Hoping for some help getting the SSL 8443 port to accept https connections. Have the following setup:
CentOS: 2.6.32-220.el6.i686 Java: 1.8.0-openjdk-220.127.116.11-3.b14.el6_8.i386 OpenSSL: 1.0.1e-48.el6_8.1 Tomcat: 8.5.4 Apr-devel: 1.5.2
- used keytool to setup a 2048 bit keystore with self-signed certificate
- generated the CSR and sent to CA
- imported the return from the CA along with root and chain
I have had no luck configuring the Connector for port 8443 with the above software.
I attempted to use the Tomcat 6/7 syntax to associate the Connector to the keystore with no luck. In the docs, it states that 8.5 will use the old syntax and build a
SSLHostconfig stanza in the background:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol" maxThreads="200" compression="on" scheme="https" secure="true" SSLEnabled="true"> keystoreFile="/opt/tomcat/.keystore" keyAlias="tomcat" keystorePass="changeit"
The password given in the Connector is the same as that defi
org.apache.coyote.http11.Http11NioProtocol need for both the keystore and the self signed certificate. Using the above I either get a hang forever on access to 8443 or the server returns keystore tampered with or bad password.
I've also tried the above but using the
protocol="org.apache.coyote.http11.Http11NioProtocol", and Nio2.
Example error message:
SEVERE: Failed to initialize end point associated with ProtocolHandler ["https-openssl-nio-8443"] java.lang.IllegalArgumentException: java.io.IOException: Keystore was tampered with, or password was incorrect
.. with the same results (hang or password error).
New syntax: I've tried all sorts of combinations of entries/attributes of the SSLHostConfig object with no joy. It either just throws Java errors at startup or hangs on access (no password errors here as I don't even think it is attempting to hit the keystore ).
Can anyone here suggest a route to get 8443 up on Tomcat 8.5 w/Java 8 on CentOS 6?
Can anyone here suggest a method to test whether the Certificate and chain are installed correctly?
Any other suggestions are welcome.