CODEWITHSUNDEEP
tomcatsslpem
brohjoe
brohjoe

Reputation: 934

Tomcat security key warnings

I'm getting an error running Tomcat 9.0.0.M20. It's looking for a localhost-rsa-key.pem key. Can someone explain how to do this? I can't find direct information on the web regarding this; however I did follow Tomcat's documentation which stated that a .keystore file needed to be created and placed inside the /conf directory, which I did, but I think it wants a localhost-rsa-key.pem file.

Here is the error log:

c:\apache-tomcat-9.0.0.M20\bin>catalina.bat run
Using CATALINA_BASE:   "c:\apache-tomcat-9.0.0.M20"
Using CATALINA_HOME:   "c:\apache-tomcat-9.0.0.M20"
Using CATALINA_TMPDIR: "c:\apache-tomcat-9.0.0.M20\temp"
Using JRE_HOME:        "C:\Program Files\Java\jdk1.8.0_121"
Using CLASSPATH:       "c:\apache-tomcat-9.0.0.M20\bin\bootstrap.jar;c:\apache-tomcat-9.0.0.M20\bin\tomcat-juli.jar"
18-Jul-2018 16:01:06.851 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server version:        Apache Tomcat/9.0.0.M20
18-Jul-2018 16:01:06.880 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server built:          Apr 12 2017 19:27:10 UTC
18-Jul-2018 16:01:06.882 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server number:         9.0.0.0
18-Jul-2018 16:01:06.883 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name:               Windows 10
18-Jul-2018 16:01:06.884 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version:            10.0
18-Jul-2018 16:01:06.885 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture:          amd64
18-Jul-2018 16:01:06.885 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home:             C:\Program Files\Java\jdk1.8.0_121\jre
18-Jul-2018 16:01:06.886 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version:           1.8.0_121-b13
18-Jul-2018 16:01:06.886 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor:            Oracle Corporation
18-Jul-2018 16:01:06.889 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_BASE:         C:\apache-tomcat-9.0.0.M20
18-Jul-2018 16:01:06.889 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA_HOME:         C:\apache-tomcat-9.0.0.M20
18-Jul-2018 16:01:06.890 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.config.file=c:\apache-tomcat-9.0.0.M20\conf\logging.properties
18-Jul-2018 16:01:06.898 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager
18-Jul-2018 16:01:06.899 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djdk.tls.ephemeralDHKeySize=2048
18-Jul-2018 16:01:06.900 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.protocol.handler.pkgs=org.apache.catalina.webresources
18-Jul-2018 16:01:06.900 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.base=c:\apache-tomcat-9.0.0.M20
18-Jul-2018 16:01:06.901 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.home=c:\apache-tomcat-9.0.0.M20
18-Jul-2018 16:01:06.902 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.io.tmpdir=c:\apache-tomcat-9.0.0.M20\temp
18-Jul-2018 16:01:06.903 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Loaded APR based Apache Tomcat Native library [1.2.12] using APR version [1.5.2].
18-Jul-2018 16:01:06.903 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
18-Jul-2018 16:01:06.904 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR/OpenSSL configuration: useAprConnector [false], useOpenSSL [true]
18-Jul-2018 16:01:08.020 INFO [main] org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL successfully initialized [OpenSSL 1.0.2k  26 Jan 2017]
18-Jul-2018 16:01:08.478 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"]
18-Jul-2018 16:01:09.152 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
18-Jul-2018 16:01:09.178 INFO [main] org.apache.coyote.http11.AbstractHttp11Protocol.configureUpgradeProtocol The ["https-openssl-apr-8443"] connector has been configured to support negotiation to [h2] via ALPN
18-Jul-2018 16:01:09.180 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["https-openssl-apr-8443"]
18-Jul-2018 16:01:09.209 WARNING [main] org.apache.tomcat.util.net.SSLHostConfig.adjustRelativePath configured file:[C:\apache-tomcat-9.0.0.M20\conf/localhost-rsa-cert.pem] does not exist.
18-Jul-2018 16:01:09.308 WARNING [main] org.apache.tomcat.util.net.SSLHostConfig.adjustRelativePath configured file:[C:\apache-tomcat-9.0.0.M20\conf/localhost-rsa-cert.pem] does not exist.
18-Jul-2018 16:01:09.347 WARNING [main] org.apache.tomcat.util.net.SSLHostConfig.adjustRelativePath configured file:[C:\apache-tomcat-9.0.0.M20\conf/localhost-rsa-key.pem] does not exist.
18-Jul-2018 16:01:09.351 SEVERE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to initialize component [Connector[org.apache.coyote.http11.Http11AprProtocol-8443]]
 org.apache.catalina.LifecycleException: Protocol handler initialization failed
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:942)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
        at org.apache.catalina.core.StandardService.initInternal(StandardService.java:530)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
        at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:875)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:607)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:630)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:311)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:494)
Caused by: java.lang.Exception: Unable to load certificate key C:\apache-tomcat-9.0.0.M20\conf/localhost-rsa-key.pem (error:02001002:system library:fopen:No such file or directory)
        at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
        at org.apache.tomcat.util.net.AprEndpoint.createSSLContext(AprEndpoint.java:494)
        at org.apache.tomcat.util.net.AprEndpoint.bind(AprEndpoint.java:373)
        at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:950)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:573)
        at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:70)
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:939)
        ... 13 more

