You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Carl <ca...@etrak-plus.com> on 2009/12/15 19:18:54 UTC
SSL problem
Fresh Tomact 6.0.20 install on a new Slackware (version 13 - 64bit) linux box. Access to 8080 works fine but neither 8443 nor 443 work. I believe 443 and 8443 are up because a nmap gives:
Discovered open port 443/tcp on 127.0.0.1
Discovered open port 8080/tcp on 127.0.0.1
Discovered open port 8443/tcp on 127.0.0.1
The relevant portions of server.xml are:
<snip>
<Connector port="8443" maxHttpHeaderSize="8192"
maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="/usr/local/certs/tomcat_keystore.ks" keystorePass="jellybean"/>
<Connector port="443" maxHttpHeaderSize="8192"
maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="/usr/local/certs/tomcat_keystore.ks" keystorePass="jellybean"/>
</snip>
The cert is from Thawte and has been used in an existing server for the past year:
root@tomcat2:/usr/local/certs#
-rw-r--r-- 1 root root 2493 2008-12-12 17:33 tomcat_keystore.ks
Yes, I have googled (for the last day) and found many ideas but nothing seems to fit so I am asking if anyone sees anything that might be the cause.
TIA,
Carl
Re: SSL problem
Posted by Carl <ca...@etrak-plus.com>.
Chuck,
When I try to go to either 8443 or 443, with:
https://10.10.10.30/ or https://10.10.10.30:8443/
I get the following:
Secure Connection Failed
An error occurred during a connection to 10.10.10.30.
SSL received a record that exceeded the maximum permissible length.
(Error code: ssl_error_rx_record_too_long)
* The page you are trying to view can not be shown because the
authenticity of the received data could not be verified.
* Please contact the web site owners to inform them of this problem.
Alternatively, use the command found in the help menu to report this broken
site.
but when I use https://10.10.10.30:8080/, I get the Tomcat page.
nstat -an gives nothing, no output.
The entire server.xml is: (rather large as I haven't started pruning out
the things I don't need):
<?xml version='1.0' encoding='utf-8'?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Note: A "Server" is not itself a "Container", so you may not
define subcomponents such as "Valves" at this level.
Documentation at /docs/config/server.html
-->
<Server port="8005" shutdown="SHUTDOWN">
<!--APR library loader. Documentation at /docs/apr.html -->
<Listener className="org.apache.catalina.core.AprLifecycleListener"
SSLEngine="on" />
<!--Initialize Jasper prior to webapps are loaded. Documentation at
/docs/jasper-howto.html -->
<Listener className="org.apache.catalina.core.JasperListener" />
<!-- JMX Support for the Tomcat server. Documentation at
/docs/non-existent.html -->
<Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
<Listener
className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<!-- A "Service" is a collection of one or more "Connectors" that share
a single "Container" Note: A "Service" is not itself a "Container",
so you may not define subcomponents such as "Valves" at this level.
Documentation at /docs/config/service.html
-->
<Service name="Catalina">
<!--The connectors can use a shared executor, you can define one or more
named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="150" minSpareThreads="4"/>
-->
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL HTTP/1.1 Connector on port 8080
-->
<Connector port="8080" protocol="HTTP/1.1"
maxHttpHeaderSize="8192"
maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" redirectPort="8443" scheme="http" acceptCount="100"
connectionTimeout="20000" disableUploadTimeout="true" />
<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
-->
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<Connector port="8443" maxHttpHeaderSize="8192"
maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="/usr/local/certs/tomcat_keystore.ks"
keystorePass="jellybean"/>
<!-- Define a SSL HTTP/1.1 Connector on port 443 -->
<Connector port="443" maxHttpHeaderSize="8192"
maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
keystoreFile="/usr/local/certs/tomcat_keystore.ks"
keystorePass="jellybean"/>
<!--
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
-->
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009"
enableLookups="false" redirectPort="443" protocol="AJP/1.3" />
<!-- An Engine represents the entry point (within Catalina) that processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- The request dumper valve dumps useful debugging information about
the request and response data received and sent by Tomcat.
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.valves.RequestDumperValve"/>
-->
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
<!-- Define the default virtual host
Note: XML Schema validation will not work with Xerces 2.2.
-->
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true" deployOnStartup="true"
xmlValidation="false" xmlNamespaceAware="false">
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.valves.AccessLogValve"
directory="logs"
prefix="localhost_access_log." suffix=".txt" pattern="common"
resolveHosts="false"/>
-->
</Host>
</Engine>
</Service>
</Server
I don't think I am using APR. Here is the startup from catalina.out:
Dec 15, 2009 2:43:02 PM org.apache.catalina.core.AprLifecycleListener init
INFO: The APR based Apache Tomcat Native library which allows optimal
performanc
e in production environments was not found on the java.library.path:
/usr/lib64/
java/lib/amd64/server:/usr/lib64/java/lib/amd64:/usr/lib64/java/../lib/amd64:/us
r/java/packages/lib/amd64:/lib:/usr/lib
Dec 15, 2009 2:43:02 PM org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8080
Dec 15, 2009 2:43:02 PM org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8443
Dec 15, 2009 2:43:02 PM org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-443
Dec 15, 2009 2:43:02 PM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 550 ms
Dec 15, 2009 2:43:02 PM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
Dec 15, 2009 2:43:02 PM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.20
RequestFilter initialized
RequestFilter initialized
RequestFilter initialized
Dec 15, 2009 2:43:04 PM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8080
Dec 15, 2009 2:43:05 PM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8443
Dec 15, 2009 2:43:05 PM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-443
Dec 15, 2009 2:43:05 PM org.apache.jk.common.ChannelSocket init
INFO: JK: ajp13 listening on /0.0.0.0:8009
Dec 15, 2009 2:43:05 PM org.apache.jk.server.JkMain start
Hope this helps solve the mystery.
TIA,
Carl
----- Original Message -----
From: "Caldarale, Charles R" <Ch...@unisys.com>
To: "Tomcat Users List" <us...@tomcat.apache.org>
Sent: Tuesday, December 15, 2009 1:26 PM
Subject: RE: SSL problem
> From: Carl [mailto:carl@etrak-plus.com]
> Subject: SSL problem
>
> Access to 8080 works fine but neither 8443 nor 443 work.
What does that mean? Does Tomcat return a message saying "not working"? (I
doubt it.)
> I believe 443 and 8443 are up because a nmap gives:
Do a netstat -an while Tomcat is running and make sure it's actually
listening on those ports.
> The relevant portions of server.xml are:
> <snip>
Did you perhaps snip out the comment marker that the default server.xml has
around the SSL <Connector>? Post all of your server.xml.
Are you using the APR library (probably named tcnative-1.so in Tomcat's bin
directory)? If so, the SSL configuration is quite different.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY
MATERIAL and is thus for use only by the intended recipient. If you received
this in error, please contact the sender and delete the e-mail and its
attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: SSL problem
Posted by "Caldarale, Charles R" <Ch...@unisys.com>.
> From: Carl [mailto:carl@etrak-plus.com]
> Subject: SSL problem
>
> Access to 8080 works fine but neither 8443 nor 443 work.
What does that mean? Does Tomcat return a message saying "not working"? (I doubt it.)
> I believe 443 and 8443 are up because a nmap gives:
Do a netstat -an while Tomcat is running and make sure it's actually listening on those ports.
> The relevant portions of server.xml are:
> <snip>
Did you perhaps snip out the comment marker that the default server.xml has around the SSL <Connector>? Post all of your server.xml.
Are you using the APR library (probably named tcnative-1.so in Tomcat's bin directory)? If so, the SSL configuration is quite different.
- Chuck
THIS COMMUNICATION MAY CONTAIN CONFIDENTIAL AND/OR OTHERWISE PROPRIETARY MATERIAL and is thus for use only by the intended recipient. If you received this in error, please contact the sender and delete the e-mail and its attachments from all computers.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL problem
Posted by Carl <ca...@etrak-plus.com>.
Mark and Chuck,
I am so embarrassed, I should have caught that. It works properly with that
one little addition.
You guys (and others also) provide so much help. All I can say is thanks.
Carl
----- Original Message -----
From: "Mark Thomas" <ma...@apache.org>
To: "Tomcat Users List" <us...@tomcat.apache.org>
Sent: Tuesday, December 15, 2009 1:28 PM
Subject: Re: SSL problem
> On 15/12/2009 18:18, Carl wrote:
>> <Connector port="443" maxHttpHeaderSize="8192"
>> maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
>> enableLookups="false" disableUploadTimeout="true"
>> acceptCount="100" scheme="https" secure="true"
>> clientAuth="false" sslProtocol="TLS"
>> keystoreFile="/usr/local/certs/tomcat_keystore.ks"
>> keystorePass="jellybean"/>
>
> You are missing SSLEnabled="true" to tell Tomcat to actually use SSL for
> that connector.
>
> Mark
>
>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL problem
Posted by Mark Thomas <ma...@apache.org>.
On 15/12/2009 18:18, Carl wrote:
> <Connector port="443" maxHttpHeaderSize="8192"
> maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
> enableLookups="false" disableUploadTimeout="true"
> acceptCount="100" scheme="https" secure="true"
> clientAuth="false" sslProtocol="TLS"
> keystoreFile="/usr/local/certs/tomcat_keystore.ks" keystorePass="jellybean"/>
You are missing SSLEnabled="true" to tell Tomcat to actually use SSL for
that connector.
Mark
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: SSL problem
Posted by André Warnier <aw...@ice-sa.com>.
Carl wrote:
> Fresh Tomact 6.0.20 install on a new Slackware (version 13 - 64bit) linux box.
Access to 8080 works fine but neither 8443 nor 443 work.
Can you define "does not work" ?
What error are you seeing ?
- is it a failure to even connect to that port on the server ?
- or do you get a Tomcat error page as a response ?
I believe 443 and 8443 are up because a nmap gives:
>
> Discovered open port 443/tcp on 127.0.0.1
> Discovered open port 8080/tcp on 127.0.0.1
> Discovered open port 8443/tcp on 127.0.0.1
Try on the server : netstat -pan
and verify that the process associated with each of the ports is really
Tomcat, or something else.
>
> The relevant portions of server.xml are:
>
> <snip>
>
> <Connector port="8443" maxHttpHeaderSize="8192"
> maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
> enableLookups="false" disableUploadTimeout="true"
> acceptCount="100" scheme="https" secure="true"
> clientAuth="false" sslProtocol="TLS"
> keystoreFile="/usr/local/certs/tomcat_keystore.ks" keystorePass="jellybean"/>
>
> <Connector port="443" maxHttpHeaderSize="8192"
> maxThreads="600" minSpareThreads="25" maxSpareThreads="75"
> enableLookups="false" disableUploadTimeout="true"
> acceptCount="100" scheme="https" secure="true"
> clientAuth="false" sslProtocol="TLS"
> keystoreFile="/usr/local/certs/tomcat_keystore.ks" keystorePass="jellybean"/>
>
> </snip>
>
These look OK (to me), provided that they do not have <!-- ... --> tags
around them. (Neither really your <snip>..</snip> tags above).
Come on, do check. It is a frequent enough error.
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org