You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Satish Mittal <sa...@gmail.com> on 2011/11/22 21:42:54 UTC
Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Hi All,
I have observed a regression between tomcat 5 and tomcat 7.
In my tomcat webapp, before I spawn another tomcat webapp process, I pass
on the keystore password by setting the system property
"javax.net.ssl.keyStorePassword" to keystore password, instead of writing
the keystore password in plain-text as an attribute in server.xml.
This used to work in tomcat 5. However in tomcat 7, the same
webapp/keystore throws the following error:
Nov 22, 2011 8:04:45 PM org.apache.coyote.AbstractProtocol init
SEVERE: Failed to initialize end point associated with ProtocolHandler
["http-bio-8096"]
java.io.IOException: Keystore was tampered with, or password was incorrect
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)
at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)
at java.security.KeyStore.load(KeyStore.java:1185)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:449)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:158)
at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:373)
at
org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:498)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:369)
at
org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:909)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at
org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at
org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:781)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.startup.Catalina.load(Catalina.java:573)
at org.apache.catalina.startup.Catalina.load(Catalina.java:596)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:449)
at java.lang.Thread.run(Thread.java:619)
Caused by: java.security.UnrecoverableKeyException: Password verification
failed
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769)
... 28 more
Nov 22, 2011 8:04:47 PM org.apache.catalina.core.StandardService
initInternal
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-8096]]
org.apache.catalina.LifecycleException: Failed to initialize component
[Connector[HTTP/1.1-8096]]
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)
at
org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at
org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:781)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
at org.apache.catalina.startup.Catalina.load(Catalina.java:573)
at org.apache.catalina.startup.Catalina.load(Catalina.java:596)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:449)
at java.lang.Thread.run(Thread.java:619)
Caused by: org.apache.catalina.LifecycleException: Protocol handler
initialization failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:911)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
... 14 more
Caused by: java.io.IOException: Keystore was tampered with, or password was
incorrect
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)
at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)
at java.security.KeyStore.load(KeyStore.java:1185)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:449)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:158)
at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:373)
at
org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:498)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:369)
at
org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:909)
... 15 more
Caused by: java.security.UnrecoverableKeyException: Password verification
failed
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769)
... 28 more
Due to this error, the HTTPS connector is not initializing. The keystore is
perfectly valid, since it works with tomcat 5.
Has anyone else observed this issue with tomcat 7? Any ideas/pointers how
to fix it?
Thanks in advance,
Satish Mittal
--
"The happiest of people don´t necessarily have the best of everything, they
just make the most of everything that comes along their way."
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Chuck,
On 11/22/11 4:02 PM, Caldarale, Charles R wrote:
>> From: Satish Mittal [mailto:satish.mittal@gmail.com] Subject:
>> Tomcat 7 not working with javax.net.ssl.keyStorePassword
>> property
>
>> In my tomcat webapp, before I spawn another tomcat webapp
>> process
>
> I'll bite: what does that mean? What part of the servlet spec
> covers that action?
I'll get the popcorn. I'm anxiously waiting to hear what this is all
about.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk7MHq0ACgkQ9CaO5/Lv0PA+mgCgmiWr15JmLkw4kUEeVOpR4tdF
WCsAn1TvIPCYsvnKthvmj/BacjL5bfwT
=2VH/
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Satish,
On 11/23/11 12:30 AM, Satish Mittal wrote:
> On Wed, Nov 23, 2011 at 2:32 AM, Caldarale, Charles R <
> Chuck.Caldarale@unisys.com> wrote:
>
>>> This used to work in tomcat 5.
>>
>> Interesting. Where is this documented to work?
>
> As per the tomcat documentation, Tomcat can use two different
> implementations of SSL:
>
> - the JSSE implementation provided as part of the Java runtime
> (since 1.4) - the APR implementation, which uses the OpenSSL engine
> by default.
>
> In my installation, I use JSSE implementation. The
> javax.net.ssl.keyStorePassword property is supported by JSSE.
Not in the way that you expect. When Java accesses the system
keystore, this system property will be used. When Tomcat accesses the
Tomcat-specific keystore, only the Tomcat keystore will be used and it
must be configured using Tomcat's configuration.
