You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Ezsra McDonald <ez...@gmail.com> on 2021/05/19 19:42:24 UTC
Tomcat SSL stops working after an undetermined amount of time
Environment:
OS: CentOS 7
Apache: apache-tomcat-8.5.65
Java: jdk1.8.0_281
Greetings,
I recently enabled SSL on my Tomcat server HTTP connectors. Something odd
is happening. After some undetermined amount of time the connector stops
responding appropriately to requests. My browser returns the following
message:
"An error occurred during a connection to target.host.com:8080. SSL
received a malformed Alert record.
Error code: SSL_ERROR_RX_MALFORMED_ALERT
"
I do not see anything in the logs to clue me in on what is happening.
I have the following configured for the connector.
<Connector executor="tomcatThreadPool"
port="${http.port}"
protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="50" enableLookups="false" acceptCount="100"
server="Apache"
SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLSv1.2"
keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
keyAlias="tomcat"
keystorePass="**************"
connectionTimeout="20000"/>
When I restart the instance everything works fine for a while. Later, when
I try to look at the tomcat manager, SSL is no longer functioning properly.
Any assistance would be appreciated.
regards,
-- Ez
Re: [OT] Tomcat SSL stops working after an undetermined amount of
time
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Ed,
On 5/24/21 16:25, Ed Rouse wrote:
> This works for me. In server.xml:
>
> <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
> maxThreads="150" SSLEnabled="true">
> <SSLHostConfig>
> <Certificate certificateKeystoreFile="C:\Program Files\Java\openjdk_1.8.0.242\jre\lib\security\cacerts"
> type="RSA" />
> </SSLHostConfig>
> </Connector>
If you really put your server's key into C:\Program
Files\Java\openjdk_1.8.0.242\jre\lib\security\cacerts you are making a
mistake IMHO. That file is supposed to contain the JVM's trust store.
You shouldn't be modifying it at all, let alone to put a private key
into it.
-chris
> From: Ezsra McDonald <ez...@gmail.com>
> Sent: Monday, May 24, 2021 4:10 PM
> To: Tomcat Users List <us...@tomcat.apache.org>
> Subject: Re: Tomcat SSL stops working after an undetermined amount of time
>
> [External email: Use caution! Do not open attachments or click on links from unknown senders or unexpected emails.]
> Chris,
>
> Thanks for your response.
>
> These Tomcat servers are something I inherited. I do not know what this
> bouncycastle.crypto is. If it is making my setup complicated how do I get
> around it? Is it part of the org.apache.coyote.http11.Http11NioProtocol?
> What would you recommend I use instead? My end goal is to just enable
> TLS/SSL on the connectors.
>
> --Ez
>
>
> On Mon, May 24, 2021 at 1:56 PM Christopher Schultz <
> chris@christopherschultz.net<ma...@christopherschultz.net>> wrote:
>
>> Ezsra,
>>
>> On 5/24/21 10:30, Ezsra McDonald wrote:
>>> I am enabling SSL debugging this morning. I did catch this in the log for
>>> an instance that started erroring out this morning. Seems like it may be
>>> too generic to help solve my problem. Here it is:
>>>
>>> 24-May-2021 09:25:44.609 SEVERE [catalina-exec-51]
>>> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
>>> java.lang.NullPointerException
>>> at org.bouncycastle.crypto.signers.PSSSigner.generateSignature(Unknown
>>> Source)
>>> at org.bouncycastle.jce.provider.JDKPSSSigner.engineSign(Unknown Source)
>>
>> Oh. You are using BouncyCastle. I've never tried to do that. I'm not
>> sure how well BC will work with Tomcat. We don't officially support that
>> configuration, but that doesn't mean we won't try to help.
>>
>> There will be a presentation at this year's ApacheCon @Home 2021 about
>> configuring Tomcat for FIPS and it will include how to configure Tomcat
>> with BC (including FIPS). Obviously, you don't want to wait around until
>> the conference to get things working, but perhaps the presenter is
>> lurking on the list ... ?
>>
>> I don't have an email address for the presenter, so I can't give you a
>> reference. :/
>>
>> -chris
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org<ma...@tomcat.apache.org>
>> For additional commands, e-mail: users-help@tomcat.apache.org<ma...@tomcat.apache.org>
>>
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: Tomcat SSL stops working after an undetermined amount of time
Posted by "Mysore, Raghunath" <rm...@visa.com.INVALID>.
Hi Ezsra,
This is an answer to your query - " Why is Tomcat not using the TLSv1.2 protocol?"
I assume you are using Oracle JDK v8u281
You may want to review the following line in the file : ..../jre/lib/security/ java.security
jdk.tls.disabledAlgorithms=??
The following old SSL versions are listed here.
