Why is tomcat having trouble loading a self signed SSL certificate?

Question

I'm having trouble getting tomcat to load a self signed certificate. I followed the instructions at this site to the letter, modified my connectors in the server.xml file, added the security constraint to my tomcat.conf file. The following is an out put of my catalina.out:

Using CATALINA_BASE:   /usr/share/tomcat5
Using CATALINA_HOME:   /usr/share/tomcat5
Using CATALINA_TMPDIR: /usr/share/tomcat5/temp
Using JRE_HOME:       /usr/lib/jvm/jre
Created MBeanServer with ID: -hnoxxr:gj0olj3z.0:s15425714.domainepardefaut.fr:1
17-Jan-11 2:13:25 AM org.apache.catalina.core.AprLifecycleListener lifecycleEvent
INFO: The Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: /usr/lib64/gcj-4.1.2
17-Jan-11 2:13:25 AM org.apache.coyote.http11.Http11BaseProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:26 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
   at java.security.KeyStore.getInstance(libgcj.so.7rh)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.coyote.http11.Http11BaseProtocol init
SEVERE: Error initializing endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.init(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
SEVERE: Catalina.start
LifecycleException:  Protocol handler initialization failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.catalina.connector.Connector.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.initialize(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.load(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.load(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:26 AM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 744 ms
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/5.5.23
17-Jan-11 2:13:26 AM org.apache.catalina.core.StandardHost start
INFO: XML validation disabled
17-Jan-11 2:13:26 AM org.apache.catalina.startup.HostConfig deployWAR
INFO: Deploying web application archive myapp.war
17-Jan-11 2:13:26 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/myapp/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:27 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path /myapp
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context /myapp
   at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployWAR(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployWARs(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:29 AM org.apache.catalina.loader.WebappClassLoader validateJarFile
INFO: validateJarFile(/usr/share/tomcat5/webapps/ROOT/WEB-INF/lib/servlet.jar) - jar not loaded. See Servlet Spec 2.3, section 9.7.2. Offending class: javax/servlet/Servlet.class
log4j:WARN No appenders could be found for logger (org.apache.commons.digester.Digester.sax).
log4j:WARN Please initialize the log4j system properly.
17-Jan-11 2:13:29 AM org.apache.catalina.startup.TldConfig lifecycleEvent
SEVERE: Error processing TLD files for context path 
javax.servlet.ServletException: Exception processing TLD at resource path /WEB-INF/struts-tiles.tld in context 
   at org.apache.catalina.startup.TldConfig.tldScanTld(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.execute(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.TldConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardContext.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChildInternal(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.addChild(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployDirectory(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployDirectories(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.deployApps(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.HostConfig.lifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardHost.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.ContainerBase.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardEngine.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
INFO: Starting Coyote HTTP/1.1 on http-8081
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Hosts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering WebModule Contexts
17-Jan-11 2:13:31 AM org.apache.catalina.connector.MapperListener init
INFO: Registering Servlets
17-Jan-11 2:13:31 AM org.apache.tomcat.util.net.jsse.JSSESocketFactory getStore
SEVERE: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore
java.security.KeyStoreException: JKS
   at java.security.KeyStore.getInstance(libgcj.so.7rh)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.coyote.http11.Http11BaseProtocol start
SEVERE: Error starting endpoint
java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getKeyManagers(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.tomcat.util.net.PoolTcpEndpoint.startEndpoint(tomcat-util-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11BaseProtocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.coyote.http11.Http11Protocol.start(tomcat-http-5.5.23.jar.so)
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start: 
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.io.IOException: Exception trying to load keystore /usr/share/tomcat5/webapps/.keystore: JKS
   at org.apache.catalina.connector.Connector.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardService.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.core.StandardServer.start(catalina-5.5.23.jar.so)
   at org.apache.catalina.startup.Catalina.start(catalina-5.5.23.jar.so)
   at java.lang.reflect.Method.invoke(libgcj.so.7rh)
   at org.apache.catalina.startup.Bootstrap.start(bootstrap.jar.so)
   at org.apache.catalina.startup.Bootstrap.main(bootstrap.jar.so)
17-Jan-11 2:13:31 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 5535 ms

I did a port scan after I start tomcat. The standard port is up along with 8005 but the SSL port doesn't exist. Am I missing a step somewhere?

guido · Accepted Answer · 2011-01-17T18:27:29.823

2

I guess you are using tomcat 5.5 compiled with gcj, on some linux distribution (debian or ubuntu?) with java-1.5.0-gcj. You can find some on topic help here: https://bugzilla.redhat.com/show_bug.cgi?id=238613

Check if the keystore indicated in the exception message is actually present, and that it is in JKS format. Or point the keystoreFile attribute in your server.xml to the cacerts file provided with your JVM (if my guess was right should be /usr/lib/jvm/java-1.5.0-gcj-4.3-1.5.0.0/jre/lib/security/cacerts ) and import there your self-signed certificate. Stock cacerts file has default password = changeit

However i suggest you to use the sun-jvm or a openjdk-1.6.0 that comes from your distro, in order to avoid a lot of hassle, in particular if it is one of your first ssl deploys.

