Tomcat and https on Windows 7

[Imre Tokai]

Hello,

How to configure basic https access on Tomcat?

Downloaded and installed apache-tomcat-6.0.29-windows-x86.zip
and i'm about to configure basic https://localhost:8443 access via browser;
1)
get the .keystore file with changeit password via jdk's
keytool... command from command line
2)
Uncommented the https 8443 config in server.xml and added properties keystoreFile="e:\.keystore" keystorePass="changeit"

    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystoreFile="e:\.keystore" keystorePass="changeit" />

When tried to run startup.bat i get exception:

  
Aug 2, 2010 7:29:12 PM org.apache.catalina.core.AprLifecycleListener init
INFO: Loaded APR based Apache Tomcat Native library 1.1.20.
Aug 2, 2010 7:29:12 PM org.apache.catalina.core.AprLifecycleListener init
INFO: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], ra
ndom [true].
Aug 2, 2010 7:29:12 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'clie
ntAuth' to 'false' did not find a matching property.
Aug 2, 2010 7:29:12 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'keys
toreFile' to 'e:\.keystore' did not find a matching property.
Aug 2, 2010 7:29:12 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'keys
torePass' to 'changeit' did not find a matching property.
Aug 2, 2010 7:29:13 PM org.apache.coyote.http11.Http11AprProtocol init
INFO: Initializing Coyote HTTP/1.1 on http-8080
Aug 2, 2010 7:29:13 PM org.apache.coyote.http11.Http11AprProtocol init
SEVERE: Error initializing endpoint
java.lang.Exception: No Certificate file specified or invalid file format
        at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
        at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:721)
        at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.jav
a:107)

Did this configuration without any trouble a while ago on earlier versions of Tomcat. Has anything changed in newer versions?


Regards

[Imre Tokai]

Am i using wrong certificate? Any (other) hints?
Anyone on this topic, please?


Regards

[Jaikiran Pai]

Imre Tokai wrote:

    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystoreFile="e:\.keystore" keystorePass="changeit" />

When tried to run startup.bat i get exception:

  
...
Aug 2, 2010 7:29:12 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'clie
ntAuth' to 'false' did not find a matching property.
Aug 2, 2010 7:29:12 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'keys
toreFile' to 'e:\.keystore' did not find a matching property.
Aug 2, 2010 7:29:12 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'keys
torePass' to 'changeit' did not find a matching property.

Try changing the protocol attribute value to "org.apache.coyote.http11.Http11NioProtocol".

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystoreFile="e:\.keystore" keystorePass="changeit" />

For more details, refer to http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html#Configuration

[Rene Larsen]

You could try to generate your own certificate - and then see if this one will work.

It is working on my Tomcat 7 server, with my own home generated certificate

keytool -v -genkey -alias <SOME_ALIAS> -keyalg RSA -keysize 2048 -sigalg SHA1withRSA -keypass <THE_PASSWD> \
        -keystore <THE_KEYSTORE_NAME> -storepass <THE_PASSWD> -storetype jks -validity 3650 \
        -dname "cn=<NAME>, ou=Java Software Code Signing, o=<ORGINIZATION>, l=<CITY>, c=<LAND_CODE e.g. US>"

Replace the <..> with your own values...

[Imre Tokai]

Working indeed thanks a lot Rene!

Which (not self-signed) certificate is recommended for this usage of Tomcat? Any experience with commercial certificates?


Regards

[Rene Larsen]

You should be able to buy a SSL Certificate from http://www.verisign.com/

[sinoob ts]

check for org.apache.catalina.core.AprLifecycleListener in the server.xml and comment that line.