Examples : SSLv3, TLSv1, TLSv1.1 etc
This, in my opinion, will ensure Tomcat will honor TLS1.2 protocol (by eliminating others )
Also are you observing that Safari browser is giving good response, while Chrome is causing the SSL issue ?
Hope this helps,
-Raghu
-----Original Message-----
From: Ed Rouse <er...@milner.com>
Sent: Monday, May 24, 2021 2:26 PM
To: Tomcat Users List <us...@tomcat.apache.org>
Subject: RE: Tomcat SSL stops working after an undetermined amount of time
This works for me. In server.xml:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="C:\Program Files\Java\openjdk_1.8.0.242\jre\lib\security\cacerts"
type="RSA" />
</SSLHostConfig>
</Connector>
From: Ezsra McDonald <ez...@gmail.com>
Sent: Monday, May 24, 2021 4:10 PM
To: Tomcat Users List <us...@tomcat.apache.org>
Subject: Re: Tomcat SSL stops working after an undetermined amount of time
[External email: Use caution! Do not open attachments or click on links from unknown senders or unexpected emails.] Chris,
Thanks for your response.
These Tomcat servers are something I inherited. I do not know what this bouncycastle.crypto is. If it is making my setup complicated how do I get around it? Is it part of the org.apache.coyote.http11.Http11NioProtocol?
What would you recommend I use instead? My end goal is to just enable TLS/SSL on the connectors.
--Ez
On Mon, May 24, 2021 at 1:56 PM Christopher Schultz < chris@christopherschultz.net<ma...@christopherschultz.net>> wrote:
> Ezsra,
>
> On 5/24/21 10:30, Ezsra McDonald wrote:
> > I am enabling SSL debugging this morning. I did catch this in the
> > log for an instance that started erroring out this morning. Seems
> > like it may be too generic to help solve my problem. Here it is:
> >
> > 24-May-2021 09:25:44.609 SEVERE [catalina-exec-51]
> > org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
> > java.lang.NullPointerException
> > at
> > org.bouncycastle.crypto.signers.PSSSigner.generateSignature(Unknown
> > Source)
> > at org.bouncycastle.jce.provider.JDKPSSSigner.engineSign(Unknown
> > Source)
>
> Oh. You are using BouncyCastle. I've never tried to do that. I'm not
> sure how well BC will work with Tomcat. We don't officially support
> that configuration, but that doesn't mean we won't try to help.
>
> There will be a presentation at this year's ApacheCon @Home 2021 about
> configuring Tomcat for FIPS and it will include how to configure
> Tomcat with BC (including FIPS). Obviously, you don't want to wait
> around until the conference to get things working, but perhaps the
> presenter is lurking on the list ... ?
>
> I don't have an email address for the presenter, so I can't give you a
> reference. :/
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:
> users-unsubscribe@tomcat.apache.org<mailto:users-unsubscribe@tomcat.ap
> ache.org> For additional commands, e-mail:
> users-help@tomcat.apache.org<ma...@tomcat.apache.org>
>
>
RE: Tomcat SSL stops working after an undetermined amount of time
Posted by Ed Rouse <er...@milner.com>.
This works for me. In server.xml:
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig>
<Certificate certificateKeystoreFile="C:\Program Files\Java\openjdk_1.8.0.242\jre\lib\security\cacerts"
type="RSA" />
</SSLHostConfig>
</Connector>
From: Ezsra McDonald <ez...@gmail.com>
Sent: Monday, May 24, 2021 4:10 PM
To: Tomcat Users List <us...@tomcat.apache.org>
Subject: Re: Tomcat SSL stops working after an undetermined amount of time
[External email: Use caution! Do not open attachments or click on links from unknown senders or unexpected emails.]
Chris,
Thanks for your response.
These Tomcat servers are something I inherited. I do not know what this
bouncycastle.crypto is. If it is making my setup complicated how do I get
around it? Is it part of the org.apache.coyote.http11.Http11NioProtocol?
What would you recommend I use instead? My end goal is to just enable
TLS/SSL on the connectors.
--Ez
On Mon, May 24, 2021 at 1:56 PM Christopher Schultz <
chris@christopherschultz.net<ma...@christopherschultz.net>> wrote:
> Ezsra,
>
> On 5/24/21 10:30, Ezsra McDonald wrote:
> > I am enabling SSL debugging this morning. I did catch this in the log for
> > an instance that started erroring out this morning. Seems like it may be
> > too generic to help solve my problem. Here it is:
> >
> > 24-May-2021 09:25:44.609 SEVERE [catalina-exec-51]
> > org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
> > java.lang.NullPointerException
> > at org.bouncycastle.crypto.signers.PSSSigner.generateSignature(Unknown
> > Source)
> > at org.bouncycastle.jce.provider.JDKPSSSigner.engineSign(Unknown Source)
>
> Oh. You are using BouncyCastle. I've never tried to do that. I'm not
> sure how well BC will work with Tomcat. We don't officially support that
> configuration, but that doesn't mean we won't try to help.