18-Jul-2018 16:01:09.356 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"]
18-Jul-2018 16:01:09.371 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read
18-Jul-2018 16:01:09.375 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 4308 ms
18-Jul-2018 16:01:09.465 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina]
18-Jul-2018 16:01:09.466 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/9.0.0.M20
18-Jul-2018 16:01:09.509 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [C:\apache-tomcat-9.0.0.M20\webapps\docs]
18-Jul-2018 16:01:10.741 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [C:\apache-tomcat-9.0.0.M20\webapps\docs] has finished in [1,232] ms
18-Jul-2018 16:01:10.745 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [C:\apache-tomcat-9.0.0.M20\webapps\examples]
18-Jul-2018 16:01:12.873 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [C:\apache-tomcat-9.0.0.M20\webapps\examples] has finished in [2,128] ms
18-Jul-2018 16:01:12.874 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [C:\apache-tomcat-9.0.0.M20\webapps\host-manager]
18-Jul-2018 16:01:13.030 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [C:\apache-tomcat-9.0.0.M20\webapps\host-manager] has finished in [155] ms
18-Jul-2018 16:01:13.033 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [C:\apache-tomcat-9.0.0.M20\webapps\manager]
18-Jul-2018 16:01:13.164 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [C:\apache-tomcat-9.0.0.M20\webapps\manager] has finished in [131] ms
18-Jul-2018 16:01:13.189 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [C:\apache-tomcat-9.0.0.M20\webapps\ROOT]
18-Jul-2018 16:01:13.287 INFO [main] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [C:\apache-tomcat-9.0.0.M20\webapps\ROOT] has finished in [98] ms
18-Jul-2018 16:01:13.317 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["http-nio-8080"]
18-Jul-2018 16:01:13.352 INFO [main] org.apache.coyote.AbstractProtocol.start Starting ProtocolHandler ["ajp-nio-8009"]
18-Jul-2018 16:01:13.367 INFO [main] org.apache.catalina.startup.Catalina.start Server startup in 3973 ms

Upvotes: 1

Views: 2108

Answers (1)

Sazzadur Rahaman
Sazzadur Rahaman

Reputation: 7126

If it wants localhost-rsa-key.pem file then you must have mentioned it somewhere in the configuration. In that case, you should generate and place one accordingly [1][2]. If you want to stick with the default configuration then just remove that part from the configuration.

Specifically, to use default configuration,

(1) You should run $JAVA_HOME/bin/keytool -genkey -alias tomcat -keyalg RSA to create the .keystore file with tomcat alias.

Typically, the .keystore the file should be located in the user's home directory (not in /conf directory). Also, the default password should be changeit (You should change the default password).

(2) Enable the following lines in server.xml file.

 <Connector
   protocol="org.apache.coyote.http11.Http11NioProtocol"
   port="8443" maxThreads="200"
   scheme="https" secure="true" SSLEnabled="true"
   clientAuth="false" sslProtocol="TLS"/>

If you customize the password or the location of the .keystore file you have to mention it in your Connector like below,

<Connector
       protocol="org.apache.coyote.http11.Http11NioProtocol"
       port="8443" maxThreads="200"
       scheme="https" secure="true" SSLEnabled="true"
       keystoreFile="${user.home}/.keystore" keystorePass="changeit"
       clientAuth="false" sslProtocol="TLS"/>

If you want to use the certificate and the corresponding key file, then you should update the Connector like below,

 <Connector
       protocol="org.apache.coyote.http11.Http11AprProtocol"
       port="8443" maxThreads="200"
       scheme="https" secure="true" SSLEnabled="true"
       SSLCertificateFile="/usr/local/ssl/server.crt"
       SSLCertificateKeyFile="/usr/local/ssl/server.pem"
       SSLVerifyClient="optional" SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"/>
  • [1] Here is how the Java keytool works.
  • [2] Here is how you should customize the default configuration in Tomcat.

Upvotes: 3

Related Questions