Unable to start Tomcat in SSL mode?

[Kumar Raja]

Hello All,

I'm trying to setup SSL mode in Tomcat and followed the documentation given in Apache site. But unforutunately I could not start it in https. Could you please advice what I'm missing here.

server.xml

    
<?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
  <GlobalNamingResources>
    <Resource auth="Container" description="User database that can be updated and saved" factory="org.apache.catalina.users.MemoryUserDatabaseFactory"  name="UserDatabase" pathname="conf/tomcat-users.xml" type="org.apache.catalina.UserDatabase"/>
  </GlobalNamingResources>
  <Service name="Catalina">
  
    <!--The connectors can use a shared executor, you can define one or more named thread pools-->
    <!--
    <Executor name="tomcatThreadPool" namePrefix="catalina-exec-" 
        maxThreads="150" minSpareThreads="4"/>
    -->
    
    
    <!-- A "Connector" represents an endpoint by which requests are received
         and responses are returned. Documentation at :
         Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
         Java AJP  Connector: /docs/config/ajp.html
         APR (HTTP/AJP) Connector: /docs/apr.html
         Define a non-SSL HTTP/1.1 Connector on port 8080
    -->
    <!--  <Connector connectionTimeout="20000" port="8080" protocol="HTTP/1.1" redirectPort="8443"/>-->
    <!-- A "Connector" using the shared thread pool-->
    <!--
    <Connector executor="tomcatThreadPool"
               port="8080" protocol="HTTP/1.1" 
               connectionTimeout="20000" 
               redirectPort="8443" />
    -->           
    <!-- Define a SSL HTTP/1.1 Connector on port 8443
         This connector uses the JSSE configuration, when using APR, the 
         connector should be using the OpenSSL style configuration
         described in the APR documentation -->
    
    <!-- Define a blocking Java SSL Coyote HTTP/1.1 Connector on port 8443 -->
[size=18][color=darkred]    <Connector protocol="org.apache.coyote.http11.Http11Protocol" 
               port="8443" 
               SSLEnabled="true"
               scheme="https" 
               secure="true"
               clientAuth="false" 
               sslProtocol="TLS"
               minSpareThreads="5"
               maxSpareThreads="75"
               enableLookups="true"
               disableUploadTimeout="true"
               acceptCount="100"
               maxThreads="150"
               keystoreFile="${user.home}/.keystore"
               keystorePass="changeit"
               />[/color][/size]
    

    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443"/>


    <!-- An Engine represents the entry point (within Catalina) that processes
         every request.  The Engine implementation for Tomcat stand alone
         analyzes the HTTP headers included with the request, and passes them
         on to the appropriate Host (virtual host).
         Documentation at /docs/config/engine.html -->

    <!-- You should set jvmRoute to support load-balancing via AJP ie :
    <Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">         
    --> 
    <Engine defaultHost="localhost" name="Catalina">

      <!--For clustering, please take a look at documentation at:
          /docs/cluster-howto.html  (simple how to)
          /docs/config/cluster.html (reference documentation) -->
      <!--
      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
      -->        

      <!-- The request dumper valve dumps useful debugging information about
           the request and response data received and sent by Tomcat.
           Documentation at: /docs/config/valve.html -->
      <!--
      <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
      -->

      <!-- This Realm uses the UserDatabase configured in the global JNDI
           resources under the key "UserDatabase".  Any edits
           that are performed against this UserDatabase are immediately
           available for use by the Realm.  -->
      <Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>

      <!-- Define the default virtual host
           Note: XML Schema validation will not work with Xerces 2.2.
       -->
      <Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true" xmlNamespaceAware="false" xmlValidation="false">

        <!-- SingleSignOn valve, share authentication between web applications
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
        -->

        <!-- Access log processes all example.
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  
               prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
        -->

      </Host>
    </Engine>
  </Service>
</Server>

I also have my keystore created using keytool and provided the path in server.xml

After the restart of the server, when I try to access https://localhost:8443 I get page can not be displayed.

When I look into the logs

    
[size=18][color=darkred]Aug 20, 2010 2:23:06 PM org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8080[/color][/size]
Aug 20, 2010 2:23:06 PM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 321 ms
Aug 20, 2010 2:23:06 PM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
Aug 20, 2010 2:23:06 PM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.29
Aug 20, 2010 2:23:06 PM org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deploying configuration descriptor host-manager.xml
Aug 20, 2010 2:23:06 PM org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deploying configuration descriptor manager.xml
Aug 20, 2010 2:23:06 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory docs
Aug 20, 2010 2:23:06 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory examples
Aug 20, 2010 2:23:06 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory ROOT
Aug 20, 2010 2:23:06 PM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8080
Aug 20, 2010 2:23:06 PM org.apache.jk.common.ChannelSocket init
INFO: JK: ajp13 listening on /0.0.0.0:8009
Aug 20, 2010 2:23:06 PM org.apache.jk.server.JkMain start
INFO: Jk running ID=0 time=0/16  config=null
Aug 20, 2010 2:23:06 PM org.apache.catalina.startup.Catalina start
INFO: Server startup in 445 ms

I see that the protocol specified in server.xml is used but, not sure why it is not starting in https mode.

Any advice.

[Kumar Raja]

Any help ?

[Rene Larsen]

The server didn't start up with SSL - are you sure that you did save your server.xml, and it was in the right one you did the changes ??

You should get this output in the server log - where you can see that both 8080 and 8443 is started:

Aug 22, 2010 9:36:28 AM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8080
Aug 22, 2010 9:36:28 AM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8443
Aug 22, 2010 9:36:28 AM org.apache.jk.common.ChannelSocket init
INFO: JK: ajp13 listening on /0.0.0.0:8009

[Kumar Raja]

Ok,

I thought I saved the changes I made to server.xml, but in fact not. Now I saved my changes, copied JSSE libraries (jcert.jar,jnet.jar,jsse.jar) to TOMCAT_HOME/lib location and have my Keystore copied to $USER.HOME as mentioned in server.xml. But after I restarted the Tomcat, I'm getting below exception

    
Aug 23, 2010 10:27:28 AM org.apache.catalina.core.AprLifecycleListener init
INFO: The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: C:\DevCenter\Sun\jdk1.6.0_21\bin;.;C:\WINDOWS\Sun\Java\bin;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\PROGRAM FILES\1E\SMSNOMAD\;C:\Program Files\Windows Imaging\;C:\WINDOWS\system32\nls;C:\WINDOWS\system32\nls\ENGLISH;C:\DevCenter\Sun\jdk1.6.0_21\bin;
Aug 23, 2010 10:27:36 AM org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8080
Aug 23, 2010 10:27:36 AM org.apache.coyote.http11.Http11Protocol init
SEVERE: Error initializing endpoint
java.io.IOException: Cannot recover key
	at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:465)
	at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)
	at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
	at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
	at org.apache.catalina.connector.Connector.initialize(Connector.java:1014)
	at org.apache.catalina.core.StandardService.initialize(StandardService.java:680)
	at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:548)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
	at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Aug 23, 2010 10:27:36 AM org.apache.catalina.startup.Catalina load
SEVERE: Catalina.start
LifecycleException:  Protocol handler initialization failed: java.io.IOException: Cannot recover key
	at org.apache.catalina.connector.Connector.initialize(Connector.java:1016)
	at org.apache.catalina.core.StandardService.initialize(StandardService.java:680)
	at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:795)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:524)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:548)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
	at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Aug 23, 2010 10:27:36 AM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 8026 ms
Aug 23, 2010 10:27:36 AM org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
Aug 23, 2010 10:27:36 AM org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.29
Aug 23, 2010 10:27:36 AM org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deploying configuration descriptor host-manager.xml
Aug 23, 2010 10:27:36 AM org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deploying configuration descriptor manager.xml
Aug 23, 2010 10:27:36 AM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory docs
Aug 23, 2010 10:27:37 AM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory examples
Aug 23, 2010 10:27:37 AM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory ROOT
Aug 23, 2010 10:27:37 AM org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8080
Aug 23, 2010 10:27:37 AM org.apache.coyote.http11.Http11Protocol start
SEVERE: Error starting endpoint
java.io.IOException: Cannot recover key
	at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:465)
	at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:130)
	at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
	at org.apache.tomcat.util.net.JIoEndpoint.start(JIoEndpoint.java:565)
	at org.apache.coyote.http11.Http11Protocol.start(Http11Protocol.java:203)
	at org.apache.catalina.connector.Connector.start(Connector.java:1087)
	at org.apache.catalina.core.StandardService.start(StandardService.java:534)
	at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
	at org.apache.catalina.startup.Catalina.start(Catalina.java:581)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
	at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)
Aug 23, 2010 10:27:37 AM org.apache.catalina.startup.Catalina start
SEVERE: Catalina.start: 
LifecycleException:  service.getName(): "Catalina";  Protocol handler start failed: java.io.IOException: Cannot recover key
	at org.apache.catalina.connector.Connector.start(Connector.java:1094)
	at org.apache.catalina.core.StandardService.start(StandardService.java:534)
	at org.apache.catalina.core.StandardServer.start(StandardServer.java:710)
	at org.apache.catalina.startup.Catalina.start(Catalina.java:581)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:597)
	at org.apache.catalina.startup.Bootstrap.start(Bootstrap.java:289)
	at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:414)
Aug 23, 2010 10:27:37 AM org.apache.catalina.startup.Catalina start
INFO: Server startup in 1228 ms

