1

How can I enable SSL for Tomcat using a pair of crt/key file?

I tried this:

I enabled the APR connector in server.xml configuration:

<Connector port="443" maxHttpHeaderSize="8192"
                 maxThreads="150"
                 enableLookups="false" disableUploadTimeout="true"
                 acceptCount="100" scheme="https" secure="true"
                 SSLEnabled="true"
                 SSLCertificateFile="my.crt"
                 SSLCertificateKeyFile="my.key" />

I had to use APR instead of Http11NioProtocol because crt and key file are updated/renewed automatically by an external process. And seems that Http11NioProtocol can use only keystore.

Then I tried to install APR:

sudo apt-get install libapr1 libapr1-dev

I reloaded Tomcat, but APR is not found:

org.apache.catalina.LifecycleException: The configured protocol [org.apache.coyote.http11.Http11AprProtocol] requires the APR/native library which is not available

1 Answer 1

2

libapr1 is a prerequesit for using APR but it's simply not enough. You need to install package libtcnative-1.

libapr1 is normally installed as a dependency thereof. You might flag it afterwards as not manually installed. You can do this with the command apt-mark auto libapr1.

There is one additional line in the configuration (server.xml) that needs to be active: <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />. This loads the native libraries.

4
  • I tried to install libctnative-1 and I got: libtcnative-1 is already the newest version (1.1.33-1). Then I tried to restart tomcat but I got: org.apache.catalina.LifecycleException: The configured protocol [org.apache.coyote.http11.Http11AprProtocol] requires the APR/native library which is not available from tomcat log.
    – Tobia
    Oct 10, 2017 at 16:24
  • The standard config contains the line <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />. Did you leave it in place?
    – blafasel
    Oct 10, 2017 at 17:08
  • This is the problem! That listener was commented in the standard config, uncommenting it I solved.Please add it to your solution so I can accept it. Thanks
    – Tobia
    Oct 11, 2017 at 7:22
  • @Tobia I edited the answer. I obviously was wrong in the assumption that it's active by default.
    – blafasel
    Oct 11, 2017 at 8:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .