You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Venkataraman Srinivasan <Ve...@gcrta.org> on 2018/08/02 16:00:11 UTC
Please help me in enabling SSL certificate
Hi,
Please help me in enabling SSL certificate in Tomcat Apache servers.
Thanks
Venkataraman Srinivasan
Database Administrator
Greater Cleveland RTA
Desk phone 1-216-356-3028
venkataraman.srinivasan@grcta.org
Re: Please help me in enabling SSL certificate
Posted by Venkataraman Srinivasan <Ve...@gcrta.org>.
John,
Thanks. Now it is working fine. I cleansed the file.
Thanks
Venkat
>>> John Palmer <jo...@gmail.com> 8/7/2018 9:10 AM >>>
your server.xml shows TWO connectors for port 8443; that second one (with
all the certificate entries) is then causing the errror:
> Caused by: java.net.BindException: Address already in use
As that one is probably the one you want to be using, delete or comment out
the first connector for port 8443....
On Thu, Aug 2, 2018 at 1:24 PM, Venkataraman Srinivasan <
Venkataraman.Srinivasan@gcrta.org> wrote:
>
> Hi ,
>
> I am using tomcat version 8.5.32
>
>
> I made the below entry in Server.xml
>
> <Service name="Catalina">
>
> <!--The connectors can use a shared executor, you can define one or
> more named thread pools-->
> <!--
> <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
> maxThreads="150" minSpareThreads="4"/>
> -->
>
>
> <!-- A "Connector" represents an endpoint by which requests are
> received
> and responses are returned. Documentation at :
> Java HTTP Connector: /docs/config/http.html
> Java AJP Connector: /docs/config/ajp.html
> APR (HTTP/AJP) Connector: /docs/apr.html
> Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
> -->
> <Connector port="8443" protocol="HTTP/1.1"
> connectionTimeout="20000"
> />
>
>
>
>
> <Connector port="8443" protocol="org.apache.coyote.
> http11.Http11NioProtocol"
> sslImplementationName="org.apache.tomcat.util.net.jsse.
> JSSEImplementation"
> maxThreads="200" secure="true" scheme="https" >
> <Certificate certificateFile="/home/apexadmin/.keystore"
> keystorePass="xxxxx" type="RSA"
> clientAuth="false" SSLEnabled="true"
> sslProtocol="TLS"
> >
> </Certificate>
> </Connector>
>
> '
> When I tried to login, https://webapxt03.rta:8443, the log file
> catalina.2018-08-02.log recorded as below
>
>
> CATALINA.OUT has got entries as below
>
>
> 02-Aug-2018 14:04:24.926 SEVERE [main] org.apache.catalina.core.StandardService.initInternal
> Failed to initialize connector [Connector[HTTP/1.1-8443]]
> org.apache.catalina.LifecycleException: Failed to initialize component
> [Connector[HTTP/1.1-8443]]
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:112)
> at org.apache.catalina.core.StandardService.initInternal(
> StandardService.java:549)
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:107)
> at org.apache.catalina.core.StandardServer.initInternal(
> StandardServer.java:875)
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:107)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:632)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:655)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(
> NativeMethodAccessorImpl.java:57)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(
> DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:606)
> at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:309)
> at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:492)
> Caused by: org.apache.catalina.LifecycleException: Protocol handler
> initialization failed
> at org.apache.catalina.connector.Connector.initInternal(
> Connector.java:995)
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:107)
> ... 12 more
> Caused by: java.net.BindException: Address already in use
> at sun.nio.ch.Net.bind0(Native Method)
> at sun.nio.ch.Net.bind(Net.java:444)
> at sun.nio.ch.Net.bind(Net.java:436)
> at sun.nio.ch.ServerSocketChannelImpl.bind(
> ServerSocketChannelImpl.java:214)
> at sun.nio.ch.ServerSocketAdaptor.bind(
> ServerSocketAdaptor.java:74)
> at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.
> java:210)
> at org.apache.tomcat.util.net.AbstractEndpoint.init(
> AbstractEndpoint.java:1086)
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(
> AbstractJsseEndpoint.java:268)
> at org.apache.coyote.AbstractProtocol.init(
> AbstractProtocol.java:581)
> at org.apache.coyote.http11.AbstractHttp11Protocol.init(
> AbstractHttp11Protocol.java:68)
> at org.apache.catalina.connector.Connector.initInternal(
> Connector.java:993)
> ... 13 more
>
>
> I used SSL/TLS Configuration HOW-TO of Apache Tomcat 7 document
>
>
>
> >>> Christopher Schultz <ch...@christopherschultz.net> 8/2/2018 12:44 PM
> >>>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Venkataraman,
>
> On 8/2/18 12:14 PM, Venkataraman Srinivasan wrote:
> > Chris,
> >
> > Thanks for your reply. I will implement your recommendations in my
> > next iterations.
> >
> > Currently I did as below.
> >
> > I copied the keystore file as /home/apexadmin/.keystore
> >
> > and made below entry in server.xml
>
> What version of Tomcat are you using? Which part of the user guide are
> you reading? I just want to make sure you are following the right
> guide for the right version.
>
> > <Connector port="8080"
> > protocol="org.apache.coyote.http11.Http11NioProtocol"
> > maxThreads="200" redirectPort="8443" scheme="https" > <Certificate
> > certificateFile="/home/apexadmin/.keystore" keystorePass="xxxxx"
> > type="RSA" clientAuth="false" SSLEnabled="true" sslProtocol="TLS"
> >>
> > </Certificate> </Connector>
>
> You will need to set a few more attributes on the <Connector>:
>
> SSLEnabled="true"
> secure="true"
>
> The next part depends upon your Tomcat version.
>
> > Opened the port 8443 and recycled tomcat.
>
> The <Connector> defined above is listening on port 8080. That is
> unusual; most people would expect port 8080 to be a plaintext HTTP
> port, while port 8443 would be the non-privileged HTTPS port.
>
> Especially for testing, consider leaving the <Connector> for port 8080
> as it was originally defined (without HTTPS) and configure a second
> <Connector> for HTTPS on port 8443.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjNNYACgkQHPApP6U8
> pFi2UQ//SPU5itX1zh/lV/ICZYTOwiSSeF8EQfxWK1bZ9jCx3Pk44AMBRMRQqjl2
> HMKRH/LsSMQp5iwtVBFKbjZyjG8btNMnmREUjFkMJHoFUh1IK0WVqybpeUSnl2BH
> +TdS6Z9twZd5q9/UybsJZScdgfV9IFECAM9xmG21ty92+xBqkbeSPUc62gf/A783
> 4P6yAYLIM3ctMHIzjwTJQ78vxTxLjsfrXvQaIC/dGefrKM6dcpxklQ/me4JNp6Lu
> GajNkuEhm20u8P172rVFdqr4NgdGlLd6UP3XXeRl1BNnCvvAI9B/HsYQ1ZOZ1pDe
> Zh3Jjamdx8neCBoZBCB7Pg/BmyuJ3RQRkA2w4APIMxoY7Bw0aYT2JpZdQqUaLFN+
> Omzqf4pjpyFfRYlyhsTmbFviqbaIT4+XJ+SZPt4TYUuqawGp7vRJOTaQwfyJfJq+
> he0XNEJWNGOzPjcdyuoJevjLONM0h7fenTAfZUUTkzmLxkMoRMSO9sIkQy46f4Z7
> vG7x3MdSvrJKgWEbUSKjsCvtuYfCATf7bPk+1KJQUTMiSmk/E8OVq6q9BrcOVl1Z
> NXWPHOT3rN0JBtBbZNzmBPz3yYywy5zKD6FTeBwbQDn2Z+KInfMOT7+40954PUXI
> j4b4vEL1H0hunoV9hRKUHpeQbLOumITocQ6Wzd9vmo6qA1tys2U=
> =lTPy
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ----------
>
> This email has been scanned for spam and viruses. Visit the following link
> to report this email as spam:
> https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_
> option=logitem&mail_id=1533228251-jk51pyRbptjj&r_address=venkataraman.
> srinivasan%40gcrta.org&report=1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
----------
This email has been scanned for spam and viruses. Visit the following link to report this email as spam:
https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_option=logitem&mail_id=1533647471-tYcHXo77FLwH&r_address=venkataraman.srinivasan%40gcrta.org&report=1
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Please help me in enabling SSL certificate
Posted by Venkataraman Srinivasan <Ve...@gcrta.org>.
Hi,
Please help me in enabling SSL certificate in Tomcat Apache servers.
Thanks
Venkataraman Srinivasan
Database Administrator
Greater Cleveland RTA
Desk phone 1-216-356-3028
venkataraman.srinivasan@grcta.org
Re: Please help me in enabling SSL certificate
Posted by Venkataraman Srinivasan <Ve...@gcrta.org>.
I used below command to create certificate locally.
$JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/tomcat/apache-tomcat-8.5.32/keystore
Thanks
Venkat
>>> Christopher Schultz <ch...@christopherschultz.net> 8/2/2018 12:03 PM >>>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Venkataraman,
On 8/2/18 12:00 PM, Venkataraman Srinivasan wrote:
> Please help me in enabling SSL certificate in Tomcat Apache
> servers.
Do you already have a certificate signed by a CA?
What have you already tried?
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjK0kACgkQHPApP6U8
pFgipg//f2c+/duHWneEVxOwKDXJqCVT4pAIZLyAeLuqvG6nY1rYDoyhRaSftAIZ
FTe3WAa8UZRWr2Ky6s234P1EpPJPWtMia7/++/n8/pranCIb6YVlbGm3SuPfncO/
VXtC0CEF0o3yTrnYLS4YTvMQUwlr0C3iqhtW2zDg/fgGdumC6PlYaw7+Qj6Jsc9k
N6Tir53YMyy1hVZu8wQxQ2c+HibQLWwY6YkgdloBqS3CLqBB4WS1NYXSVqqTH8cE
5KgHtDN8kja3T5OzcKCm/59wK/o03g7cLkit7S3mHn5pTkJ1p90HP0I2QzyEPUuN
yCw4liMOX/x2F3XBgfDangH4qABkWwpT5wsAPeJqu9drsE5CLd0ZEs2wz3BHyOzn
XlHKny6R5VBroriaTNmvXav0aY9f+QXOuhWWzDF5UTWPyqcNO/nzDwAdxy4jlykk
u4Yw07y3Yx/lUr6wuGi7gGEM8MdgQlOSfzv/rI2glL5n3hEr9WMr7yuTkM4wvyfp
feARNzAvBTInu++Bb8kB4r/KxJbx/4doCXlOxfR78PxuIP43nklMcwYxBt+suAEP
YU7fqPCVKmY1Urta1z/sBC5HwIFxfA8qa7LyZoOXi42kaULeBR2dydQM8cKoDlh8
BpXPbEbnEUyBMMuSNJtu1c1va7GdbZRJhz6S4LtxcDSYNEYWjJo=
=SLOV
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
----------
This email has been scanned for spam and viruses. Visit the following link to report this email as spam:
https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_option=logitem&mail_id=1533225806-BgkdviBw265M&r_address=venkataraman.srinivasan%40gcrta.org&report=1
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Venkataraman,
On 8/2/18 12:05 PM, Venkataraman Srinivasan wrote:
> I used below command to create certificate locally.
>
> $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore
> /opt/tomcat/apache-tomcat-8.5.32/keystore
Okay, so you have a self-signed certificate.
Have you tried anything to configure Tomcat for TLS/SSL? If so, what?
If you haven't tried anything, yet, have you read any documentation on
the Tomcat site for how to configure TLS?
(BTW, you probably have a certificate that doesn't last as long as you
might think, and the key might not have as many bits as you might
like. Consider inspecting the certificate and key to see the details
and decide if it meets your needs. Personally, I always use RSA keys
of at least 4096-bits and use SHA256 signatures on the certificates.
The validity period is up to you. You might also consider using an EC
key+certificate, since the same "strength" key+cert can be processed
with less CPU time than an equivalent RSA key.)
- -chris
>>>> Christopher Schultz <ch...@christopherschultz.net> 8/2/2018
>>>> 12:03 PM >>>
> Venkataraman,
>
> On 8/2/18 12:00 PM, Venkataraman Srinivasan wrote:
>> Please help me in enabling SSL certificate in Tomcat Apache
>> servers.
>
> Do you already have a certificate signed by a CA?
>
> What have you already tried?
>
> -chris
>
> ---------------------------------------------------------------------
>
>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ----------
>
> This email has been scanned for spam and viruses. Visit the
> following link to report this email as spam:
> https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_option=logi
tem&mail_id=1533225806-BgkdviBw265M&r_address=venkataraman.srinivasan%40
gcrta.org&report=1
>
>
>
> ---------------------------------------------------------------------
>
>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjLMIACgkQHPApP6U8
pFhsww/+OYuxpSdXU+twUKitl7UP6njGDFZdB3y6r0MEmv8Y5lzKeZRXr+VAru3r
RDv1kBg6v2ohaAR2+kjZ7xxueIDauaHcvnOCgnrFYq84ZI4vQgWKosaCc78OTv9e
H9jSE6wA29jwvgijSIDn5X3aAHugXVbBD6gKkZcFCOsi7MLmiZGljTie6qe1r+s7
mSF2lRy09TsiQX3c86wEV+Lp0280eRufDvphuu6Kto+AzNy8f4AHSXZ0smHQ8QB4
QM8vm23YXAOwnnbeljWsSdvN0KpjjzedHGzgZqhTKnu+vBiYxBp7+bJ5x9Lld8iS
YaYTFQtOFvG3jcQwptGN2X1e0fPdALOxWblRaIFZNq4U1WwIiOEcrgCTQNnsTOxM
IfEfMYugik7o7l2SwZZV5tqT+H++GehzBvHdXk0r40q+EBaioyws58DvB1/7FSb7
Vk4oKNjfDT5Hq04KMRtXlX7TB940OQuy7ckRF4bB8yUKQai0xqXANIfEQLpCHU6q
xuBM/5UOXjC7/KsEKgwFaLh7LeCLvl/6GLXpf9P3Wtg4Ahb57k61BhU2YsEZVop5
oX+Uf233f2IdUrEOq5/Kj302LP9DGcPZzjX2rWI7CpPEgOahTFpKxvJc4EoqZYah
WpWWL/m9yv57emaBeoxZtZJEfoHz/P8d/kd+x0e6jGq9Tl6yOKg=
=tj+4
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by "James H. H. Lampert" <ja...@touchtonecorp.com>.
On 8/2/18, 9:05 AM, Venkataraman Srinivasan wrote:
> I used below command to create certificate locally.
>
> $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /opt/tomcat/apache-tomcat-8.5.32/keystore
Ok. Probably the first thing you need to do is set up your connector to
use that keystore. If it's a Java Keystore, then presumably you will be
using the native/JSSE connector; the other one is for OpenSSL. And there
are plenty of web resources explaining that process in detail. This is
the one I keep bookmarked for reference:
http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html
Once you have the connector working, if you want your server to be
trusted by strangers, then you need to get that keystore signed.
Using Keytool (or some other utility, like KeyStore Explorer on a
Macintosh), you need to generate a Certificate Signing Request for your
keystore.
You would then choose a Certificate Authority, and buy a certificate. At
some point in the process, you will be asked to upload the CSR. You
might also be asked to provide some sort of proof that you have control
over the domain.
Once the certificate is issued, you would then import the reply, along
with one or more supporting certificates (collectively, a "certificate
chain") into your keystore, again using either Keytool or some more
user-friendly utility, and then plug the signed keystore into your
server. The Certificate Authority, if it's a major one, will probably
have detailed instructions specific to Tomcat.
--
JHHL
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
James,
On 8/2/18 12:17 PM, James H. H. Lampert wrote:
> On 8/2/18, 9:05 AM, Venkataraman Srinivasan wrote:
>> I used below command to create certificate locally.
>>
>> $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA
>> -keystore /opt/tomcat/apache-tomcat-8.5.32/keystore
>
> Ok. Probably the first thing you need to do is set up your
> connector to use that keystore.
Thanks for your reply, James. I'm going to make a few adjustments to
help newcomers as well as you use the correct terminology in a few place
s.
> If it's a Java Keystore, then presumably you will be using the
> native/JSSE connector; the other one is for OpenSSL.
Java actually supports a handful of keystore types. Common ones are
JKS (the default up until Java 9, which is Java-specific), JCEKS
(which is still Java-specific and somehow "more secure" but I don't
understand how) and PKCS12, which is an industry-standard. OpenSSL can
use PKCS12 keystores, but usually people use PEM-encoded DER files
(the things that are a bunch of letters and numbers beginning with
either "----BEGIN PRIVATE KEY----" or "----BEGIN CERTIFICATE----".
> And there are plenty of web resources explaining that process in
> detail. This is the one I keep bookmarked for reference:>
> http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html
This is a good one, but things have changed a bit for configuration
for later versions of Tomcat. Tomcat 8.5 and later specifically have
to have a different kind of configuration for SSL/TLS certificates,
because of the use of Server Name Indication (SNI) to determine which
certificate to show to the client when making a connection.
Remember that the TLS handshake happens before the HTTP headers
(including the "Host" header) can be delivered, and the server can
host certificates for multiple domain names. SNI allows the TLS
handshake to tell the server which hostname it intends to reach once
the TLS handshake has completed and the HTTP conversation begins.
> Once you have the connector working, if you want your server to be
> trusted by strangers, then you need to get that keystore signed.
Technically, it's the certificate that gets signed, not the keystore.
> Using Keytool (or some other utility, like KeyStore Explorer on a
> Macintosh), you need to generate a Certificate Signing Request for
> your keystore.
>
> You would then choose a Certificate Authority, and buy a
> certificate. At some point in the process, you will be asked to
> upload the CSR. You might also be asked to provide some sort of
> proof that you have control over the domain.
>
> Once the certificate is issued, you would then import the reply
Which is a certificate itself. It's actually YOUR certificate, plus a
signature that proves the CA signed it.
> along with one or more supporting certificates (collectively, a
> "certificate chain") into your keystore, again using either
> Keytool or some more user-friendly utility, and then plug the
> signed keystore into your server. The Certificate Authority, if
> it's a major one, will probably have detailed instructions specific
> to Tomcat.
They might. But there are a lot of options, so not every guide will be
straightforward to use.
If the Tomcat documentation can't help get things going, it needs to
be updated.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjN1UACgkQHPApP6U8
pFg/XBAAhZQVTigfwjAxoEVEl+gj8Y1vUYY6qb9YwZVogovWWeBw1udV+iN0LhBx
bY+uol18XWzYKQ62OUn0nqOfYGrjcOJTCVWqz7HFNWTtOczmFUmFXsQZN76mOUx1
ynF97carzh74N6kQwP81JYVxZcqMtTwMln+hhSqJ2QtBJ1I8TmXn222QLGA3rT61
U4t1xjbkD+YU4+W4zhA5Z/gfMEBby5zi6YJOq5NHUnPsypypxIUSdIJ0l9T/qWu8
xcCCLtxtg3rqVjn4vi4Lo8/+YIm6IVohU39aOMNnVSjW19FGIKL5zFgWsFV2xy6w
r856GV0+WRDZDikwJegxUaKwt5gwBo5+sop75HMebRx67xazEFsXH3rlmCwloATK
ajv+GUIgWhUcHdhrMbr0DhKynaBSCkM7RUgeWl9CnjZ9L8Ejs2iO7dKu8qzT5/9C
FtFZcoesnST/atEGcZWE5CP9w10HkBactxsg/9juLBHdmGBnOKL547bAdv2xi1XN
3d4OVAj/pfW6GH0gJUrz0Eou7LIQE50niPQszxyqGixK3e7h7fDrKlpRNAQ6cpre
C0jNDYgWsKG7i7XNpuxxdnwpYSm18y3uMQ+BYRW4pNXUqRGWGmjFYponSAtuP9hI
hrHDvAsYdVR7fs+f7Nwn+cjSYxQ7hq0bNAwFrgVc5aLxdpewu/k=
=YXie
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by Venkataraman Srinivasan <Ve...@gcrta.org>.
Chris,
Thanks for your reply. I will implement your recommendations in my next iterations.
Currently I did as below.
I copied the keystore file as /home/apexadmin/.keystore
and made below entry in server.xml
<Connector port="8080" protocol="org.apache.coyote.http11.Http11NioProtocol"
maxThreads="200" redirectPort="8443" scheme="https" >
<Certificate certificateFile="/home/apexadmin/.keystore"
keystorePass="changeit" type="RSA"
clientAuth="false" SSLEnabled="true" sslProtocol="TLS"
>
</Certificate>
</Connector>
Opened the port 8443 and recycled tomcat.
But no use
Thanks
Venkat
>>> Christopher Schultz <ch...@christopherschultz.net> 8/2/2018 12:09 PM >>>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Venkataraman,
On 8/2/18 12:05 PM, Venkataraman Srinivasan wrote:
> I used below command to create certificate locally.
>
> $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore
> /opt/tomcat/apache-tomcat-8.5.32/keystore
Okay, so you have a self-signed certificate.
Have you tried anything to configure Tomcat for TLS/SSL? If so, what?
If you haven't tried anything, yet, have you read any documentation on
the Tomcat site for how to configure TLS?
(BTW, you probably have a certificate that doesn't last as long as you
might think, and the key might not have as many bits as you might
like. Consider inspecting the certificate and key to see the details
and decide if it meets your needs. Personally, I always use RSA keys
of at least 4096-bits and use SHA256 signatures on the certificates.
The validity period is up to you. You might also consider using an EC
key+certificate, since the same "strength" key+cert can be processed
with less CPU time than an equivalent RSA key.)
- -chris
>>>> Christopher Schultz <ch...@christopherschultz.net> 8/2/2018
>>>> 12:03 PM >>>
> Venkataraman,
>
> On 8/2/18 12:00 PM, Venkataraman Srinivasan wrote:
>> Please help me in enabling SSL certificate in Tomcat Apache
>> servers.
>
> Do you already have a certificate signed by a CA?
>
> What have you already tried?
>
> -chris
>
> ---------------------------------------------------------------------
>
>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ----------
>
> This email has been scanned for spam and viruses. Visit the
> following link to report this email as spam:
> https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_option=logi
tem&mail_id=1533225806-BgkdviBw265M&r_address=venkataraman.srinivasan%40
gcrta.org&report=1
>
>
>
> ---------------------------------------------------------------------
>
>
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjLMIACgkQHPApP6U8
pFhsww/+OYuxpSdXU+twUKitl7UP6njGDFZdB3y6r0MEmv8Y5lzKeZRXr+VAru3r
RDv1kBg6v2ohaAR2+kjZ7xxueIDauaHcvnOCgnrFYq84ZI4vQgWKosaCc78OTv9e
H9jSE6wA29jwvgijSIDn5X3aAHugXVbBD6gKkZcFCOsi7MLmiZGljTie6qe1r+s7
mSF2lRy09TsiQX3c86wEV+Lp0280eRufDvphuu6Kto+AzNy8f4AHSXZ0smHQ8QB4
QM8vm23YXAOwnnbeljWsSdvN0KpjjzedHGzgZqhTKnu+vBiYxBp7+bJ5x9Lld8iS
YaYTFQtOFvG3jcQwptGN2X1e0fPdALOxWblRaIFZNq4U1WwIiOEcrgCTQNnsTOxM
IfEfMYugik7o7l2SwZZV5tqT+H++GehzBvHdXk0r40q+EBaioyws58DvB1/7FSb7
Vk4oKNjfDT5Hq04KMRtXlX7TB940OQuy7ckRF4bB8yUKQai0xqXANIfEQLpCHU6q
xuBM/5UOXjC7/KsEKgwFaLh7LeCLvl/6GLXpf9P3Wtg4Ahb57k61BhU2YsEZVop5
oX+Uf233f2IdUrEOq5/Kj302LP9DGcPZzjX2rWI7CpPEgOahTFpKxvJc4EoqZYah
WpWWL/m9yv57emaBeoxZtZJEfoHz/P8d/kd+x0e6jGq9Tl6yOKg=
=tj+4
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
----------
This email has been scanned for spam and viruses. Visit the following link to report this email as spam:
https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_option=logitem&mail_id=1533226184-8zaWI97tys-m&r_address=venkataraman.srinivasan%40gcrta.org&report=1
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Venkataraman,
On 8/2/18 12:14 PM, Venkataraman Srinivasan wrote:
> Chris,
>
> Thanks for your reply. I will implement your recommendations in my
> next iterations.
>
> Currently I did as below.
>
> I copied the keystore file as /home/apexadmin/.keystore
>
> and made below entry in server.xml
What version of Tomcat are you using? Which part of the user guide are
you reading? I just want to make sure you are following the right
guide for the right version.
> <Connector port="8080"
> protocol="org.apache.coyote.http11.Http11NioProtocol"
> maxThreads="200" redirectPort="8443" scheme="https" > <Certificate
> certificateFile="/home/apexadmin/.keystore" keystorePass="changeit"
> type="RSA" clientAuth="false" SSLEnabled="true" sslProtocol="TLS"
>>
> </Certificate> </Connector>
You will need to set a few more attributes on the <Connector>:
SSLEnabled="true"
secure="true"
The next part depends upon your Tomcat version.
> Opened the port 8443 and recycled tomcat.
The <Connector> defined above is listening on port 8080. That is
unusual; most people would expect port 8080 to be a plaintext HTTP
port, while port 8443 would be the non-privileged HTTPS port.
Especially for testing, consider leaving the <Connector> for port 8080
as it was originally defined (without HTTPS) and configure a second
<Connector> for HTTPS on port 8443.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjNNYACgkQHPApP6U8
pFi2UQ//SPU5itX1zh/lV/ICZYTOwiSSeF8EQfxWK1bZ9jCx3Pk44AMBRMRQqjl2
HMKRH/LsSMQp5iwtVBFKbjZyjG8btNMnmREUjFkMJHoFUh1IK0WVqybpeUSnl2BH
+TdS6Z9twZd5q9/UybsJZScdgfV9IFECAM9xmG21ty92+xBqkbeSPUc62gf/A783
4P6yAYLIM3ctMHIzjwTJQ78vxTxLjsfrXvQaIC/dGefrKM6dcpxklQ/me4JNp6Lu
GajNkuEhm20u8P172rVFdqr4NgdGlLd6UP3XXeRl1BNnCvvAI9B/HsYQ1ZOZ1pDe
Zh3Jjamdx8neCBoZBCB7Pg/BmyuJ3RQRkA2w4APIMxoY7Bw0aYT2JpZdQqUaLFN+
Omzqf4pjpyFfRYlyhsTmbFviqbaIT4+XJ+SZPt4TYUuqawGp7vRJOTaQwfyJfJq+
he0XNEJWNGOzPjcdyuoJevjLONM0h7fenTAfZUUTkzmLxkMoRMSO9sIkQy46f4Z7
vG7x3MdSvrJKgWEbUSKjsCvtuYfCATf7bPk+1KJQUTMiSmk/E8OVq6q9BrcOVl1Z
NXWPHOT3rN0JBtBbZNzmBPz3yYywy5zKD6FTeBwbQDn2Z+KInfMOT7+40954PUXI
j4b4vEL1H0hunoV9hRKUHpeQbLOumITocQ6Wzd9vmo6qA1tys2U=
=lTPy
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by Venkataraman Srinivasan <Ve...@gcrta.org>.
Hi ,
I am using tomcat version 8.5.32
I made the below entry in Server.xml
<Service name="Catalina">
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="150" minSpareThreads="4"/>
-->
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
-->
<Connector port="8443" protocol="HTTP/1.1"
connectionTimeout="20000"
/>
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
maxThreads="200" secure="true" scheme="https" >
<Certificate certificateFile="/home/apexadmin/.keystore"
keystorePass="xxxxx" type="RSA"
clientAuth="false" SSLEnabled="true" sslProtocol="TLS"
>
</Certificate>
</Connector>
'
When I tried to login, https://webapxt03.rta:8443, the log file catalina.2018-08-02.log recorded as below
CATALINA.OUT has got entries as below
02-Aug-2018 14:04:24.926 SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[HTTP/1.1-8443]]
org.apache.catalina.LifecycleException: Failed to initialize component [Connector[HTTP/1.1-8443]]
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:112)
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:549)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:875)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
at org.apache.catalina.startup.Catalina.load(Catalina.java:632)
at org.apache.catalina.startup.Catalina.load(Catalina.java:655)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:606)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:309)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:492)
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:995)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
... 12 more
Caused by: java.net.BindException: Address already in use
at sun.nio.ch.Net.bind0(Native Method)
at sun.nio.ch.Net.bind(Net.java:444)
at sun.nio.ch.Net.bind(Net.java:436)
at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:214)
at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74)
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:210)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1086)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:268)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:581)
at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:68)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:993)
... 13 more
I used SSL/TLS Configuration HOW-TO of Apache Tomcat 7 document
>>> Christopher Schultz <ch...@christopherschultz.net> 8/2/2018 12:44 PM >>>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Venkataraman,
On 8/2/18 12:14 PM, Venkataraman Srinivasan wrote:
> Chris,
>
> Thanks for your reply. I will implement your recommendations in my
> next iterations.
>
> Currently I did as below.
>
> I copied the keystore file as /home/apexadmin/.keystore
>
> and made below entry in server.xml
What version of Tomcat are you using? Which part of the user guide are
you reading? I just want to make sure you are following the right
guide for the right version.
> <Connector port="8080"
> protocol="org.apache.coyote.http11.Http11NioProtocol"
> maxThreads="200" redirectPort="8443" scheme="https" > <Certificate
> certificateFile="/home/apexadmin/.keystore" keystorePass="xxxxx"
> type="RSA" clientAuth="false" SSLEnabled="true" sslProtocol="TLS"
>>
> </Certificate> </Connector>
You will need to set a few more attributes on the <Connector>:
SSLEnabled="true"
secure="true"
The next part depends upon your Tomcat version.
> Opened the port 8443 and recycled tomcat.
The <Connector> defined above is listening on port 8080. That is
unusual; most people would expect port 8080 to be a plaintext HTTP
port, while port 8443 would be the non-privileged HTTPS port.
Especially for testing, consider leaving the <Connector> for port 8080
as it was originally defined (without HTTPS) and configure a second
<Connector> for HTTPS on port 8443.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjNNYACgkQHPApP6U8
pFi2UQ//SPU5itX1zh/lV/ICZYTOwiSSeF8EQfxWK1bZ9jCx3Pk44AMBRMRQqjl2
HMKRH/LsSMQp5iwtVBFKbjZyjG8btNMnmREUjFkMJHoFUh1IK0WVqybpeUSnl2BH
+TdS6Z9twZd5q9/UybsJZScdgfV9IFECAM9xmG21ty92+xBqkbeSPUc62gf/A783
4P6yAYLIM3ctMHIzjwTJQ78vxTxLjsfrXvQaIC/dGefrKM6dcpxklQ/me4JNp6Lu
GajNkuEhm20u8P172rVFdqr4NgdGlLd6UP3XXeRl1BNnCvvAI9B/HsYQ1ZOZ1pDe
Zh3Jjamdx8neCBoZBCB7Pg/BmyuJ3RQRkA2w4APIMxoY7Bw0aYT2JpZdQqUaLFN+
Omzqf4pjpyFfRYlyhsTmbFviqbaIT4+XJ+SZPt4TYUuqawGp7vRJOTaQwfyJfJq+
he0XNEJWNGOzPjcdyuoJevjLONM0h7fenTAfZUUTkzmLxkMoRMSO9sIkQy46f4Z7
vG7x3MdSvrJKgWEbUSKjsCvtuYfCATf7bPk+1KJQUTMiSmk/E8OVq6q9BrcOVl1Z
NXWPHOT3rN0JBtBbZNzmBPz3yYywy5zKD6FTeBwbQDn2Z+KInfMOT7+40954PUXI
j4b4vEL1H0hunoV9hRKUHpeQbLOumITocQ6Wzd9vmo6qA1tys2U=
=lTPy
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
----------
This email has been scanned for spam and viruses. Visit the following link to report this email as spam:
https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_option=logitem&mail_id=1533228251-jk51pyRbptjj&r_address=venkataraman.srinivasan%40gcrta.org&report=1
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by Christopher Schultz <ch...@christopherschultz.net>.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
Venkataraman,
On 8/2/18 2:24 PM, Venkataraman Srinivasan wrote:
> I am using tomcat version 8.5.32
Thanks.
> I made the below entry in Server.xml
>
> <Service name="Catalina">
>
> <!--The connectors can use a shared executor, you can define one or
> more named thread pools--> <!-- <Executor name="tomcatThreadPool"
> namePrefix="catalina-exec-" maxThreads="150" minSpareThreads="4"/>
> -->
>
>
> <!-- A "Connector" represents an endpoint by which requests are
> received and responses are returned. Documentation at : Java HTTP
> Connector: /docs/config/http.html Java AJP Connector:
> /docs/config/ajp.html APR (HTTP/AJP) Connector: /docs/apr.html
> Define a non-SSL/TLS HTTP/1.1 Connector on port 8080 --> <Connector
> port="8443" protocol="HTTP/1.1" connectionTimeout="20000" />
>
>
>
>
> <Connector port="8443"
> protocol="org.apache.coyote.http11.Http11NioProtocol"
> sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementat
ion"
>
>
maxThreads="200" secure="true" scheme="https" >
> <Certificate certificateFile="/home/apexadmin/.keystore"
This is incorrect. The certificateFile attribute should point to a
PEM-encoded DER file (text file with "----BEGIN CERTIFICATE----" at
the top). You appear to be using a keystore (file name seems obvious,
plus you have a keystorePass attribute on the <Certificate>).
If you want to use a keystore, you need to use the
certificateKeystoreFile and certificateKeystorePassword attributes
instead.
> keystorePass="xxxxx" type="RSA" clientAuth="false"
> SSLEnabled="true" sslProtocol="TLS"
None of clientAuth, SSLEnabled, or sslProtocol are valid attributes of
a <Certificate> element.
clientAuth should be SSLHostConfig/@certificateVerification
SSLEnabled should be Connector/@SSLEnabled
sslProtocol should be SSLHostConfig/@sslProtocol
>>
> </Certificate> </Connector>
As John mentions, you have two connectors attempting to use the same
port, which isn't going to work. I'd remove the first one, since it's
obvious you want the second one to be the configured connector.
You also need to set SSLEnabled="true" on the <Connector>. Nothing
will work without that.
http://tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support
Also, since you are using Tomcat 8.5, you should probably be using
Tomcat 8.5 configuration style, like you can see in this next section
of the configuration guide:
http://tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support_-_S
SLHostConfig
Specifically, you should be using <SSLHostConfig> elements with
<Certificate> child elements instead of bare <Certificate> elements
within the connector.
- -chris
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Thunderbird - https://www.enigmail.net/
iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltpo1wACgkQHPApP6U8
pFhVxw//b1ErT5svW9RC2sTcpVCXTsmTG1EhnAIO1Q6dH2TFeL+SOH/v928I50Og
fiANo4SCtu3PeI7cYpbliJlufgaEQvKLn8tMNZN07GUcFSAdo0OlZHuEjBplpqSH
gqkragfZCyPzFX4byTOZzRNmVo6WLJUf5ZkaDUaxJ4gepIt6CJ2ChGqL07fnepZJ
frbd6iIv4WO1/rW+gkqPsgBVRk3+S7q6hHcAxikpu2LuNUDTM4Sq2hAhbRFaiM8r
L64c9KMNhDJB7xgWOk98wjGcRguG/bQ1GXnWzqUPcWTT2YeCGF3YBhVzu3gXG/Iy
E3HCCTN++H2wro90Rim9ZrOsZpQkqonO9nQix9CCB/hH4eTtBoU/DFhKhqO33wwv
gb8IX2xQVtqdX1ddWqCXEDenecwR6biSUYCeXfa5/zET/MI/TOqMeXSdZiv+Ygbc
7yXzFDEfW120RkbDcoM6GZ88SV/3T+XolnmQIBNOXPq9MUmt8zL0kbCPl/zgO13x
q+ACGqQ7YPVUh0mnlH3udff+79uyJxLTaQUQVYN29g7p9v7V2oKz13iHO7A5V0yc
gO7QQdOhC+qCsBugwMNcXzhVtehI68kfx6fIS4ie/yoZ/Rc7Z0qXBoiTtnJkM/Qe
oobgBvPhXEzMOQ/re20zU4v0LjjqP4jqVmLe01djmeq19BAw3D4=
=Lz/l
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: Please help me in enabling SSL certificate
Posted by John Palmer <jo...@gmail.com>.
your server.xml shows TWO connectors for port 8443; that second one (with
all the certificate entries) is then causing the errror:
> Caused by: java.net.BindException: Address already in use
As that one is probably the one you want to be using, delete or comment out
the first connector for port 8443....
On Thu, Aug 2, 2018 at 1:24 PM, Venkataraman Srinivasan <
Venkataraman.Srinivasan@gcrta.org> wrote:
>
> Hi ,
>
> I am using tomcat version 8.5.32
>
>
> I made the below entry in Server.xml
>
> <Service name="Catalina">
>
> <!--The connectors can use a shared executor, you can define one or
> more named thread pools-->
> <!--
> <Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
> maxThreads="150" minSpareThreads="4"/>
> -->
>
>
> <!-- A "Connector" represents an endpoint by which requests are
> received
> and responses are returned. Documentation at :
> Java HTTP Connector: /docs/config/http.html
> Java AJP Connector: /docs/config/ajp.html
> APR (HTTP/AJP) Connector: /docs/apr.html
> Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
> -->
> <Connector port="8443" protocol="HTTP/1.1"
> connectionTimeout="20000"
> />
>
>
>
>
> <Connector port="8443" protocol="org.apache.coyote.
> http11.Http11NioProtocol"
> sslImplementationName="org.apache.tomcat.util.net.jsse.
