You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by "Neil B. Cohen" <nc...@verisign.com> on 2008/11/20 14:45:04 UTC

SSL setup question

I'm having a problem setting up SSL with Tomcat. The situation is this:

I have a system running IBM's Netcool/Portal software. We added SSL to 
the Portal a while back. I created a certificate for the machine.
However, Netcool/Portal does not create a keystore file - you simply 
copy the certificate as a text file into a specific directory and it 
works from there. Netcool/Portal has its own version of the JDK.

Now, on the same machine, I have installed a current JDK (v1.6) and my 
own installation of Tomcat (v6.0.16). Runs just fine on port 8080.
I want to add SSL capability to the Tomcat setup so I can talk to it 
using https. I created a keystore file using the certificate we 
generated for Netcool, as follows:

keytool -importcert -v -trustcacerts -alias tomcat -keystore 
<path_to_keystore>/keystore.kdb -file 
/opt/netcool/portal/<path_to_cert>/server.crt

Then,

keytool -list -keystore ./keystore.kdb
Enter keystore password:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

tomcat, Nov 20, 2008, trustedCertEntry,
Certificate fingerprint (MD5): 
11:87:A8:7C:BB:55:AC:68:46:34:4F:45:7D:62:9C:AF

So I have a keystore. I set up the tomcat server.xml file:

<Connector port="7443" protocol="HTTP/1.1" SSLEnabled="true"
                 maxThreads="150"
                 scheme="https"
                 secure="true"
                 clientAuth="false"
                 keystoreFile="/usr/<path_to_keystore>/keystore.kdb"
                 keystorePass="<password>"
                 sslProtocol="TLS" />

And when I start Tomcat, I get an infinite loop in the log file that 
looks like:
Nov 20, 2008 1:40:17 PM org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8080
Nov 20, 2008 1:40:17 PM org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-7443
Nov 20, 2008 1:40:17 PM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 886 ms
Nov 20, 2008 1:40:17 PM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
Nov 20, 2008 1:40:17 PM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.16
Nov 20, 2008 1:40:18 PM com.sun.faces.config.ConfigureListener 
contextInitialize
d
INFO: Initializing Sun's JavaServer Faces implementation 
(1.2_04-b20-p03) for co
ntext '/NCAdmin'
Nov 20, 2008 1:40:20 PM org.apache.catalina.core.StandardContext 
addApplicationL
istener
INFO: The listener "listeners.ContextListener" is already configured for 
this co
ntext. The duplicate definition has been ignored.
Nov 20, 2008 1:40:20 PM org.apache.catalina.core.StandardContext 
addApplicationL
istener
INFO: The listener "listeners.SessionListener" is already configured for 
this co
ntext. The duplicate definition has been ignored.
Nov 20, 2008 1:40:20 PM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8080
Nov 20, 2008 1:40:20 PM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-7443
Nov 20, 2008 1:40:20 PM org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
SEVERE: Socket accept failed
java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException: 
No avai
lable certificate or key corresponds to the SSL cipher suites which are 
enabled.
         at 
org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESo
cketFactory.java:150)
         at 
org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:
310)
         at java.lang.Thread.run(Thread.java:619)
Nov 20, 2008 1:40:20 PM org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
SEVERE: Socket accept failed
java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException: 
No avai
lable certificate or key corresponds to the SSL cipher suites which are 
enabled.
         at 
org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESo
cketFactory.java:150)
         at 
org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:
310)
         at java.lang.Thread.run(Thread.java:619)
Nov 20, 2008 1:40:20 PM org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
SEVERE: Socket accept failed
java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException: 
No avai
lable certificate or key corresponds to the SSL cipher suites which are 
enabled.
         at 
org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESo
cketFactory.java:150)
         at 
org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:
310)
         at java.lang.Thread.run(Thread.java:619)
Nov 20, 2008 1:40:20 PM org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
SEVERE: Socket accept failed

I'm not an SSL expert, so I'm not sure where to look. Am I missing an 
intermediate certificate somewhere? Or have I
configured the keystore incorrectly? I'd appreciate any pointers or 
suggestions for
getting this running.

Thanks very much,

nbc

NAME:   Neil B. Cohen (Verisign Inc.)
PHONE:  703-948-4471
DOMAIN: ncohen@verisign.com
*************************************************************
* Murphy's Philosophy: Smile - tomorrow will be worse...    *
*                                                           *
* O'Tooles Commentary: Murphy was an optimist!              *
*************************************************************




---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org

Re: SSL setup question

Posted by Filip Hanik - Dev Lists <de...@hanik.com>.
the infinite loop is fixed in 6.0.18,
the system will still not start, since the JVM you're running with 
doesn't support the type of cipher that you're keystore is trying to use