Honestly, I'm surprised that this worked in Tomcat 5. It's possible
that there has been a regression, but I'd like to see it working,
first. Can you provide steps-to-reproduce in both Tomcat 5 (5.what?)
and Tomcat 6/7? The procedures should be the same (other than using
different TC versions) but the outcomes should be different if this is
a regression. Start with a stock TC install (from the ZIP/tgz archive)
and tell us how to configure everything, including creating the
keystore and key(s), importing certificates, etc.
> If you go to tomcat documentation at
> http://tomcat.apache.org/tomcat-5.5-doc/config/http.html#SSL_Support,
> you would find that multiple JSSE properties (related to
> trustStore) are supported by Tomcat as a mechanism to pass the
> value instead of specifying them explicitly in server.xml. I know
> that for keyStorePassword, it is not documented. However since this
> mechanism was working in tomcat 5, I want to check whether anyone
> else has observed this change in tomcat 7.
See above. If this is a regression, it can be fixed.
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk7NHSEACgkQ9CaO5/Lv0PDqMwCgw60f34yVfKukGuUDIlbdYF7H
TDgAnjRB57yNNldaNcZlKigrH9PTW7/t
=Xdbu
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Satish Mittal <sa...@gmail.com>.
Hi,
Please see my response inline.
-Satish
On Wed, Nov 23, 2011 at 2:32 AM, Caldarale, Charles R <
Chuck.Caldarale@unisys.com> wrote:
> > From: Satish Mittal [mailto:satish.mittal@gmail.com]
> > Subject: Tomcat 7 not working with javax.net.ssl.keyStorePassword
> property
>
> > In my tomcat webapp, before I spawn another tomcat
> > webapp process
>
> I'll bite: what does that mean? What part of the servlet spec covers that
> action?
>
>
As per my product design, I have a parent process (tomcat webapp) that
needs to spawns another tomcat webapp process and configure its server.xml.
However I get the same behavior with the parent tomcat process itself,
so these details don't matter here.
> > I pass on the keystore password by setting the system property
> > "javax.net.ssl.keyStorePassword" to keystore password, instead of
> > writing the keystore password in plain-text as an attribute in
> > server.xml.
>
> What makes you think this will work?
>
>
> This used to work in tomcat 5.
>
> Interesting. Where is this documented to work?
>
As per the tomcat documentation, Tomcat can use two different
implementations of SSL:
- the JSSE implementation provided as part of the Java runtime (since
1.4)
- the APR implementation, which uses the OpenSSL engine by default.
In my installation, I use JSSE implementation. The
javax.net.ssl.keyStorePassword property is supported by JSSE.
> > However in tomcat 7, the same webapp/keystore throws the following
> > error:
> >
> > Nov 22, 2011 8:04:45 PM org.apache.coyote.AbstractProtocol init
> > SEVERE: Failed to initialize end point associated with
> > ProtocolHandler ["http-bio-8096"] java.io.IOException: Keystore was
> > tampered with, or password was incorrect
>
> You probably didn't set the password. :(
>
>
If you go to tomcat documentation at
http://tomcat.apache.org/tomcat-5.5-doc/config/http.html#SSL_Support, you
would find that multiple JSSE properties (related to trustStore) are
supported by Tomcat as a mechanism to pass the value instead of specifying
them explicitly in server.xml. I know that for keyStorePassword, it is not
documented. However since this mechanism was working in tomcat 5, I want to
check whether anyone else has observed this change in tomcat 7.
-Satish
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
> MATERIAL and is thus for use only by the intended recipient. If you
> received this in error, please contact the sender and delete the e-mail and
> its attachments from all computers.
>
>
--
"The happiest of people don´t necessarily have the best of everything, they
just make the most of everything that comes along their way."
RE: Tomcat 7 not working with javax.net.ssl.keyStorePassword
property
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Satish Mittal [mailto:satish.mittal@gmail.com]
> Subject: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
> In my tomcat webapp, before I spawn another tomcat
> webapp process
I'll bite: what does that mean? What part of the servlet spec covers that action?
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Satish Mittal <sa...@gmail.com>.