> JSSEImplementation"
> maxThreads="200" secure="true" scheme="https" >
> <Certificate certificateFile="/home/apexadmin/.keystore"
> keystorePass="xxxxx" type="RSA"
> clientAuth="false" SSLEnabled="true"
> sslProtocol="TLS"
> >
> </Certificate>
> </Connector>
>
> '
> When I tried to login, https://webapxt03.rta:8443, the log file
> catalina.2018-08-02.log recorded as below
>
>
> CATALINA.OUT has got entries as below
>
>
> 02-Aug-2018 14:04:24.926 SEVERE [main] org.apache.catalina.core.StandardService.initInternal
> Failed to initialize connector [Connector[HTTP/1.1-8443]]
> org.apache.catalina.LifecycleException: Failed to initialize component
> [Connector[HTTP/1.1-8443]]
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:112)
> at org.apache.catalina.core.StandardService.initInternal(
> StandardService.java:549)
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:107)
> at org.apache.catalina.core.StandardServer.initInternal(
> StandardServer.java:875)
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:107)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:632)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:655)
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
> at sun.reflect.NativeMethodAccessorImpl.invoke(
> NativeMethodAccessorImpl.java:57)
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(
> DelegatingMethodAccessorImpl.java:43)
> at java.lang.reflect.Method.invoke(Method.java:606)
> at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:309)
> at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:492)
> Caused by: org.apache.catalina.LifecycleException: Protocol handler
> initialization failed
> at org.apache.catalina.connector.Connector.initInternal(
> Connector.java:995)
> at org.apache.catalina.util.LifecycleBase.init(
> LifecycleBase.java:107)
> ... 12 more
> Caused by: java.net.BindException: Address already in use
> at sun.nio.ch.Net.bind0(Native Method)
> at sun.nio.ch.Net.bind(Net.java:444)
> at sun.nio.ch.Net.bind(Net.java:436)
> at sun.nio.ch.ServerSocketChannelImpl.bind(
> ServerSocketChannelImpl.java:214)
> at sun.nio.ch.ServerSocketAdaptor.bind(
> ServerSocketAdaptor.java:74)
> at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.
> java:210)
> at org.apache.tomcat.util.net.AbstractEndpoint.init(
> AbstractEndpoint.java:1086)
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(
> AbstractJsseEndpoint.java:268)
> at org.apache.coyote.AbstractProtocol.init(
> AbstractProtocol.java:581)
> at org.apache.coyote.http11.AbstractHttp11Protocol.init(
> AbstractHttp11Protocol.java:68)
> at org.apache.catalina.connector.Connector.initInternal(
> Connector.java:993)
> ... 13 more
>
>
> I used SSL/TLS Configuration HOW-TO of Apache Tomcat 7 document
>
>
>
> >>> Christopher Schultz <ch...@christopherschultz.net> 8/2/2018 12:44 PM
> >>>
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA256
>
> Venkataraman,
>
> On 8/2/18 12:14 PM, Venkataraman Srinivasan wrote:
> > Chris,
> >
> > Thanks for your reply. I will implement your recommendations in my
> > next iterations.
> >
> > Currently I did as below.
> >
> > I copied the keystore file as /home/apexadmin/.keystore
> >
> > and made below entry in server.xml
>
> What version of Tomcat are you using? Which part of the user guide are
> you reading? I just want to make sure you are following the right
> guide for the right version.
>
> > <Connector port="8080"
> > protocol="org.apache.coyote.http11.Http11NioProtocol"
> > maxThreads="200" redirectPort="8443" scheme="https" > <Certificate
> > certificateFile="/home/apexadmin/.keystore" keystorePass="xxxxx"
> > type="RSA" clientAuth="false" SSLEnabled="true" sslProtocol="TLS"
> >>
> > </Certificate> </Connector>
>
> You will need to set a few more attributes on the <Connector>:
>
> SSLEnabled="true"
> secure="true"
>
> The next part depends upon your Tomcat version.
>
> > Opened the port 8443 and recycled tomcat.
>
> The <Connector> defined above is listening on port 8080. That is
> unusual; most people would expect port 8080 to be a plaintext HTTP
> port, while port 8443 would be the non-privileged HTTPS port.
>
> Especially for testing, consider leaving the <Connector> for port 8080
> as it was originally defined (without HTTPS) and configure a second
> <Connector> for HTTPS on port 8443.
>
> - -chris
> -----BEGIN PGP SIGNATURE-----
> Comment: GPGTools - http://gpgtools.org
> Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/
>
> iQIzBAEBCAAdFiEEMmKgYcQvxMe7tcJcHPApP6U8pFgFAltjNNYACgkQHPApP6U8
> pFi2UQ//SPU5itX1zh/lV/ICZYTOwiSSeF8EQfxWK1bZ9jCx3Pk44AMBRMRQqjl2
> HMKRH/LsSMQp5iwtVBFKbjZyjG8btNMnmREUjFkMJHoFUh1IK0WVqybpeUSnl2BH
> +TdS6Z9twZd5q9/UybsJZScdgfV9IFECAM9xmG21ty92+xBqkbeSPUc62gf/A783
> 4P6yAYLIM3ctMHIzjwTJQ78vxTxLjsfrXvQaIC/dGefrKM6dcpxklQ/me4JNp6Lu
> GajNkuEhm20u8P172rVFdqr4NgdGlLd6UP3XXeRl1BNnCvvAI9B/HsYQ1ZOZ1pDe
> Zh3Jjamdx8neCBoZBCB7Pg/BmyuJ3RQRkA2w4APIMxoY7Bw0aYT2JpZdQqUaLFN+
> Omzqf4pjpyFfRYlyhsTmbFviqbaIT4+XJ+SZPt4TYUuqawGp7vRJOTaQwfyJfJq+
> he0XNEJWNGOzPjcdyuoJevjLONM0h7fenTAfZUUTkzmLxkMoRMSO9sIkQy46f4Z7
> vG7x3MdSvrJKgWEbUSKjsCvtuYfCATf7bPk+1KJQUTMiSmk/E8OVq6q9BrcOVl1Z
> NXWPHOT3rN0JBtBbZNzmBPz3yYywy5zKD6FTeBwbQDn2Z+KInfMOT7+40954PUXI
> j4b4vEL1H0hunoV9hRKUHpeQbLOumITocQ6Wzd9vmo6qA1tys2U=
> =lTPy
> -----END PGP SIGNATURE-----
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
> ----------
>
> This email has been scanned for spam and viruses. Visit the following link
> to report this email as spam:
> https://attseg.cloud-protect.net/index01.php?mod_id=11&mod_
> option=logitem&mail_id=1533228251-jk51pyRbptjj&r_address=venkataraman.
> srinivasan%40gcrta.org&report=1
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>