What could I be missing here?

My server.xml is as follows

    
<?xml version='1.0' encoding='utf-8'?>
<Server port="8005" shutdown="SHUTDOWN">
  <GlobalNamingResources>
    <Resource name="UserDatabase" auth="Container"
              type="org.apache.catalina.UserDatabase"
              description="User database that can be updated and saved"
              factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
              pathname="conf/tomcat-users.xml" />
  </GlobalNamingResources>
  <Service name="Catalina">
    <Connector port="8080" protocol="HTTP/1.1" 
               connectionTimeout="20000" 
               redirectPort="8443" />
    <!--
    <Connector executor="tomcatThreadPool"
               port="8080" protocol="HTTP/1.1" 
               connectionTimeout="20000" 
               redirectPort="8443" />
    -->           
    <!-- Define a SSL HTTP/1.1 Connector on port 8443
         This connector uses the JSSE configuration, when using APR, the 
         connector should be using the OpenSSL style configuration
         described in the APR documentation -->
    <!--
    <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />
    -->
    <Connector protocol="org.apache.coyote.http11.Http11Protocol" 
               port="8443" 
               SSLEnabled="true"
               scheme="https" 
               secure="true"
               clientAuth="false" 
               sslProtocol="TLS"
               minSpareThreads="5"
               maxSpareThreads="75"
               enableLookups="true"
               disableUploadTimeout="true"
               acceptCount="100"
               maxThreads="150"
               keystoreFile="${user.home}/.keystore"
               keystorePass="changeit"
               />

    <!-- Define an AJP 1.3 Connector on port 8009 -->
    <Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
    <Engine name="Catalina" defaultHost="localhost">

      <!--For clustering, please take a look at documentation at:
          /docs/cluster-howto.html  (simple how to)
          /docs/config/cluster.html (reference documentation) -->
      <!--
      <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
      -->        
      <!--
      <Valve className="org.apache.catalina.valves.RequestDumperValve"/>
      -->

      <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
             resourceName="UserDatabase"/>

      <!-- Define the default virtual host
           Note: XML Schema validation will not work with Xerces 2.2.
       -->
      <Host name="localhost"  appBase="webapps"
            unpackWARs="true" autoDeploy="true"
            xmlValidation="false" xmlNamespaceAware="false">

        <!-- SingleSignOn valve, share authentication between web applications
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
        -->

        <!-- Access log processes all example.
             Documentation at: /docs/config/valve.html -->
        <!--
        <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"  
               prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
        -->

      </Host>
    </Engine>
  </Service>
</Server>

[Kumar Raja]

I think I got this straightened. My keystore and private key passwords were not matching and Tomcat documentation has a clear explanation on this, which I have not looked into earlier.

Now I'm able to run my tomcat in https..