Unable to start Tomcat6 with HTTPS enabled

Question

I have the following server.xml settings for my tomcat6 server

    <!-- COMMENTED
    <Connector port="8080" maxThreads="150"
               enableLookups="false" acceptCount="100"
               scheme="http" redirectPort="8443"/> 
    -->

   <!-- COMMENTED
    <Connector port="80" maxThreads="150"
               enableLookups="false" acceptCount="100"
               scheme="http" redirectPort="443"/>
   -->

    <Connector port="443" maxHttpHeaderSize="8192"
               maxThreads="150"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               SSLEnabled="true"
               SSLCertificateFile="%SSL_CERT%"
               SSLCertificateKeyFile="%SSL_KEY%"
               SSLCipherSuite="ALL:!ADH:!kEDH:!SSLv2:!EXPORT40:!EXP:!LOW"
               compression="on"
               compressableMimeType="text/html,text/xml,text/plain,application/javascript,application/json,text/javascript"/>

Complete server.xml is here but when I try to start the application I get the following error in catalina.*.log file

    INFO: Initializing Coyote HTTP/1.1 on http-80
Apr 7, 2013 8:38:38 PM org.apache.coyote.http11.Http11AprProtocol init
SEVERE: Error initializing endpoint
java.lang.Exception: Invalid Server SSL Protocol (error:00000000:lib(0):func(0):reason(0))
        at org.apache.tomcat.jni.SSLContext.make(Native Method)
        at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:729)
        at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107)
        at org.apache.catalina.connector.Connector.initialize(Connector.java:1049)
        at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
        at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Apr 7, 2013 8:38:38 PM org.apache.catalina.core.StandardService initialize
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-443]]
LifecycleException:  Protocol handler initialization failed: java.lang.Exception: Invalid Server SSL Protocol (error:00000000:lib(0):func(0):reason(0))
        at org.apache.catalina.connector.Connector.initialize(Connector.java:1051)
        at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
        at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)

I've checked the following things already

1. I have given read permissions for everyone for .crt and .key files
2. I copied server.xml to a different working tomcat6 server and it works there, server.xml from the mentioned working tomcat5 webserver doesn't work here and it fails with the same error
3. Works well with just HTTP enabled
4. explicitly mentioning protocol in the Connector i.e. protocol="org.apache.coyote.http11.Http11AprProtocol" results in the same exception

Please help me if I am missing something. Thanks in advance

Answer 1

The configuration you specified is for Tomcat APR protocol. Tomcat APR protocol uses Open SSL. If you want to use APR then install Open SSL and APR library in your system. Otherwise use inbuilt JKS format. For that you need to import those certificate and key to JKS. Tomcat SSL Howto documentation will help you. Tomcat SSL How to APR Documentation

Answer 2

Are you using Ubuntu 12.04?

The APR version shipped by Ubuntu 12.04 libtcnatve-1 v1.0.22 seems to be broken. Installing an older version of libtcnative-1 (in this case the one from Ubuntu 10.04, v1.0.19 http://packages.ubuntu.com/en/lucid/libtcnative-1 fixed it for me.

Answer 3

Have you install APR library ? (read here) or if you don't want to install APR, just try to change the protocol into org.apache.coyote.Http11NioProtocol