Mailing-List: contact user-help@geronimo.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@geronimo.apache.org
Received-SPF: pass (athena.apache.org: domain of kevan.miller@gmail.com
 designates 209.85.221.18 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:from:to:in-reply-to:content-type
         :content-transfer-encoding:mime-version:subject:date:references
         :x-mailer;
        b=YphoYKwFu2ITAYu/Vt5lJT3mGAoDqvgMvfxCKQXhQbUSmTcnarNTEDH5gWPVWHFaqC
         o37NbxuM0ocqP8fnZcNrEJpTIUKKjff3aaj8rArVVrV/CneNxf507BBW6cZJZLQVm4Rn
         c55g4dcw+1EsRMgOeTLzHm1LE54ubEzDB0DWg=
Message-Id: <E14C5F36-4941-4660-989E-4AFD3F5B4DCA@gmail.com>
From: Kevan Miller <kevan.miller@gmail.com>
To: user@geronimo.apache.org
In-Reply-To: <b6525da10812011618t408578e5vc73b3d2231295213@mail.gmail.com>
Content-Type: text/plain; charset=US-ASCII; format=flowed; delsp=yes
Content-Transfer-Encoding: 7bit
Mime-Version: 1.0 (Apple Message framework v929.2)
Subject: Re: Geronimo, keystores and SSL
Date: Thu, 4 Dec 2008 15:38:03 -0500
References: <b6525da10812011618t408578e5vc73b3d2231295213@mail.gmail.com>


On Dec 1, 2008, at 7:18 PM, Christian Svensson wrote:

> Hello!
>
> I've been trying for the better part of today getting keystores to  
> automatically unlock on startup - with very limited success.
> Is there something that I should know about keystore password / key  
> password? Digging around some old mailing list threads said  
> something about key password must be equal to keystore password -  
> any more of those gotchas?
>
> The problem is that I create (or change password on geronimo-default  
> for that matter) a new keystore, assign SSL to use the certificate  
> and restart the server:
> org.apache.geronimo.management.geronimo.KeystoreIsLocked: Keystore  
> 'plasma-ssl' is locked; please use the keystore page in the admin  
> console to unlock it
>         at  
> org 
> .apache 
> .geronimo 
> .security 
> .keystore 
> .FileKeystoreManager.createSSLContext(FileKeystoreManager.java:343)
>         at  
> org 
> .apache 
> .geronimo 
> .jetty6 
> .connector 
> .GeronimoSelectChannelSSLListener 
> .createSSLContext(GeronimoSelectChannelSSLListener.java:54)
>
>
> Resetting the SSL connector to using geronimo-default / geronimo  
> with secret / secret as passwords makes it work again - but why on  
> earth doesn't Geronimo unlock my keystores on startup? I mean, it  
> saves the password (or something like it) in config.xml.

Hmm. I recall an issue similar to this. Can't say that I've tried it,  
either. Hoping that maybe Vamsi can offer some advice?

--kevan