Mailing-List: contact dev-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Developers List" <dev@tomcat.apache.org>
From: bugzilla@apache.org
To: dev@tomcat.apache.org
Subject: [Bug 61445] New: Unable to start SSL using SunMSCAPI
Date: Fri, 18 Aug 2017 07:03:55 +0000
Message-ID: <bug-61445-78@https.bz.apache.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Auto-Submitted: auto-generated
MIME-Version: 1.0
archived-at: Fri, 18 Aug 2017 07:04:03 -0000

https://bz.apache.org/bugzilla/show_bug.cgi?id=3D61445

            Bug ID: 61445
           Summary: Unable to start SSL using SunMSCAPI
           Product: Tomcat 8
           Version: 8.5.20
          Hardware: PC
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Connectors
          Assignee: dev@tomcat.apache.org
          Reporter: radek.nemec@solitea.cz
  Target Milestone: ----

Created attachment 35250
  --> https://bz.apache.org/bugzilla/attachment.cgi?id=3D35250&action=3Dedit
Catalina log with SSL problem

I have this Connector in server.xml:

<Connector port=3D"8443" protocol=3D"org.apache.coyote.http11.Http11NioProt=
ocol"
maxThreads=3D"150" SSLEnabled=3D"true" scheme=3D"https" secure=3D"true">
    <SSLHostConfig truststoreProvider=3D"SunMSCAPI" truststoreType=3D"Windo=
ws-Root"
protocols=3D"+TLSv1.2,+TLSv1.1,+TLSv1">
        <Certificate certificateKeystoreProvider=3D"SunMSCAPI"
certificateKeystoreFile=3D"" certificateKeystoreType=3D"Windows-MY"
certificateKeyAlias=3D"my-web-cz" type=3D"RSA" />
    </SSLHostConfig>
</Connector>

Tomcat is running as a service under account "ServiceAccount". In Tomcat 8.=
5.14
the site is functioning normally and certificate from LocalMachine
(Windows-Root) is accessed and used.
Setting certificateKeystoreFile=3D"" is correct for SunMSCAPI, not an error,
without it the "java.lang.IllegalArgumentException: Illegal character in op=
aque
part at index 2: C:\Users\ServiceAccount/.keystore" occurs.

However after upgrading 8.5.14 to 8.5.20, this error appears in log (see
attachment for full log):

...
17-Aug-2017 16:41:45.976 INFO [main]
org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Loaded APR bas=
ed
Apache Tomcat Native library [1.2.12] using APR version [1.5.2].
17-Aug-2017 16:41:45.976 INFO [main]
org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR capabiliti=
es:
IPv6 [true], sendfile [true], accept filters [false], random [true].
17-Aug-2017 16:41:45.976 INFO [main]
org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR/OpenSSL
configuration: useAprConnector [false], useOpenSSL [true]
17-Aug-2017 16:41:46.633 INFO [main]
org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL
successfully initialized [OpenSSL 1.0.2k  26 Jan 2017]
17-Aug-2017 16:41:46.836 INFO [main] org.apache.coyote.AbstractProtocol.init
Initializing ProtocolHandler ["https-openssl-nio-8443"]
17-Aug-2017 16:41:47.398 SEVERE [main] org.apache.coyote.AbstractProtocol.i=
nit
Failed to initialize end point associated with ProtocolHandler
["https-openssl-nio-8443"]
 java.lang.IllegalArgumentException: java.security.KeyStoreException: Cannot
get key bytes, not PKCS#8 encoded
        at
org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJs=
seEndpoint.java:114)
        at
org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseE=
ndpoint.java:85)
        at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:225)
        at
org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:982)
        at
org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.j=
ava:244)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:62=
0)
        at
org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol=
.java:66)
        at
org.apache.catalina.connector.Connector.initInternal(Connector.java:997)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:1=
07)
        at
org.apache.catalina.core.StandardService.initInternal(StandardService.java:=
549)
...

--=20
You are receiving this mail because:
You are the assignee for the bug.=

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org