On Wed, Nov 23, 2011 at 11:14 PM, Konstantin Kolinko <knst.kolinko@gmail.com
> wrote:
> 2011/11/23 Satish Mittal <sa...@gmail.com>:
> >
> > This used to work in tomcat 5. However in tomcat 7, the same
> > webapp/keystore throws the following error:
>
> You must always mention the full version number. There are ~20
> different versions of Tomcat 7.0.x, and even more of 5.0.x/5.5.y
>
>
Sure, I should have told that earlier. I am migrating from tomcat 5.5.33 to
tomcat 7.0.22 .
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
"The happiest of people don´t necessarily have the best of everything, they
just make the most of everything that comes along their way."
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Konstantin Kolinko <kn...@gmail.com>.
2011/11/23 Satish Mittal <sa...@gmail.com>:
>
> This used to work in tomcat 5. However in tomcat 7, the same
> webapp/keystore throws the following error:
You must always mention the full version number. There are ~20
different versions of Tomcat 7.0.x, and even more of 5.0.x/5.5.y
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Satish Mittal <sa...@gmail.com>.
On Sat, Nov 26, 2011 at 2:56 AM, Konstantin Kolinko
<kn...@gmail.com>wrote:
> 2011/11/24 Mark Thomas <ma...@apache.org>:
> > On 22/11/2011 20:42, Satish Mittal wrote:
> >> Hi All,
> >>
> >> I have observed a regression between tomcat 5 and tomcat 7.
> >
> > That is https://issues.apache.org/bugzilla/show_bug.cgi?id=38774 that
> > was fixed only in the 5.5.x branch.
> >
> > I'm not a huge fan of using system properties for configuration so I
> > prefer the Tomcat 6+ approach that requires explicit configuration (even
> > though some system properties are still used as fall back).
> >
> >>
> >> In my tomcat webapp, before I spawn another tomcat webapp process, I
> pass
> >> on the keystore password by setting the system property
> >> "javax.net.ssl.keyStorePassword" to keystore password, instead of
> writing
> >> the keystore password in plain-text as an attribute in server.xml.
> >>
>
> You can always use
> keystorePass="${javax.net.ssl.keyStorePassword}"
>
> That will work in all current Tomcat versions, including 5.5 as well.
>
>
That's a good idea... I tried that out and it worked for me with tomcat
7.0.22... Thanks Konstantin!
Best regards,
> Konstantin Kolinko
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
"The happiest of people don´t necessarily have the best of everything, they
just make the most of everything that comes along their way."
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Konstantin Kolinko <kn...@gmail.com>.
2011/11/24 Mark Thomas <ma...@apache.org>:
> On 22/11/2011 20:42, Satish Mittal wrote:
>> Hi All,
>>
>> I have observed a regression between tomcat 5 and tomcat 7.
>
> That is https://issues.apache.org/bugzilla/show_bug.cgi?id=38774 that
> was fixed only in the 5.5.x branch.
>
> I'm not a huge fan of using system properties for configuration so I
> prefer the Tomcat 6+ approach that requires explicit configuration (even
> though some system properties are still used as fall back).
>
>>
>> In my tomcat webapp, before I spawn another tomcat webapp process, I pass
>> on the keystore password by setting the system property
>> "javax.net.ssl.keyStorePassword" to keystore password, instead of writing
>> the keystore password in plain-text as an attribute in server.xml.
>>
You can always use
keystorePass="${javax.net.ssl.keyStorePassword}"
That will work in all current Tomcat versions, including 5.5 as well.
Best regards,
Konstantin Kolinko
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Satish Mittal <sa...@gmail.com>.
On Thu, Nov 24, 2011 at 3:07 AM, Mark Thomas <ma...@apache.org> wrote:
> On 22/11/2011 20:42, Satish Mittal wrote:
> > Hi All,
> >
> > I have observed a regression between tomcat 5 and tomcat 7.
>
> That is https://issues.apache.org/bugzilla/show_bug.cgi?id=38774 that
> was fixed only in the 5.5.x branch.
>
> I'm not a huge fan of using system properties for configuration so I
> prefer the Tomcat 6+ approach that requires explicit configuration (even
> though some system properties are still used as fall back).
