InvalidAlgorithmParameterException：从 Tomcat 7 升级时，trustAnchors 参数必须为非空

Question

I have gone through several questions and answers regarding this but still unable to fix the issue.

I am upgrading from Tomcat 7 to 8.5. I have copied the server.xml, web.xml and context.xml from the old server to the new one. The only change I made is commenting the following line from server.xml

<!--Listener className="org.apache.catalina.core.JasperListener" /-->

Connector port specification is as follows:

<Connector port="50000" protocol="org.apache.coyote.http11.Http11Protocol"
           SSLEnabled="true" acceptCount="100" debug="0" maxProcessors="75"
           minProcessors="5" server="Server for App" clientAuth="false"
           sslProtocol="TLS"  maxThreads="150" scheme="https" secure="true"
           sslEnabledProtocols="TLSv1.2" keystoreFile="/location/keystore.p12"
           truststoreType="PKCS12" keystoreType="PKCS12" keystorePass="***"
           truststoreFile="/location/keystore.p12" truststorePass="***"
           ciphers="***" connectionTimeout="60000" />

Starting Tomcat produces the following error:

    SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[org.apache.coyote.http11.Http11Protocol-50000]]
            org.apache.catalina.LifecycleException: Protocol handler initialization failed
                    at org.apache.catalina.connector.Connector.initInternal(Connector.java:1076)
                    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                    at org.apache.catalina.core.StandardService.initInternal(StandardService.java:552)
                    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                    at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:846)
                    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                    at org.apache.catalina.startup.Catalina.load(Catalina.java:639)
                    at org.apache.catalina.startup.Catalina.load(Catalina.java:662)
                    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
                    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
                    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
                    at java.lang.reflect.Method.invoke(Method.java:498)
                    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:302)
                    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472)
            Caused by: java.lang.IllegalArgumentException: the trustAnchors parameter must be non-empty
                    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:100)
                    at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:72)
                    at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:247)
                    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1143)
                    at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:222)
                    at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:599)
                    at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:80)
                    at org.apache.catalina.connector.Connector.initInternal(Connector.java:1074)
                    ... 13 more
            Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
                    at java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
                    at java.security.cert.PKIXParameters.<init>(PKIXParameters.java:157)
                    at java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:130)
                    at org.apache.tomcat.util.net.SSLUtilBase.getParameters(SSLUtilBase.java:501)
                    at org.apache.tomcat.util.net.SSLUtilBase.getTrustManagers(SSLUtilBase.java:432)
                    at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:245)
                    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:98)
                    ... 20 more

Setting -Djavax.net.debug=all did not produce much additional clue.

I believe this has something to do with certificates but if I run the old Tomcat 7 with the same settings, it works just fine. Any help is much appreciated.

Answer 1

Turns out the keystore requires a TrustedCertEntry and it only has a PrivateKeyEntry. I imported one global trusted certificate using keytool and the issue is resolved.