>
> There will be a presentation at this year's ApacheCon @Home 2021 about
> configuring Tomcat for FIPS and it will include how to configure Tomcat
> with BC (including FIPS). Obviously, you don't want to wait around until
> the conference to get things working, but perhaps the presenter is
> lurking on the list ... ?
>
> I don't have an email address for the presenter, so I can't give you a
> reference. :/
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org<ma...@tomcat.apache.org>
> For additional commands, e-mail: users-help@tomcat.apache.org<ma...@tomcat.apache.org>
>
>
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Ezsra McDonald <ez...@gmail.com>.
Chris,
Thanks for your response.
These Tomcat servers are something I inherited. I do not know what this
bouncycastle.crypto is. If it is making my setup complicated how do I get
around it? Is it part of the org.apache.coyote.http11.Http11NioProtocol?
What would you recommend I use instead? My end goal is to just enable
TLS/SSL on the connectors.
--Ez
On Mon, May 24, 2021 at 1:56 PM Christopher Schultz <
chris@christopherschultz.net> wrote:
> Ezsra,
>
> On 5/24/21 10:30, Ezsra McDonald wrote:
> > I am enabling SSL debugging this morning. I did catch this in the log for
> > an instance that started erroring out this morning. Seems like it may be
> > too generic to help solve my problem. Here it is:
> >
> > 24-May-2021 09:25:44.609 SEVERE [catalina-exec-51]
> > org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
> > java.lang.NullPointerException
> > at org.bouncycastle.crypto.signers.PSSSigner.generateSignature(Unknown
> > Source)
> > at org.bouncycastle.jce.provider.JDKPSSSigner.engineSign(Unknown Source)
>
> Oh. You are using BouncyCastle. I've never tried to do that. I'm not
> sure how well BC will work with Tomcat. We don't officially support that
> configuration, but that doesn't mean we won't try to help.
>
> There will be a presentation at this year's ApacheCon @Home 2021 about
> configuring Tomcat for FIPS and it will include how to configure Tomcat
> with BC (including FIPS). Obviously, you don't want to wait around until
> the conference to get things working, but perhaps the presenter is
> lurking on the list ... ?
>
> I don't have an email address for the presenter, so I can't give you a
> reference. :/
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Ezsra,
On 5/24/21 10:30, Ezsra McDonald wrote:
> I am enabling SSL debugging this morning. I did catch this in the log for
> an instance that started erroring out this morning. Seems like it may be
> too generic to help solve my problem. Here it is:
>
> 24-May-2021 09:25:44.609 SEVERE [catalina-exec-51]
> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
> java.lang.NullPointerException
> at org.bouncycastle.crypto.signers.PSSSigner.generateSignature(Unknown
> Source)
> at org.bouncycastle.jce.provider.JDKPSSSigner.engineSign(Unknown Source)
Oh. You are using BouncyCastle. I've never tried to do that. I'm not
sure how well BC will work with Tomcat. We don't officially support that
configuration, but that doesn't mean we won't try to help.
There will be a presentation at this year's ApacheCon @Home 2021 about
configuring Tomcat for FIPS and it will include how to configure Tomcat
with BC (including FIPS). Obviously, you don't want to wait around until
the conference to get things working, but perhaps the presenter is
lurking on the list ... ?
I don't have an email address for the presenter, so I can't give you a
reference. :/
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Ezsra,
On 5/24/21 11:18, Ezsra McDonald wrote:
> I was unable to identify the issue with debug enabled. I started looking
> closer at the error I was getting in the various browsers. Apparently the
> SSL is working. The browsers are blocking it because the server is using
> something other than TLSv1.2 or better. I was able to prove this using
> Safari. When I enabled the older TLS options I was able to connect.
This is excellent information to have.
Tomcat (or BC) should not be throwing NPE under any circumstances, though.
> The odd
> thing is that I have the connector configured for TLSv1.2. So, that is
> where I need to concentrate my efforts now. Why is tomcat not using the
> TLSv1.2 protocol?
>
> As a refresher, I have the following configured for the connector.
> <Connector executor="tomcatThreadPool"
> port="${http.port}"
> protocol="org.apache.coyote.http11.Http11NioProtocol"
> maxThreads="50" enableLookups="false" acceptCount="100"
> server="Apache"
> SSLEnabled="true" scheme="https" secure="true"
> clientAuth="false" sslProtocol="TLSv1.2"
> keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
> keyAlias="tomcat"
> keystorePass="**************"
> connectionTimeout="20000"/>
Aha. You are using "sslProtocol" which is, unfortunately, a nearly
worthless configuration attribute and *always* causes confusion for
anyone who has never had to deal with the JSSE TLS API.
The configuration attribute you really want to use is:
protocols="TLSv1.2"
The default is "all" which means
"SSLv2Hello,TLSv1,TLSv1.1,TLSv1.2,TLSv1.3", so all protocols should be
enabled by default.
> A SSLscan of the server port shows the following requests were accepted.
> Some are TLSv1.2.
>
> sslscan target.host.com:8080|grep Accepted
> Accepted TLSv1 256 bits ECDHE-RSA-AES256-SHA
> Accepted TLSv1 256 bits DHE-RSA-AES256-SHA
> Accepted TLSv1 128 bits ECDHE-RSA-AES128-SHA
> Accepted TLSv1 128 bits DHE-RSA-AES128-SHA
> Accepted TLS11 256 bits ECDHE-RSA-AES256-SHA
> Accepted TLS11 256 bits DHE-RSA-AES256-SHA
> Accepted TLS11 128 bits ECDHE-RSA-AES128-SHA
> Accepted TLS11 128 bits DHE-RSA-AES128-SHA
> Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384
> Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384
> Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA
> Accepted TLS12 256 bits DHE-RSA-AES256-GCM-SHA384
> Accepted TLS12 256 bits DHE-RSA-AES256-SHA256
> Accepted TLS12 256 bits DHE-RSA-AES256-SHA
> Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256
> Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256
> Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA
> Accepted TLS12 128 bits DHE-RSA-AES128-GCM-SHA256
> Accepted TLS12 128 bits DHE-RSA-AES128-SHA256
> Accepted TLS12 128 bits DHE-RSA-AES128-SHA
Most browsers will ignore some subset of the above.
The only "safe" cipher suite listed above is ECDHE-RSA-AES128-GCM-SHA256
and everyone should support *at least* that for the time being. Hmm.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Ezsra McDonald <ez...@gmail.com>.
I was unable to identify the issue with debug enabled. I started looking
closer at the error I was getting in the various browsers. Apparently the
SSL is working. The browsers are blocking it because the server is using
something other than TLSv1.2 or better. I was able to prove this using
Safari. When I enabled the older TLS options I was able to connect. The odd
thing is that I have the connector configured for TLSv1.2. So, that is
where I need to concentrate my efforts now. Why is tomcat not using the
TLSv1.2 protocol?
As a refresher, I have the following configured for the connector.
<Connector executor="tomcatThreadPool"
port="${http.port}"
protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="50" enableLookups="false" acceptCount="100"
server="Apache"
SSLEnabled="true" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLSv1.2"
keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
keyAlias="tomcat"
keystorePass="**************"
connectionTimeout="20000"/>
A SSLscan of the server port shows the following requests were accepted.
Some are TLSv1.2.
sslscan target.host.com:8080|grep Accepted
Accepted TLSv1 256 bits ECDHE-RSA-AES256-SHA
Accepted TLSv1 256 bits DHE-RSA-AES256-SHA
Accepted TLSv1 128 bits ECDHE-RSA-AES128-SHA
Accepted TLSv1 128 bits DHE-RSA-AES128-SHA
Accepted TLS11 256 bits ECDHE-RSA-AES256-SHA
Accepted TLS11 256 bits DHE-RSA-AES256-SHA
Accepted TLS11 128 bits ECDHE-RSA-AES128-SHA
Accepted TLS11 128 bits DHE-RSA-AES128-SHA
Accepted TLS12 256 bits ECDHE-RSA-AES256-GCM-SHA384
Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA384
Accepted TLS12 256 bits ECDHE-RSA-AES256-SHA
Accepted TLS12 256 bits DHE-RSA-AES256-GCM-SHA384
Accepted TLS12 256 bits DHE-RSA-AES256-SHA256
Accepted TLS12 256 bits DHE-RSA-AES256-SHA
Accepted TLS12 128 bits ECDHE-RSA-AES128-GCM-SHA256
Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA256
Accepted TLS12 128 bits ECDHE-RSA-AES128-SHA
Accepted TLS12 128 bits DHE-RSA-AES128-GCM-SHA256
Accepted TLS12 128 bits DHE-RSA-AES128-SHA256
Accepted TLS12 128 bits DHE-RSA-AES128-SHA
--Ez
On Mon, May 24, 2021 at 9:30 AM Ezsra McDonald <ez...@gmail.com>
wrote:
> I am enabling SSL debugging this morning. I did catch this in the log for
> an instance that started erroring out this morning. Seems like it may be
> too generic to help solve my problem. Here it is:
>
> 24-May-2021 09:25:44.609 SEVERE [catalina-exec-51]
> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
> java.lang.NullPointerException
> at org.bouncycastle.crypto.signers.PSSSigner.generateSignature(Unknown
> Source)
> at org.bouncycastle.jce.provider.JDKPSSSigner.engineSign(Unknown Source)
> at java.security.Signature$Delegate.engineSign(Signature.java:1382)
> at java.security.Signature.sign(Signature.java:698)
> at
> sun.security.ssl.CertificateVerify$T13CertificateVerifyMessage.<init>(CertificateVerify.java:931)
