6

I configured tomcat with SSL successfully and was using a self-signed certificate. Recently an issue arose where just having the client "Accept/trust" our certificate wasn't easy. We ended up purchasing a verisigin certificate for that server.

I've added the new certificate to the certificate to the key store. I've updated tomcat's server.xml file to use the alias, for the new certificate. I've restarted both Tomcat and the Server. Everytime I connect to the server I get the old Certificate.

Enviornment:

  • Windows 2008 R2 - 64bit
  • Tomcat 6.0.29 - installed as a service
  • Java 1.6.0_23

Connector from server.xml:

<Connector port="443" maxThreads="150" 
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="keystore.keys" keyalias="webapps2013"
           keystorePass="Redacted"             
           clientAuth="false" sslProtocol="TLS" protocol="HTTP/1.1" />

I've even tried changing the key store, by moving the old certificate to a different alias and adding my new certicate at what the old alias name was.

I've tried it from multiple browsers, and workstations. (Cleared my cache too.)

So what do I need to do to get tomcat to pickup and serve my new certificate?

UPDATE:
After a suggestion in one of the comments to clear tomcats cache.
I stopped tomcat, deleted ${CATALINA_HOME}/work and restarted tomcat.
It's still serving the old certificate.

UPDATE 2:
I've looked through jakarta_service_date.log catalina.date.log manager.date.log stdout.date.log and stderr.date.log I don't see any certificate errors. Although I am Seeing an odd error about Session Serialization.

Dec 11, 2013 10:46:27 AM org.apache.catalina.session.StandardManager doUnload
SEVERE: IOException while saving persisted sessions: java.io.FileNotFoundException: 
C:\Tomcat6.0\work\Catalina\localhost\RCSLIBRRunner\SESSIONS.ser (Access is denied)
java.io.FileNotFoundException: C:\Tomcat6.0\work\Catalina\localhost\RCSLIBRRunner\SESSIONS.ser (Access is denied)

followed by a stacktrace. Other Applications threw tha similar same exception. It hasn't happened in a couple hours, I think it was a side effect from clearing tomcats cache.

Here's another Serialization error:

Dec 11, 2013 10:46:27 AM org.apache.catalina.session.StandardManager stop
SEVERE: Exception unloading sessions to persistent storage
java.io.FileNotFoundException: C:\Tomcat6.0\work\Catalina\localhost\RCSLIBRRunner\SESSIONS.ser (Access is denied)
3
  • Did you try to clear the Tomcat cache files ?
    – krisFR
    Dec 11, 2013 at 19:18
  • Which files are those?
    – Raystorm
    Dec 11, 2013 at 19:42
  • Stop Tomcat service, then delete the folder named "Catalina" in your "work" folder, and restart Tomcat service
    – krisFR
    Dec 11, 2013 at 19:54

2 Answers 2

2

We had trouble with the protocol="HTTP/1.1", with errors in our logs. Our errors were

Certificate file specified or invalid file format

Based on some "google research", we used this for protocol instead:

protocol="org.apache.coyote.http11.Http11NioProtocol"

Our Connector is as follows:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
    SSLEnabled="true"
    maxThreads="150" 
    scheme="https" 
    secure="true"
    keystoreFile="/path/to/keystore"
    keystorePass="******"
    clientAuth="false" 
    sslProtocol="TLS" />
1

turns out I had a typo in my Connector

It should be:

<Connector port="443" maxThreads="150" 
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="keystore.keys" keyAlias="webapps2013"
           keystorePass="Redacted"             
           clientAuth="false" sslProtocol="TLS" protocol="HTTP/1.1" />

Note: the first a in keyAlias is capitalized.

Turns out that if the alias isn't listed it just silently serves the first key it finds in the key store.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .