You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Gregor Schneider <rc...@googlemail.com> on 2008/08/29 17:16:55 UTC
APR & SSL not working
Hi there,
I'm about to give it up.
One final question though:
Anybody out there who has the following combination up & running:
- Linux (Debian preferred, other distributions also welcome)
- Tomcat 5.5
- APR
- SSL
?????
I'm sucessful getting Tomcat running together with the APR, however,
when I'm inserting the connector
<Connector port="8443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
SSLEngine="on"
SSLCertificateFile="/home/tomcat/www/certs/dom.dekold4711.crt"
SSLCertificateKeyFile="/home/tomcat/www/certs/dom.dekold4711.key"
/>
into server.xml, Tomcat-startup hangs when initializing Coyote HTTP/1.1:
2008-08-29 17:15:31,722 INFO [main]: An older
version 1.1.3 of the Apache Tomcat Native library is installed, while
Tomcat recommends versi
on greater than 1.1.4
2008-08-29 17:15:32,142 INFO [main]: Initializing
Coyote HTTP/1.1 on http-8080
However, netstat shows me that Tomcat is listening on port 8443
So, if anybody has the configuration Tomcat & APR & SSL up & running,
I'd be happy about any confirmation, otherwise I'll consider Tomcat &
APR & SSL as simply not functional.
Gregor
--
what's puzzlin' you, is the nature of my game
gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: APR & SSL not working
Posted by Gregor Schneider <rc...@googlemail.com>.
Hi Filip,
guess you're mixing things up:
Since I'm using the APR (Apache Portable Runtime), according to
http://tomcat.apache.org/tomcat-5.5-doc/apr.html,
it has to be SSLEngine="on"
(check the HTTPS-Connector)
The example given in the Tomcat-docs is
<Connector port="443" maxHttpHeaderSize="8192"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
SSLEngine="on"
SSLCertificateFile="${catalina.base}/conf/localhost.crt"
SSLCertificateKeyFile="${catalina.base}/conf/localhost.key" />
Cheers
Gregor
--
what's puzzlin' you, is the nature of my game
gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: APR & SSL not working
Posted by Filip Hanik - Dev Lists <de...@hanik.com>.
SSLEngine="on" should be SSLEnabled="true"
Gregor Schneider wrote:
> Hi there,
>
> I'm about to give it up.
>
> One final question though:
>
> Anybody out there who has the following combination up & running:
>
> - Linux (Debian preferred, other distributions also welcome)
> - Tomcat 5.5
> - APR
> - SSL
>
> ?????
>
> I'm sucessful getting Tomcat running together with the APR, however,
> when I'm inserting the connector
>
> <Connector port="8443" maxHttpHeaderSize="8192"
> maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
> enableLookups="false" disableUploadTimeout="true"
> acceptCount="100" scheme="https" secure="true"
> SSLEngine="on"
> SSLCertificateFile="/home/tomcat/www/certs/dom.dekold4711.crt"
> SSLCertificateKeyFile="/home/tomcat/www/certs/dom.dekold4711.key"
> />
>
> into server.xml, Tomcat-startup hangs when initializing Coyote HTTP/1.1:
>
> 2008-08-29 17:15:31,722 INFO [main]: An older
> version 1.1.3 of the Apache Tomcat Native library is installed, while
> Tomcat recommends versi
> on greater than 1.1.4
> 2008-08-29 17:15:32,142 INFO [main]: Initializing
> Coyote HTTP/1.1 on http-8080
>
> However, netstat shows me that Tomcat is listening on port 8443
>
> So, if anybody has the configuration Tomcat & APR & SSL up & running,
> I'd be happy about any confirmation, otherwise I'll consider Tomcat &
> APR & SSL as simply not functional.
>
> Gregor
>
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
RE: APR & SSL not working
Posted by Martin Gainty <mg...@hotmail.com>.
gregor-
i assume your implementation includes configuring AprLifecycleListener listener in server.xml
<Listener className="org.apache.catalina.core.AprLifecycleListener" />
?
Martin
______________________________________________
Disclaimer and confidentiality note
Everything in this e-mail and any attachments relates to the official business of Sender. This transmission is of a confidential nature and Sender does not endorse distribution to any party other than intended recipient. Sender does not necessarily endorse content contained within this transmission.
> Date: Fri, 29 Aug 2008 17:16:55 +0200
> From: rc46fi@googlemail.com
> To: users@tomcat.apache.org
> Subject: APR & SSL not working
>
> Hi there,
>
> I'm about to give it up.
>
> One final question though:
>
> Anybody out there who has the following combination up & running:
>
> - Linux (Debian preferred, other distributions also welcome)
> - Tomcat 5.5
> - APR
> - SSL
>
> ?????
>
> I'm sucessful getting Tomcat running together with the APR, however,
> when I'm inserting the connector
>
> <Connector port="8443" maxHttpHeaderSize="8192"
> maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
> enableLookups="false" disableUploadTimeout="true"
> acceptCount="100" scheme="https" secure="true"
> SSLEngine="on"
> SSLCertificateFile="/home/tomcat/www/certs/dom.dekold4711.crt"
> SSLCertificateKeyFile="/home/tomcat/www/certs/dom.dekold4711.key"
> />
>
> into server.xml, Tomcat-startup hangs when initializing Coyote HTTP/1.1:
>
> 2008-08-29 17:15:31,722 INFO [main]: An older
> version 1.1.3 of the Apache Tomcat Native library is installed, while
> Tomcat recommends versi
> on greater than 1.1.4
> 2008-08-29 17:15:32,142 INFO [main]: Initializing
> Coyote HTTP/1.1 on http-8080
>
> However, netstat shows me that Tomcat is listening on port 8443
>
> So, if anybody has the configuration Tomcat & APR & SSL up & running,
> I'd be happy about any confirmation, otherwise I'll consider Tomcat &
> APR & SSL as simply not functional.
>
> Gregor
> --
> what's puzzlin' you, is the nature of my game
> gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
> gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
>
> ---------------------------------------------------------------------
> To start a new topic, e-mail: users@tomcat.apache.org
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
_________________________________________________________________
Get thousands of games on your PC, your mobile phone, and the web with Windows®.
http://clk.atdmt.com/MRT/go/108588800/direct/01/
Re: APR & SSL not working
Posted by Gregor Schneider <rc...@googlemail.com>.
Hi Marcus,
On Mon, Sep 1, 2008 at 4:56 PM, Markus Schönhaber
<to...@list-post.mks-mail.de> wrote:
>
> Is the libtcnative your Tomcat uses really linked against your self-compiled
> version of APR (ldd to check)?
>
looks as if you're becoming my personal hero...
I just had the development-headers of the APR installed, meaning the
APR was the pre-compiled Debian-version.
Now I've downloaded the APR-sources, compiled them with
./configure --with-devrandom=/dev/urandom
make && make install
Really a big, big thanks for helping me to make it work!
Gregor
--
what's puzzlin' you, is the nature of my game
gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: APR & SSL not working
Posted by Markus Schönhaber <to...@list-post.mks-mail.de>.
Gregor Schneider wrote:
> seems I was a bit too optimistic...
>
> although I compiled APR with /dev/urandomPLUS creating $HOME/.rnd
> (changed 2048 to 4096 since this is the value specified in
> /proc/sys/kernal/poolsize), it's again taking ages to start up tomcat.
AFAIK is /dev/urandom guaranteed not to block. If initializing the HTTPS
connector takes very long nevertheless, I'd make sure that /dev/urandom
is indeed used - and not /dev/random. You could, for example, use lsof
to check.
Is the libtcnative your Tomcat uses really linked against your
self-compiled version of APR (ldd to check)?
> Do you know of any additional option to speed up the process of
> creating some entropy?
I'm not sure, but maybe a lot of activity generated in a ssh session
might help too.
Regards
mks
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: APR & SSL not working
Posted by Gregor Schneider <rc...@googlemail.com>.