> at
> sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.onProduceCertificateVerify(CertificateVerify.java:1105)
> at
> sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.produce(CertificateVerify.java:1098)
> at sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:420)
> at
> sun.security.ssl.ClientHello$T13ClientHelloConsumer.goServerHello(ClientHello.java:1096)
> at
> sun.security.ssl.ClientHello$T13ClientHelloConsumer.consume(ClientHello.java:1032)
> at
> sun.security.ssl.ClientHello$ClientHelloConsumer.onClientHello(ClientHello.java:716)
> at
> sun.security.ssl.ClientHello$ClientHelloConsumer.consume(ClientHello.java:683)
> at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:376)
> at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
> at
> sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:983)
> at
> sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:970)
> at java.security.AccessController.doPrivileged(Native Method)
> at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:917)
> at
> org.apache.tomcat.util.net.SecureNioChannel.tasks(SecureNioChannel.java:432)
> at
> org.apache.tomcat.util.net.SecureNioChannel.handshakeUnwrap(SecureNioChannel.java:496)
> at
> org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:237)
> at
> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1611)
> at
> org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
> at
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> at
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> at
> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
> at java.lang.Thread.run(Thread.java:748)
>
>
> I will let you know what I find in the debug. It may be a while because
> the instance works fine initially.
>
> -- Ez
>
>
> On Thu, May 20, 2021 at 10:55 AM <Jo...@wellsfargo.com.invalid>
> wrote:
>
>> It's "ssl,handshake."
>>
>>
>> > -----Original Message-----
>> > From: Ezsra McDonald <ez...@gmail.com>
>> > Sent: Thursday, May 20, 2021 10:43 AM
>> > To: Tomcat Users List <us...@tomcat.apache.org>
>> > Subject: Re: Tomcat SSL stops working after an undetermined amount of
>> > time
>> >
>> > Mark,
>> >
>> > Thanks for your response.
>> >
>> > I did not see anything in the logs. This morning I added '
>> > -Djava.net.debug=handshake' to my configuration. I did not see any SSL
>> > debug information in my logs. Perhaps I did this wrong or need to use a
>> > different argument?
>> >
>> > I expected the debug to be in the access log. Should I be looking
>> elsewhere?
>> > I also checked other logs that had timestamps for after the instance was
>> > restarted.
>> >
>> > -- Ez
>> >
>> > On Thu, May 20, 2021 at 3:05 AM Mark Thomas <ma...@apache.org> wrote:
>> >
>> > > On 19/05/2021 20:42, Ezsra McDonald wrote:
>> > > > Environment:
>> > > > OS: CentOS 7
>> > > > Apache: apache-tomcat-8.5.65
>> > > > Java: jdk1.8.0_281
>> > > >
>> > > > Greetings,
>> > > >
>> > > > I recently enabled SSL on my Tomcat server HTTP connectors.
>> > > > Something odd is happening. After some undetermined amount of time
>> > > > the connector stops responding appropriately to requests. My browser
>> > > > returns the following
>> > > > message:
>> > > >
>> > > > "An error occurred during a connection to target.host.com:8080. SSL
>> > > > received a malformed Alert record.
>> > > >
>> > > > Error code: SSL_ERROR_RX_MALFORMED_ALERT "
>> > > > I do not see anything in the logs to clue me in on what is
>> happening.
>> > > >
>> > > > I have the following configured for the connector.
>> > > > <Connector executor="tomcatThreadPool"
>> > > > port="${http.port}"
>> > > > protocol="org.apache.coyote.http11.Http11NioProtocol"
>> > > > maxThreads="50" enableLookups="false" acceptCount="100"
>> > > > server="Apache"
>> > > > SSLEnabled="true" scheme="https" secure="true"
>> > > > clientAuth="false" sslProtocol="TLSv1.2"
>> > > > keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
>> > > > keyAlias="tomcat"
>> > > > keystorePass="**************"
>> > > > connectionTimeout="20000"/>
>> > > >
>> > > > When I restart the instance everything works fine for a while.
>> > > > Later,
>> > > when
>> > > > I try to look at the tomcat manager, SSL is no longer functioning
>> > > properly.
>> > > >
>> > > > Any assistance would be appreciated.
>> > >
>> > > Anything in the access logs?
>> > >
>> > > Enable TLS debug logging in the JVM Tomcat is using. You'll get a lot
>> > > of data but you'll be able to see exactly what is happening.
