You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2016/07/29 09:08:31 UTC
[Bug 59910] New: certificateKeyAlias required to be set
https://bz.apache.org/bugzilla/show_bug.cgi?id=59910
Bug ID: 59910
Summary: certificateKeyAlias required to be set
Product: Tomcat 8
Version: 8.5.x-trunk
Hardware: All
OS: All
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: mike@normi.net
The documentation states that certificateKeyAlias is optional, and that "If not
specified, the first key read from the keystore will be used". It seems that
since r1713277, the default of this variable is set to "tomcat", which leads to
the following exception if the name of the certificate is different:
> java.lang.IllegalArgumentException: java.io.IOException: Alias name tomcat does not identify a key entry
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:103)
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:81)
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59910] certificateKeyAlias required to be set
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59910
--- Comment #3 from Mike Noordermeer <mi...@normi.net> ---
I wouldn't be too happy with that, as most people are not even aware of the
fact that a PFX can contain multiple certificates and keys. And in that case it
would probably be better to require the user to set a certificateKeyAlias,
instead of relying on the default 'tomcat'.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59910] certificateKeyAlias required to be set
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59910
--- Comment #1 from Mike Noordermeer <mi...@normi.net> ---
Btw, this is with JSSE and a PFX certificate containing only one entry.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59910] certificateKeyAlias required to be set
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59910
--- Comment #4 from Remy Maucherat <re...@apache.org> ---
Thanks for the feedback, but I disagree with that. All of our current examples
and howtos use "tomcat" as key alias, and "changeit" as password (it is the
hardcoded default, just like "tomcat" is hardcoded again - I think it used to
be this way sometime in the past).
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59910] certificateKeyAlias required to be set
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59910
Remy Maucherat <re...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #6 from Remy Maucherat <re...@apache.org> ---
Ok, I experimented and the inconsistency seems acceptable and there's no
hardcoding when not needed. It will be included in 9.0.0.M10 and 8.5.5.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59910] certificateKeyAlias required to be set
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59910
--- Comment #2 from Remy Maucherat <re...@apache.org> ---
This was changed since it's a lot harder to do properly with OpenSSL and so it
needs an alias name. For consistency, it could be best to keep the new default
for both JSSE and OpenSSL, and fix the documentation.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 59910] certificateKeyAlias required to be set
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=59910
--- Comment #5 from Mike Noordermeer <mi...@normi.net> ---
That may be the case, but a PFX file almost always has a password, so people
set the password. Nobody knows what the key alias is though (and nobody
specifies the name when creating the PFX). This is just going from my
experience with the sysadmins we work with, and maybe these sysadmins are to
blame, but I think this new 'feature' (or more precisely, the removal of the
automatic key alias detection feature) worsens the user experience.
If it's really difficult with OpenSSL, I can understand the change, but it's
still a shame.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org