0

Hoping for some help getting the SSL 8443 port to accept https connections. Have the following setup:

CentOS: 2.6.32-220.el6.i686
Java:       1.8.0-openjdk-1.8.0.91-3.b14.el6_8.i386
OpenSSL:    1.0.1e-48.el6_8.1
Tomcat: 8.5.4
Apr-devel:  1.5.2
  • used keytool to setup a 2048 bit keystore with self-signed certificate
  • generated the CSR and sent to CA
  • imported the return from the CA along with root and chain

I have had no luck configuring the Connector for port 8443 with the above software.

I attempted to use the Tomcat 6/7 syntax to associate the Connector to the keystore with no luck. In the docs, it states that 8.5 will use the old syntax and build a SSLHostconfig stanza in the background:

Old syntax:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol"
        maxThreads="200" compression="on"
        scheme="https" secure="true" SSLEnabled="true">
        keystoreFile="/opt/tomcat/.keystore" keyAlias="tomcat"
        keystorePass="changeit"

....

The password given in the Connector is the same as that defi org.apache.coyote.http11.Http11NioProtocol need for both the keystore and the self signed certificate. Using the above I either get a hang forever on access to 8443 or the server returns keystore tampered with or bad password.

I've also tried the above but using the protocol="org.apache.coyote.http11.Http11NioProtocol", and Nio2.

Example error message:

SEVERE: Failed to initialize end point associated with ProtocolHandler ["https-openssl-nio-8443"]
java.lang.IllegalArgumentException: java.io.IOException: Keystore was tampered with, or password was incorrect

.. with the same results (hang or password error).

New syntax: I've tried all sorts of combinations of entries/attributes of the SSLHostConfig object with no joy. It either just throws Java errors at startup or hangs on access (no password errors here as I don't even think it is attempting to hit the keystore ).

Can anyone here suggest a route to get 8443 up on Tomcat 8.5 w/Java 8 on CentOS 6?

Can anyone here suggest a method to test whether the Certificate and chain are installed correctly?

Any other suggestions are welcome.

  • apr uses openssl. openssl can't use a java keystore. Read the documentation once more. – raupach Jul 22 '16 at 8:46
  • Are you uising JKS keystore? the APR connector requires PEM encoded certificates, not JKS. It also requires using the APR configuration parameters. – user368507 Aug 2 '16 at 18:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.