>> > >
>> > > Mark
>> > >
>> > > ---------------------------------------------------------------------
>> > > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> > > For additional commands, e-mail: users-help@tomcat.apache.org
>> > >
>> > >
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Ezsra McDonald <ez...@gmail.com>.
I am enabling SSL debugging this morning. I did catch this in the log for
an instance that started erroring out this morning. Seems like it may be
too generic to help solve my problem. Here it is:
24-May-2021 09:25:44.609 SEVERE [catalina-exec-51]
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun
java.lang.NullPointerException
at org.bouncycastle.crypto.signers.PSSSigner.generateSignature(Unknown
Source)
at org.bouncycastle.jce.provider.JDKPSSSigner.engineSign(Unknown Source)
at java.security.Signature$Delegate.engineSign(Signature.java:1382)
at java.security.Signature.sign(Signature.java:698)
at
sun.security.ssl.CertificateVerify$T13CertificateVerifyMessage.<init>(CertificateVerify.java:931)
at
sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.onProduceCertificateVerify(CertificateVerify.java:1105)
at
sun.security.ssl.CertificateVerify$T13CertificateVerifyProducer.produce(CertificateVerify.java:1098)
at sun.security.ssl.SSLHandshake.produce(SSLHandshake.java:420)
at
sun.security.ssl.ClientHello$T13ClientHelloConsumer.goServerHello(ClientHello.java:1096)
at
sun.security.ssl.ClientHello$T13ClientHelloConsumer.consume(ClientHello.java:1032)
at
sun.security.ssl.ClientHello$ClientHelloConsumer.onClientHello(ClientHello.java:716)
at
sun.security.ssl.ClientHello$ClientHelloConsumer.consume(ClientHello.java:683)
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:376)
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
at
sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:983)
at
sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:970)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:917)
at
org.apache.tomcat.util.net.SecureNioChannel.tasks(SecureNioChannel.java:432)
at
org.apache.tomcat.util.net.SecureNioChannel.handshakeUnwrap(SecureNioChannel.java:496)
at
org.apache.tomcat.util.net.SecureNioChannel.handshake(SecureNioChannel.java:237)
at
org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1611)
at
org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at
java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at
java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at
org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:748)
I will let you know what I find in the debug. It may be a while because the
instance works fine initially.
-- Ez
On Thu, May 20, 2021 at 10:55 AM <Jo...@wellsfargo.com.invalid>
wrote:
> It's "ssl,handshake."
>
>
> > -----Original Message-----
> > From: Ezsra McDonald <ez...@gmail.com>
> > Sent: Thursday, May 20, 2021 10:43 AM
> > To: Tomcat Users List <us...@tomcat.apache.org>
> > Subject: Re: Tomcat SSL stops working after an undetermined amount of
> > time
> >
> > Mark,
> >
> > Thanks for your response.
> >
> > I did not see anything in the logs. This morning I added '
> > -Djava.net.debug=handshake' to my configuration. I did not see any SSL
> > debug information in my logs. Perhaps I did this wrong or need to use a
> > different argument?
> >
> > I expected the debug to be in the access log. Should I be looking
> elsewhere?
> > I also checked other logs that had timestamps for after the instance was
> > restarted.
> >
> > -- Ez
> >
> > On Thu, May 20, 2021 at 3:05 AM Mark Thomas <ma...@apache.org> wrote:
> >
> > > On 19/05/2021 20:42, Ezsra McDonald wrote:
> > > > Environment:
> > > > OS: CentOS 7
> > > > Apache: apache-tomcat-8.5.65
> > > > Java: jdk1.8.0_281
> > > >
> > > > Greetings,
> > > >
> > > > I recently enabled SSL on my Tomcat server HTTP connectors.
> > > > Something odd is happening. After some undetermined amount of time
> > > > the connector stops responding appropriately to requests. My browser
> > > > returns the following
> > > > message:
> > > >
> > > > "An error occurred during a connection to target.host.com:8080. SSL
> > > > received a malformed Alert record.
> > > >
> > > > Error code: SSL_ERROR_RX_MALFORMED_ALERT "
> > > > I do not see anything in the logs to clue me in on what is happening.
> > > >
> > > > I have the following configured for the connector.
> > > > <Connector executor="tomcatThreadPool"
> > > > port="${http.port}"
> > > > protocol="org.apache.coyote.http11.Http11NioProtocol"
> > > > maxThreads="50" enableLookups="false" acceptCount="100"
> > > > server="Apache"
> > > > SSLEnabled="true" scheme="https" secure="true"
> > > > clientAuth="false" sslProtocol="TLSv1.2"
> > > > keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
> > > > keyAlias="tomcat"
> > > > keystorePass="**************"
> > > > connectionTimeout="20000"/>
> > > >
> > > > When I restart the instance everything works fine for a while.
> > > > Later,
> > > when
> > > > I try to look at the tomcat manager, SSL is no longer functioning
> > > properly.