Hi Markus,
seems I was a bit too optimistic...
although I compiled APR with /dev/urandomPLUS creating $HOME/.rnd
(changed 2048 to 4096 since this is the value specified in
/proc/sys/kernal/poolsize), it's again taking ages to start up tomcat.
Since this is a server-machine where I just can't "move the mouse or
hack the keyboard" to create some entropy, I'm again stuck here.
Do you know of any additional option to speed up the process of
creating some entropy?
Since we're stuck to Tomcat 5.5, unfortunately Tomcat 6 with the new
config is not an option.
Cheers
Gregor
--
what's puzzlin' you, is the nature of my game
gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: APR & SSL not working
Posted by Markus Schönhaber <to...@list-post.mks-mail.de>.
Gregor Schneider wrote:
> The solution was:
>
> - create an .rnd-file within the user-space:
>
> openssl rand -out $HOME/.rnd 2048
>
> - compile the APR with /dev/urandom:
>
> ./configure --with-apr=/usr/bin/apr-1-config \\
> --with-devrandom=/dev/urandom \\
> --prefix=/home/tomcat/www/lib
>
> make && make install
>
> Now it seems to work like charm.
If you configure APR to use /dev/urandom, creating a static ranndom file
shouldn't be necessary.
BTW: in Tomcat 6 (starting with 6.0.17?) the AprLifecycleListener
supports the attribute SSLRandomSeed:
<http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html#Edit%20the%20Tomcat%20Configuration%20File>
This is supposed to set the random source used by APR. As I understand
it (haven't tried it myself) one should be able to set this, for
example, to /dev/urandom or a static random file and speed things up
even if APR was compiled with /dev/random as default random source.
Regards
mks
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: APR & SSL not working
Posted by Gregor Schneider <rc...@googlemail.com>.
Hi Markus,
On Fri, Aug 29, 2008 at 5:52 PM, Markus Schönhaber
<to...@list-post.mks-mail.de> wrote:
> Gregor Schneider schrieb:
>
> Search the list archives. There has more than once been discussion about
> this topic. For example
> http://marc.info/?l=tomcat-user&m=118190563608389&w=2
> Maybe this helps.
>
actually it did, thanks a lot for the hint.
The solution was:
- create an .rnd-file within the user-space:
openssl rand -out $HOME/.rnd 2048
- compile the APR with /dev/urandom:
./configure --with-apr=/usr/bin/apr-1-config \\
--with-devrandom=/dev/urandom \\
--prefix=/home/tomcat/www/lib
make && make install
Now it seems to work like charm.
Again, thanks for shedding some light..
Gregor
--
what's puzzlin' you, is the nature of my game
gpgp-fp: 79A84FA526807026795E4209D3B3FE028B3170B2
gpgp-key available @ http://pgpkeys.pca.dfn.de:11371
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: APR & SSL not working
Posted by Markus Schönhaber <to...@list-post.mks-mail.de>.
Gregor Schneider schrieb:
> Anybody out there who has the following combination up & running:
>
> - Linux (Debian preferred, other distributions also welcome)
> - Tomcat 5.5
> - APR
> - SSL
Yes.
> into server.xml, Tomcat-startup hangs when initializing Coyote HTTP/1.1:
>
> 2008-08-29 17:15:31,722 INFO [main]: An older
> version 1.1.3 of the Apache Tomcat Native library is installed, while
> Tomcat recommends versi
> on greater than 1.1.4
> 2008-08-29 17:15:32,142 INFO [main]: Initializing
> Coyote HTTP/1.1 on http-8080
>
> However, netstat shows me that Tomcat is listening on port 8443
If these are the last lines of your log, that's to be expected.
Otherwise the log would contain info about http-8443.
How long did you wait? Chances are, APR is using /dev/random and the
system has run out of entropy.
Search the list archives. There has more than once been discussion about
this topic. For example
http://marc.info/?l=tomcat-user&m=118190563608389&w=2
Maybe this helps.
Regards
mks
---------------------------------------------------------------------
To start a new topic, e-mail: users@tomcat.apache.org
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org