search http://tomcat.markmail.org for the same error, it's been answered 
before

Filip

Neil B. Cohen wrote:
> I'm having a problem setting up SSL with Tomcat. The situation is this:
>
> I have a system running IBM's Netcool/Portal software. We added SSL to 
> the Portal a while back. I created a certificate for the machine.
> However, Netcool/Portal does not create a keystore file - you simply 
> copy the certificate as a text file into a specific directory and it 
> works from there. Netcool/Portal has its own version of the JDK.
>
> Now, on the same machine, I have installed a current JDK (v1.6) and my 
> own installation of Tomcat (v6.0.16). Runs just fine on port 8080.
> I want to add SSL capability to the Tomcat setup so I can talk to it 
> using https. I created a keystore file using the certificate we 
> generated for Netcool, as follows:
>
> keytool -importcert -v -trustcacerts -alias tomcat -keystore 
> <path_to_keystore>/keystore.kdb -file 
> /opt/netcool/portal/<path_to_cert>/server.crt
>
> Then,
>
> keytool -list -keystore ./keystore.kdb
> Enter keystore password:
>
> Keystore type: JKS
> Keystore provider: SUN
>
> Your keystore contains 1 entry
>
> tomcat, Nov 20, 2008, trustedCertEntry,
> Certificate fingerprint (MD5): 
> 11:87:A8:7C:BB:55:AC:68:46:34:4F:45:7D:62:9C:AF
>
> So I have a keystore. I set up the tomcat server.xml file:
>
> <Connector port="7443" protocol="HTTP/1.1" SSLEnabled="true"
>                 maxThreads="150"
>                 scheme="https"
>                 secure="true"
>                 clientAuth="false"
>                 keystoreFile="/usr/<path_to_keystore>/keystore.kdb"
>                 keystorePass="<password>"
>                 sslProtocol="TLS" />
>
> And when I start Tomcat, I get an infinite loop in the log file that 
> looks like:
> Nov 20, 2008 1:40:17 PM org.apache.coyote.http11.Http11Protocol init
> INFO: Initializing Coyote HTTP/1.1 on http-8080
> Nov 20, 2008 1:40:17 PM org.apache.coyote.http11.Http11Protocol init
> INFO: Initializing Coyote HTTP/1.1 on http-7443
> Nov 20, 2008 1:40:17 PM org.apache.catalina.startup.Catalina load
> INFO: Initialization processed in 886 ms
> Nov 20, 2008 1:40:17 PM org.apache.catalina.core.StandardService start
> INFO: Starting service Catalina
> Nov 20, 2008 1:40:17 PM org.apache.catalina.core.StandardEngine start
> INFO: Starting Servlet Engine: Apache Tomcat/6.0.16
> Nov 20, 2008 1:40:18 PM com.sun.faces.config.ConfigureListener 
> contextInitialize
> d
> INFO: Initializing Sun's JavaServer Faces implementation 
> (1.2_04-b20-p03) for co
> ntext '/NCAdmin'
> Nov 20, 2008 1:40:20 PM org.apache.catalina.core.StandardContext 
> addApplicationL
> istener
> INFO: The listener "listeners.ContextListener" is already configured 
> for this co
> ntext. The duplicate definition has been ignored.
> Nov 20, 2008 1:40:20 PM org.apache.catalina.core.StandardContext 
> addApplicationL
> istener
> INFO: The listener "listeners.SessionListener" is already configured 
> for this co
> ntext. The duplicate definition has been ignored.
> Nov 20, 2008 1:40:20 PM org.apache.coyote.http11.Http11Protocol start
> INFO: Starting Coyote HTTP/1.1 on http-8080
> Nov 20, 2008 1:40:20 PM org.apache.coyote.http11.Http11Protocol start
> INFO: Starting Coyote HTTP/1.1 on http-7443
> Nov 20, 2008 1:40:20 PM 
> org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
> SEVERE: Socket accept failed
> java.net.SocketException: SSL handshake 
> errorjavax.net.ssl.SSLException: No avai
> lable certificate or key corresponds to the SSL cipher suites which 
> are enabled.
>         at 
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESo
> cketFactory.java:150)
>         at 
> org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:
> 310)
>         at java.lang.Thread.run(Thread.java:619)
> Nov 20, 2008 1:40:20 PM 
> org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
> SEVERE: Socket accept failed
> java.net.SocketException: SSL handshake 
> errorjavax.net.ssl.SSLException: No avai
> lable certificate or key corresponds to the SSL cipher suites which 
> are enabled.
>         at 
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESo
> cketFactory.java:150)
>         at 
> org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:
> 310)
>         at java.lang.Thread.run(Thread.java:619)
> Nov 20, 2008 1:40:20 PM 
> org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
> SEVERE: Socket accept failed
> java.net.SocketException: SSL handshake 
> errorjavax.net.ssl.SSLException: No avai
> lable certificate or key corresponds to the SSL cipher suites which 
> are enabled.
>         at 
> org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESo
> cketFactory.java:150)
>         at 
> org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:
> 310)
>         at java.lang.Thread.run(Thread.java:619)
> Nov 20, 2008 1:40:20 PM 
> org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
> SEVERE: Socket accept failed
>
> I'm not an SSL expert, so I'm not sure where to look. Am I missing an 
> intermediate certificate somewhere? Or have I
> configured the keystore incorrectly? I'd appreciate any pointers or 
> suggestions for
> getting this running.
>
> Thanks very much,
>
> nbc
>
> NAME:   Neil B. Cohen (Verisign Inc.)
> PHONE:  703-948-4471
> DOMAIN: ncohen@verisign.com
> *************************************************************
> * Murphy's Philosophy: Smile - tomorrow will be worse...    *
> *                                                           *
> * O'Tooles Commentary: Murphy was an optimist!              *
> *************************************************************
>
>
>
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>


---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org