I’m having trouble getting tomcat to load a self signed certificate. I followed the instructions at this site to the letter, modified my connectors in the server.xml file, added the security constraint to my tomcat.conf file. The following is an out put of my catalina.out:
Using CATALINA_BASE: /usr/share/tomcat5
Using CATALINA_HOME: /usr/share/tomcat5
Using CATALINA_TMPDIR: /usr/share/tomcat5/temp
Using JRE_HOME: /usr/lib/jvm/jre
Created MBeanServer with ID: -hnoxxr:gj0olj3z.0:s15425714.domainepardefaut.fr:1
17-Jan-11 2:13:25 AM org.apache.catalina.core.AprLifecycleListener lifecycleEvent
INFO: The Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: /usr/lib64/gcj-4.1.2
17-Jan-11 2:13:25 AM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:26 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
at java.security.KeyStore.getInstance(libgcj.so.7rh)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.coyote.http11.Http11BaseProtocol init
SEVERE: Error initializing endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
SEVERE: Catalina.start
LifecycleException: Protocol handler initialization failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 744 ms
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/5.5.23
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardHost start
INFO: XML validation disabled
17-Jan-11 2:13:26 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive myapp.war
17-Jan-11 2:13:26 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/myapp/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:27 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path /myapp
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context /myapp
at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.deployWAR(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.deployWARs(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:29 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/ROOT/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:29 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context
at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.deployDirectory(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.deployDirectories(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
INFO: Starting Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Hosts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering WebModule Contexts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Servlets
17-Jan-11 2:13:31 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
at java.security.KeyStore.getInstance(libgcj.so.7rh)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
SEVERE: Error starting endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start:
LifecycleException: service.getName(): "Catalina"; Protocol handler start failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
at java.lang.reflect.Method.invoke(libgcj.so.7rh)
at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 5535 ms
I did a port scan after I start tomcat. The standard port is up along with 8005 but the SSL port doesn’t exist. Am I missing a step somewhere?
I guess you are using tomcat 5.5 compiled with gcj, on some linux distribution (debian or ubuntu?) with java-1.5.0-gcj. You can find some on topic help here:
https://bugzilla.redhat.com/show_bug.cgi?id=238613
Check if the keystore indicated in the exception message is actually present, and that it is in JKS format. Or point the keystoreFile attribute in your server.xml to the cacerts file provided with your JVM (if my guess was right should be /usr/lib/jvm/java-1.5.0-gcj-4.3-1.5.0.0/jre/lib/security/cacerts ) and import there your self-signed certificate.
Stock cacerts file has default password = changeit
However i suggest you to use the sun-jvm or a openjdk-1.6.0 that comes from your distro, in order to avoid a lot of hassle, in particular if it is one of your first ssl deploys.
Edit:
Let me append here my working configuration:
<Connector port="8443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="/etc/pki/java/cacerts" keystorePass="changeit" keystoreType="JKS" keyAlias="tomcat" />In the /etc/pki/java/cacerts keystore, i generated a keypair with:
Note: if you dont specify the key alias in server.xml, the first keypair found in the keystore is used.
Important note: the keystore password MUST be the same as the private key password!