> > > >
> > > > Any assistance would be appreciated.
> > >
> > > Anything in the access logs?
> > >
> > > Enable TLS debug logging in the JVM Tomcat is using. You'll get a lot
> > > of data but you'll be able to see exactly what is happening.
> > >
> > > Mark
> > >
> > > ---------------------------------------------------------------------
> > > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > > For additional commands, e-mail: users-help@tomcat.apache.org
> > >
> > >
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
RE: Tomcat SSL stops working after an undetermined amount of time
Posted by Jo...@wellsfargo.com.INVALID.
It's "ssl,handshake."
> -----Original Message-----
> From: Ezsra McDonald <ez...@gmail.com>
> Sent: Thursday, May 20, 2021 10:43 AM
> To: Tomcat Users List <us...@tomcat.apache.org>
> Subject: Re: Tomcat SSL stops working after an undetermined amount of
> time
>
> Mark,
>
> Thanks for your response.
>
> I did not see anything in the logs. This morning I added '
> -Djava.net.debug=handshake' to my configuration. I did not see any SSL
> debug information in my logs. Perhaps I did this wrong or need to use a
> different argument?
>
> I expected the debug to be in the access log. Should I be looking elsewhere?
> I also checked other logs that had timestamps for after the instance was
> restarted.
>
> -- Ez
>
> On Thu, May 20, 2021 at 3:05 AM Mark Thomas <ma...@apache.org> wrote:
>
> > On 19/05/2021 20:42, Ezsra McDonald wrote:
> > > Environment:
> > > OS: CentOS 7
> > > Apache: apache-tomcat-8.5.65
> > > Java: jdk1.8.0_281
> > >
> > > Greetings,
> > >
> > > I recently enabled SSL on my Tomcat server HTTP connectors.
> > > Something odd is happening. After some undetermined amount of time
> > > the connector stops responding appropriately to requests. My browser
> > > returns the following
> > > message:
> > >
> > > "An error occurred during a connection to target.host.com:8080. SSL
> > > received a malformed Alert record.
> > >
> > > Error code: SSL_ERROR_RX_MALFORMED_ALERT "
> > > I do not see anything in the logs to clue me in on what is happening.
> > >
> > > I have the following configured for the connector.
> > > <Connector executor="tomcatThreadPool"
> > > port="${http.port}"
> > > protocol="org.apache.coyote.http11.Http11NioProtocol"
> > > maxThreads="50" enableLookups="false" acceptCount="100"
> > > server="Apache"
> > > SSLEnabled="true" scheme="https" secure="true"
> > > clientAuth="false" sslProtocol="TLSv1.2"
> > > keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
> > > keyAlias="tomcat"
> > > keystorePass="**************"
> > > connectionTimeout="20000"/>
> > >
> > > When I restart the instance everything works fine for a while.
> > > Later,
> > when
> > > I try to look at the tomcat manager, SSL is no longer functioning
> > properly.
> > >
> > > Any assistance would be appreciated.
> >
> > Anything in the access logs?
> >
> > Enable TLS debug logging in the JVM Tomcat is using. You'll get a lot
> > of data but you'll be able to see exactly what is happening.
> >
> > Mark
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> > For additional commands, e-mail: users-help@tomcat.apache.org
> >
> >
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Mark Thomas <ma...@apache.org>.
On 20/05/2021 16:42, Ezsra McDonald wrote:
> Mark,
>
> Thanks for your response.
>
> I did not see anything in the logs. This morning I added '
> -Djava.net.debug=handshake' to my configuration. I did not see any SSL
> debug information in my logs. Perhaps I did this wrong or need to use a
> different argument?
Try:
-Djavax.net.debug=handshake
Mark
>
> I expected the debug to be in the access log. Should I be looking
> elsewhere? I also checked other logs that had timestamps for after the
> instance was restarted.
>
> -- Ez
>
> On Thu, May 20, 2021 at 3:05 AM Mark Thomas <ma...@apache.org> wrote:
>
>> On 19/05/2021 20:42, Ezsra McDonald wrote:
>>> Environment:
>>> OS: CentOS 7
>>> Apache: apache-tomcat-8.5.65
>>> Java: jdk1.8.0_281
>>>
>>> Greetings,
>>>
>>> I recently enabled SSL on my Tomcat server HTTP connectors. Something odd
>>> is happening. After some undetermined amount of time the connector stops
>>> responding appropriately to requests. My browser returns the following
>>> message:
>>>
>>> "An error occurred during a connection to target.host.com:8080. SSL
>>> received a malformed Alert record.
>>>
>>> Error code: SSL_ERROR_RX_MALFORMED_ALERT
>>> "
>>> I do not see anything in the logs to clue me in on what is happening.
>>>
>>> I have the following configured for the connector.