Edit: Let me append here my working configuration:

<Connector port="8443" maxHttpHeaderSize="8192"
       maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
       enableLookups="false" disableUploadTimeout="true"
       acceptCount="100" scheme="https" secure="true"
       clientAuth="false" sslProtocol="TLS" 
       keystoreFile="/etc/pki/java/cacerts" 
       keystorePass="changeit" keystoreType="JKS"
       keyAlias="tomcat"
/>

In the /etc/pki/java/cacerts keystore, i generated a keypair with:

$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /etc/pki/java/cacerts

Note: if you dont specify the key alias in server.xml, the first keypair found in the keystore is used.

Important note: the keystore password MUST be the same as the private key password!

edited Jan 17 '11 at 18:27

answered Jan 17 '11 at 02:21

guido

18,864
6
70
95

Thnaks. I'm just about to go crash so I will do all this tomorrow. I am on CentOS 5.5 using openjdk version "1.6.0_17" – Dark Star1 Jan 17 '11 at 02:33
If you look at the first stack trace entry, libgcj.so indicates tomcat is on a 1.5.0 JVM (gcj was removed in openjdk 1.6.0). you could just have a JAVA_HOME problem, check the relevant tomcat configuration under /etc – guido Jan 17 '11 at 03:18
Thanks. I'll remove and re-install java and see if that helps. – Dark Star1 Jan 17 '11 at 10:51
Actually you can have more JVMs (jre/jdk) installed at the same time, it would be just a matter of telling tomcat which one to use. You can check and set which JVM is used system-wise, using the alternatives utility form the command line, this way: *alternatives --config java * – guido Jan 17 '11 at 12:31
Thanks.. I never knew about that... I'll look into this alternatives command. On inspection I found that java version being used (as a result of the "java -version" command) is 1.6.0_17, but this maybe because I ran a yum update for Java. I will get back to you once I have a result. – Dark Star1 Jan 17 '11 at 16:28
JRE_HOME defaults to JAVA_HOME when it's empty. I suggest you to only set JAVA_HOME (and to point it to a JDK not a JRE) in tomcat5.conf; note that the java command you get as default on the command line could *not* be the same used to launch tomcat. For greater detail check the source code of /usr/bin/dtomcat5 – guido Jan 17 '11 at 18:15
mmh interesting... pls check if catalina.out reports the line *Using JAVA_HOME: /usr/lib/jvm/java-1.6.0-openjdk-1.6.0.0.x86_64* (the path you configured in */etc/tomcat5/tomcat5.conf*); if not check again if the package java-1.6.0-openjdk-devel is installed on your distro, as said above JRE is not enough to run tomcat, you need a JDK – guido Jan 17 '11 at 18:37
Thanks.. I checked the catalina.out file. It is using: Using JRE_HOME: /usr/lib/jvm/jre-1.6.0-openjdk.x86_64. However the devel package wan't installed so I've yum'med it, I'll let you know in about an hour after I've yummed some food. :) – Dark Star1 Jan 17 '11 at 18:47
Thank you very very very much. It worked. I missed your comment on using the jdk instead of JRE. Once I changed that it worked. – Dark Star1 Jan 17 '11 at 19:16

score 1 · Answer 2 · answered Jan 17 '11 at 18:32

1

You are trying to use a JKS format key store. This format was defined by Sun, and is not supported by GNU Classpath.

GNU Classpath might support a "PKCS12" key store (because it is a standard, unlike JKS). A new command in the keytool utility from a Java 6 runtime will allow you to "import" an existing JKS key store into a new PKCS #12 key store. Of course, GNU Classpath can't perform this conversion either, but if you use an OpenJDK product to do the conversion, the resulting store might work with GNU Classpath at run time.

answered Jan 17 '11 at 18:32

erickson

265,237
58
395
493

THANK you so so much.... That may be my problem.. I wasn't ware that JKS was sun and unsupported by openjdk – Dark Star1 Jan 17 '11 at 18:39
1

It *is* supported by OpenJDK, because OpenJDK feeds the Oracle (formerly Sun) Java distributions. GNU Classpath is where support is likely to be absent. – erickson Jan 17 '11 at 18:52

score 0 · Answer 3 · edited Oct 21 '12 at 01:46

0

If you are using the GNU jvm and keytool, you can add the following options to the Tomcat connector in server.xml in order to get it to work:

keystoreType="gkr"
algorithm="JessieX509"

The algorithm is mentioned at http://developer.classpath.org/doc/javax/net/ssl/KeyManagerFactory.html#getDefaultAlgorithm:

edited Oct 21 '12 at 01:46

doubleDown

8,048
1
32
48

answered Jun 08 '12 at 21:38

Atv

1

score 0 · Answer 4 · answered Jan 17 '11 at 02:20

0

You are running GNU CLASSPATH, not Java. Remove it and install a JDK.

answered Jan 17 '11 at 02:20

user207421

305,947
44
307
483

I'm sorry Can you elaborate on why this is a problem? – Dark Star1 Jan 17 '11 at 02:34

Why is tomcat having trouble loading a self signed SSL certificate?

4 Answers4