>
>
Hi Mark,
Thanks for the link. I was searching for a related post in apache but
couldn't find it.
May I request you to merge this fix to tomcat 7 branch as well? Since it
was working in tomcat .5.33, it would be a regression for my application
once it moves to latest tomcat 7 version.
Thanks,
Satish
Mark
>
>
> >
> > In my tomcat webapp, before I spawn another tomcat webapp process, I pass
> > on the keystore password by setting the system property
> > "javax.net.ssl.keyStorePassword" to keystore password, instead of writing
> > the keystore password in plain-text as an attribute in server.xml.
> >
> > This used to work in tomcat 5. However in tomcat 7, the same
> > webapp/keystore throws the following error:
> >
> > Nov 22, 2011 8:04:45 PM org.apache.coyote.AbstractProtocol init
> > SEVERE: Failed to initialize end point associated with ProtocolHandler
> > ["http-bio-8096"]
> > java.io.IOException: Keystore was tampered with, or password was
> incorrect
> > at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)
> > at
> sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)
> > at java.security.KeyStore.load(KeyStore.java:1185)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:449)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:158)
> > at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:373)
> > at
> >
> org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:498)
> > at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:369)
> > at
> >
> org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
> > at
> org.apache.catalina.connector.Connector.initInternal(Connector.java:909)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > at
> >
> org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > at
> >
> org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:781)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > at org.apache.catalina.startup.Catalina.load(Catalina.java:573)
> > at org.apache.catalina.startup.Catalina.load(Catalina.java:596)
> > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> > at
> >
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> > at
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> > at java.lang.reflect.Method.invoke(Method.java:597)
> > at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
> > at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:449)
> > at java.lang.Thread.run(Thread.java:619)
> > Caused by: java.security.UnrecoverableKeyException: Password verification
> > failed
> > at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769)
> > ... 28 more
> > Nov 22, 2011 8:04:47 PM org.apache.catalina.core.StandardService
> > initInternal
> > SEVERE: Failed to initialize connector [Connector[HTTP/1.1-8096]]
> > org.apache.catalina.LifecycleException: Failed to initialize component
> > [Connector[HTTP/1.1-8096]]
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)
> > at
> >
> org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > at
> >
> org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:781)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > at org.apache.catalina.startup.Catalina.load(Catalina.java:573)
> > at org.apache.catalina.startup.Catalina.load(Catalina.java:596)
> > at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> > at
> >
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> > at
> >
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> > at java.lang.reflect.Method.invoke(Method.java:597)
> > at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
> > at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:449)
> > at java.lang.Thread.run(Thread.java:619)
> > Caused by: org.apache.catalina.LifecycleException: Protocol handler
> > initialization failed
> > at
> org.apache.catalina.connector.Connector.initInternal(Connector.java:911)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> > ... 14 more
> > Caused by: java.io.IOException: Keystore was tampered with, or password
> was
> > incorrect
> > at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)
> > at
> sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)
> > at java.security.KeyStore.load(KeyStore.java:1185)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:449)
> > at
> >
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:158)
> > at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:373)
> > at
> >
> org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:498)
> > at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:369)
> > at
> >
> org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
> > at
> org.apache.catalina.connector.Connector.initInternal(Connector.java:909)
> > ... 15 more
> > Caused by: java.security.UnrecoverableKeyException: Password verification
> > failed
> > at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769)
> > ... 28 more
> >
> > Due to this error, the HTTPS connector is not initializing. The keystore
> is
> > perfectly valid, since it works with tomcat 5.
> >
> > Has anyone else observed this issue with tomcat 7? Any ideas/pointers how
> > to fix it?
> >
> > Thanks in advance,
> > Satish Mittal
> >
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
--
"The happiest of people don´t necessarily have the best of everything, they
just make the most of everything that comes along their way."
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Mark Thomas <ma...@apache.org>.
On 22/11/2011 20:42, Satish Mittal wrote:
> Hi All,
>
> I have observed a regression between tomcat 5 and tomcat 7.
That is https://issues.apache.org/bugzilla/show_bug.cgi?id=38774 that
was fixed only in the 5.5.x branch.