>>> <Connector executor="tomcatThreadPool"
>>> port="${http.port}"
>>> protocol="org.apache.coyote.http11.Http11NioProtocol"
>>> maxThreads="50" enableLookups="false" acceptCount="100"
>>> server="Apache"
>>> SSLEnabled="true" scheme="https" secure="true"
>>> clientAuth="false" sslProtocol="TLSv1.2"
>>> keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
>>> keyAlias="tomcat"
>>> keystorePass="**************"
>>> connectionTimeout="20000"/>
>>>
>>> When I restart the instance everything works fine for a while. Later,
>> when
>>> I try to look at the tomcat manager, SSL is no longer functioning
>> properly.
>>>
>>> Any assistance would be appreciated.
>>
>> Anything in the access logs?
>>
>> Enable TLS debug logging in the JVM Tomcat is using. You'll get a lot of
>> data but you'll be able to see exactly what is happening.
>>
>> Mark
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
>>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Ezsra McDonald <ez...@gmail.com>.
Mark,
Thanks for your response.
I did not see anything in the logs. This morning I added '
-Djava.net.debug=handshake' to my configuration. I did not see any SSL
debug information in my logs. Perhaps I did this wrong or need to use a
different argument?
I expected the debug to be in the access log. Should I be looking
elsewhere? I also checked other logs that had timestamps for after the
instance was restarted.
-- Ez
On Thu, May 20, 2021 at 3:05 AM Mark Thomas <ma...@apache.org> wrote:
> On 19/05/2021 20:42, Ezsra McDonald wrote:
> > Environment:
> > OS: CentOS 7
> > Apache: apache-tomcat-8.5.65
> > Java: jdk1.8.0_281
> >
> > Greetings,
> >
> > I recently enabled SSL on my Tomcat server HTTP connectors. Something odd
> > is happening. After some undetermined amount of time the connector stops
> > responding appropriately to requests. My browser returns the following
> > message:
> >
> > "An error occurred during a connection to target.host.com:8080. SSL
> > received a malformed Alert record.
> >
> > Error code: SSL_ERROR_RX_MALFORMED_ALERT
> > "
> > I do not see anything in the logs to clue me in on what is happening.
> >
> > I have the following configured for the connector.
> > <Connector executor="tomcatThreadPool"
> > port="${http.port}"
> > protocol="org.apache.coyote.http11.Http11NioProtocol"
> > maxThreads="50" enableLookups="false" acceptCount="100"
> > server="Apache"
> > SSLEnabled="true" scheme="https" secure="true"
> > clientAuth="false" sslProtocol="TLSv1.2"
> > keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
> > keyAlias="tomcat"
> > keystorePass="**************"
> > connectionTimeout="20000"/>
> >
> > When I restart the instance everything works fine for a while. Later,
> when
> > I try to look at the tomcat manager, SSL is no longer functioning
> properly.
> >
> > Any assistance would be appreciated.
>
> Anything in the access logs?
>
> Enable TLS debug logging in the JVM Tomcat is using. You'll get a lot of
> data but you'll be able to see exactly what is happening.
>
> Mark
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
Re: Tomcat SSL stops working after an undetermined amount of time
Posted by Mark Thomas <ma...@apache.org>.
On 19/05/2021 20:42, Ezsra McDonald wrote:
> Environment:
> OS: CentOS 7
> Apache: apache-tomcat-8.5.65
> Java: jdk1.8.0_281
>
> Greetings,
>
> I recently enabled SSL on my Tomcat server HTTP connectors. Something odd
> is happening. After some undetermined amount of time the connector stops
> responding appropriately to requests. My browser returns the following
> message:
>
> "An error occurred during a connection to target.host.com:8080. SSL
> received a malformed Alert record.
>
> Error code: SSL_ERROR_RX_MALFORMED_ALERT
> "
> I do not see anything in the logs to clue me in on what is happening.
>
> I have the following configured for the connector.
> <Connector executor="tomcatThreadPool"
> port="${http.port}"
> protocol="org.apache.coyote.http11.Http11NioProtocol"
> maxThreads="50" enableLookups="false" acceptCount="100"
> server="Apache"
> SSLEnabled="true" scheme="https" secure="true"
> clientAuth="false" sslProtocol="TLSv1.2"
> keystoreFile="/opt/tomcat/ssl/tomcat_ssl.jks"
> keyAlias="tomcat"
> keystorePass="**************"
> connectionTimeout="20000"/>
>
> When I restart the instance everything works fine for a while. Later, when
> I try to look at the tomcat manager, SSL is no longer functioning properly.
>
> Any assistance would be appreciated.
Anything in the access logs?
Enable TLS debug logging in the JVM Tomcat is using. You'll get a lot of
data but you'll be able to see exactly what is happening.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org