org.apache.catalina.startup.HostConfig deployWAR INFO: Deploying web application archive myapp.war 17-Jan-11 2:13:26 AM org.apache.catalina.loader.WebappClassLoader validateJarFile INFO: validateJarFile(/usr/share/tomcat5/webapps/myapp/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax). log4j:WARN Please initialize the log4j system properly. 17-Jan-11 2:13:27 AM org.apache.catalina.startup.TldConfig lifecycleEvent SEVERE: Error processing TLD files for context path /myapp javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context /myapp at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so) at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so) at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.deployWAR(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.deployWARs(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:29 AM org.apache.catalina.loader.WebappClassLoader validateJarFile INFO: validateJarFile(/usr/share/tomcat5/webapps/ROOT/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax). log4j:WARN Please initialize the log4j system properly. 17-Jan-11 2:13:29 AM org.apache.catalina.startup.TldConfig lifecycleEvent SEVERE: Error processing TLD files for context path javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so) at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so) at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.deployDirectory(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.deployDirectories(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so) at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start INFO: Starting Coyote HTTP/1.1 on http-8081 17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init INFO: Registering Hosts 17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init INFO: Registering WebModule Contexts 17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init INFO: Registering Servlets 17-Jan-11 2:13:31 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore java.security.KeyStoreException: JKS at java.security.KeyStore.getInstance(libgcj.so.7rh) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so) at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so) at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so) at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start SEVERE: Error starting endpoint java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so) at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so) at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so) at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so) at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start SEVERE: Catalina.start: LifecycleException: service.getName(): "Catalina"; Protocol handler start failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so) at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so) at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so) at java.lang.reflect.Method.invoke(libgcj.so.7rh) at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so) at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so) 17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start INFO: Server startup in 5535 ms

I did a port scan after I start tomcat. The standard port is up along with 8005 but the SSL port doesn't exist. Am I missing a step somewhere?

--------------Solutions-------------

I guess you are using tomcat 5.5 compiled with gcj, on some linux distribution (debian or ubuntu?) with java-1.5.0-gcj. You can find some on topic help here: https://bugzilla.redhat.com/show_bug.cgi?id=238613

Check if the keystore indicated in the exception message is actually present, and that it is in JKS format. Or point the keystoreFile attribute in your server.xml to the cacerts file provided with your JVM (if my guess was right should be /usr/lib/jvm/java-1.5.0-gcj-4.3-1.5.0.0/jre/lib/security/cacerts ) and import there your self-signed certificate. Stock cacerts file has default password = changeit

However i suggest you to use the sun-jvm or a openjdk-1.6.0 that comes from your distro, in order to avoid a lot of hassle, in particular if it is one of your first ssl deploys.

Edit: Let me append here my working configuration:

<Connector port="8443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="/etc/pki/java/cacerts"
keystorePass="changeit" keystoreType="JKS"
keyAlias="tomcat"
/>

In the /etc/pki/java/cacerts keystore, i generated a keypair with:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /etc/pki/java/cacerts

Note: if you dont specify the key alias in server.xml, the first keypair found in the keystore is used.

Important note: the keystore password MUST be the same as the private key password!

You are trying to use a JKS format key store. This format was defined by Sun, and is not supported by GNU Classpath.

GNU Classpath might support a "PKCS12" key store (because it is a standard, unlike JKS). A new command in the keytool utility from a Java 6 runtime will allow you to "import" an existing JKS key store into a new PKCS #12 key store. Of course, GNU Classpath can't perform this conversion either, but if you use an OpenJDK product to do the conversion, the resulting store might work with GNU Classpath at run time.

You are running GNU CLASSPATH, not Java. Remove it and install a JDK.

If you are using the GNU jvm and keytool, you can add the following options to the Tomcat connector in server.xml in order to get it to work:

keystoreType="gkr"
algorithm="JessieX509"

The algorithm is mentioned at http://developer.classpath.org/doc/javax/net/ssl/KeyManagerFactory.html#getDefaultAlgorithm:

Category:ssl Time:2011-01-17 Views:0
Tags: ssl tomcat5.5

Related post

Copyright (C) pcaskme.com, All Rights Reserved.

processed in 1.529 (s). 13 q(s)