I'm not a huge fan of using system properties for configuration so I
prefer the Tomcat 6+ approach that requires explicit configuration (even
though some system properties are still used as fall back).
Mark
>
> In my tomcat webapp, before I spawn another tomcat webapp process, I pass
> on the keystore password by setting the system property
> "javax.net.ssl.keyStorePassword" to keystore password, instead of writing
> the keystore password in plain-text as an attribute in server.xml.
>
> This used to work in tomcat 5. However in tomcat 7, the same
> webapp/keystore throws the following error:
>
> Nov 22, 2011 8:04:45 PM org.apache.coyote.AbstractProtocol init
> SEVERE: Failed to initialize end point associated with ProtocolHandler
> ["http-bio-8096"]
> java.io.IOException: Keystore was tampered with, or password was incorrect
> at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)
> at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)
> at java.security.KeyStore.load(KeyStore.java:1185)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:449)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:158)
> at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:373)
> at
> org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:498)
> at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:369)
> at
> org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
> at org.apache.catalina.connector.Connector.initInternal(Connector.java:909)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> at
> org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> at
> org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:781)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:573)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:596)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> at java.lang.reflect.Method.invoke(Method.java:597)
> at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
> at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:449)
> at java.lang.Thread.run(Thread.java:619)
> Caused by: java.security.UnrecoverableKeyException: Password verification
> failed
> at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769)
> ... 28 more
> Nov 22, 2011 8:04:47 PM org.apache.catalina.core.StandardService
> initInternal
> SEVERE: Failed to initialize connector [Connector[HTTP/1.1-8096]]
> org.apache.catalina.LifecycleException: Failed to initialize component
> [Connector[HTTP/1.1-8096]]
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)
> at
> org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> at
> org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:781)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:573)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:596)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at
> sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
> at
> sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
> at java.lang.reflect.Method.invoke(Method.java:597)
> at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)
> at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:449)
> at java.lang.Thread.run(Thread.java:619)
> Caused by: org.apache.catalina.LifecycleException: Protocol handler
> initialization failed
> at org.apache.catalina.connector.Connector.initInternal(Connector.java:911)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
> ... 14 more
> Caused by: java.io.IOException: Keystore was tampered with, or password was
> incorrect
> at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:771)
> at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:38)
> at java.security.KeyStore.load(KeyStore.java:1185)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:449)
> at
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:158)
> at org.apache.tomcat.util.net.JIoEndpoint.bind(JIoEndpoint.java:373)
> at
> org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:498)
> at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:369)
> at
> org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
> at org.apache.catalina.connector.Connector.initInternal(Connector.java:909)
> ... 15 more
> Caused by: java.security.UnrecoverableKeyException: Password verification
> failed
> at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:769)
> ... 28 more
>
> Due to this error, the HTTPS connector is not initializing. The keystore is
> perfectly valid, since it works with tomcat 5.
>
> Has anyone else observed this issue with tomcat 7? Any ideas/pointers how
> to fix it?
>
> Thanks in advance,
> Satish Mittal
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat 7 not working with javax.net.ssl.keyStorePassword property
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Satish,
On 11/22/11 3:42 PM, Satish Mittal wrote:
> I pass on the keystore password by setting the system property
> "javax.net.ssl.keyStorePassword" to keystore password, instead of
> writing the keystore password in plain-text as an attribute in
> server.xml.
What makes you think this will work?
> This used to work in tomcat 5.
Interesting. Where is this documented to work?
> However in tomcat 7, the same webapp/keystore throws the following
> error:
>
> Nov 22, 2011 8:04:45 PM org.apache.coyote.AbstractProtocol init
> SEVERE: Failed to initialize end point associated with
> ProtocolHandler ["http-bio-8096"] java.io.IOException: Keystore was
> tampered with, or password was incorrect
You probably didn't set the password. :(
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iEYEARECAAYFAk7MIXkACgkQ9CaO5/Lv0PCOTACfbrLPw9otOzQVmBMiKM1JG2Z3
QGAAnjGzxKuTkwvgEsEwng7tsEXG1fuC
=ifjs
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org