开发者

Why is tomcat having trouble loading a self signed SSL certificate?

开发者 https://www.devze.com 2023-02-04 08:33 出处：网络
I\'m having trouble getting tomcat to load a self signed certificate. I followed the instructions at this site to the letter, modified my connectors in the server.xml file, added the security constrai
相关专题：ssltomcat5.5

I'm having trouble getting tomcat to load a self signed certificate. I followed the instructions at this site to the letter, modified my connectors in the server.xml file, added the security constraint to my tomcat.conf file. The following is an out put of my catalina.out: 

Using CATALINA_BASE:   /usr/share/tomcat5
Using CATALINA_HOME:   /usr/share/tomcat5
Using CATALINA_TMPDIR: /usr/share/tomcat5/temp
Using JRE_HOME:       /usr/lib/jvm/jre
Created MBeanServer with ID: -hnoxxr:gj0olj3z.0:s15425714.domainepardefaut.fr:1
17-Jan-11 2:13:25 AM org.apache.catalina.core.AprLifecycleListener lifecycleEvent
INFO: The Apache Tomcat Native library which allows optimal pe开发者_如何学Gorformance in production environments was not found on the java.library.path: /usr/lib64/gcj-4.1.2
17-Jan-11 2:13:25 AM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:26 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
   at java.security.KeyStore.getInstance(libgcj.so.7rh)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.coyote.http11.Http11BaseProtocol init
SEVERE: Error initializing endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
SEVERE: Catalina.start
LifecycleException:  Protocol handler initialization failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 744 ms
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/5.5.23
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardHost start
INFO: XML validation disabled
17-Jan-11 2:13:26 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive myapp.war
17-Jan-11 2:13:26 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/myapp/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:27 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path /myapp
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context /myapp
   at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployWAR(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployWARs(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:29 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/ROOT/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:29 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path 
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context 
   at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployDirectory(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployDirectories(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
INFO: Starting Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Hosts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering WebModule Contexts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Servlets
17-Jan-11 2:13:31 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
   at java.security.KeyStore.getInstance(libgcj.so.7rh)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
SEVERE: Error starting endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start: 
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 5535 ms

I did a port scan after I start tomcat. The standard port is up along with 8005 but the SSL port doesn't exist. Am I missing a step somewhere?

I guess you are using tomcat 5.5 compiled with gcj, on some linux distribution (debian or ubuntu?) with java-1.5.0-gcj. You can find some on topic help here: https://bugzilla.redhat.com/show_bug.cgi?id=238613

Check if the keystore indicated in the exception message is actually present, and that it is in JKS format. Or point the keystoreFile attribute in your server.xml to the cacerts file provided with your JVM (if my guess was right should be /usr/lib/jvm/java-1.5.0-gcj-4.3-1.5.0.0/jre/lib/security/cacerts ) and import there your self-signed certificate. Stock cacerts file has default password = changeit

However i suggest you to use the sun-jvm or a openjdk-1.6.0 that comes from your distro, in order to avoid a lot of hassle, in particular if it is one of your first ssl deploys.

Edit: Let me append here my working configuration:

<Connector port="8443" maxHttpHeaderSize="8192"
       maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
       enableLookups="false" disableUploadTimeout="true"
       acceptCount="100" scheme="https" secure="true"
       clientAuth="false" sslProtocol="TLS" 
       keystoreFile="/etc/pki/java/cacerts" 
       keystorePass="changeit" keystoreType="JKS"
       keyAlias="tomcat"
/>

In the /etc/pki/java/cacerts keystore, i generated a keypair with:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /etc/pki/java/cacerts

Note: if you dont specify the key alias in server.xml, the first keypair found in the keystore is used.

Important note: the keystore password MUST be the same as the private key password!

You are trying to use a JKS format key store. This format was defined by Sun, and is not supported by GNU Classpath.

GNU Classpath might support a "PKCS12" key store (because it is a standard, unlike JKS). A new command in the keytool utility from a Java 6 runtime will allow you to "import" an existing JKS key store into a new PKCS #12 key store. Of course, GNU Classpath can't perform this conversion either, but if you use an OpenJDK product to do the conversion, the resulting store might work with GNU Classpath at run time.

You are running GNU CLASSPATH, not Java. Remove it and install a JDK.

If you are using the GNU jvm and keytool, you can add the following options to the Tomcat connector in server.xml in order to get it to work:

keystoreType="gkr"
algorithm="JessieX509"

The algorithm is mentioned at http://developer.classpath.org/doc/javax/net/ssl/KeyManagerFactory.html#getDefaultAlgorithm:

0

上一篇:

:下一篇

更多 问答 相关资讯：

精彩评论

暂无评论...
登录 注册
Qedev.com
验证码 换一张
取 消

    关注公众号

    热门标签

    图文推荐

    Delphi - Custom drawing a message list

    Delphi - Custom drawing a message list
    C++ header-only include pattern

    C++ header-only include pattern
    IE7 Margin Collapses Into Padding

    IE7 Margin Collapses Into Padding
    in CoffeeScript, how can I use a variable as a key in a hash?

    in CoffeeScript, how can I use a variable as a key in a hash?
    Interactive visualization of a graph in python [closed]

    Interactive visualization of a graph in python [closed]
    How to customise PHP MYSQL tables?

    How to customise PHP MYSQL tables?
    High quality, simple random password generator

    High quality, simple random password generator
    Image Recognition ApI in android

    Image Recognition ApI in android

    开发者开发者网给大家分享系统运维,大数据运维,云计算,编程开发技巧,路由交换,运维和开发相关的资讯及技术文章，同时StackOverflow中文社区，知识经验交流分享。

    法律声明：本站内容均为网友上传，网站举办方负责审核和监督，如存在版权或非法内容，欢迎举报，我们将尽快予以删除。邮箱：devze@qq.com

    Copyright © 2018-2020 开发者. All rights reserved. Powered by 开发者ICP备案号: 京ICP备10032868号-9