[英]ssl tomcat certificate error
I followed the following steps at http://www.globalsign.com/support/install/install_tomcat.php , using the following entry in server.xml
: 我使用
server.xml
的以下条目在http://www.globalsign.com/support/install/install_tomcat.php上执行了以下步骤:
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
keystoreFile="D:\Tomcat\ukdp.keystore" keystorePass="123456" keyAlias="ukdp"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
But the following exception occurs during startup: 但是在启动期间发生以下异常:
SEVERE: Error initializing endpoint
java.io.IOException: Alias name ukdp does not identify a key entry
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:412)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:378)
at
org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:125)
at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:496)
at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:177)
at org.apache.catalina.connector.Connector.initialize(Connector.java:1059)
at org.apache.catalina.core.StandardService.initialize(StandardService.java:677)
at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:792)
at org.apache.catalina.startup.Catalina.load(Catalina.java:518)
at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:260)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:412)
Mar 14, 2011 4:14:56 PM org.apache.catalina.startup.Catalina load
When I remove the keyAlias
entry as follows: 当我删除
keyAlias
条目时,如下所示:
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
keystoreFile="D:\Tomcat\ukdp.keystore" keystorePass="123456"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
The following exception occurs during startup: 启动期间发生以下异常:
SEVERE: Socket accept failed
java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled.
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESocketFactory.java:150)
at org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:310)
at java.lang.Thread.run(Unknown Source)
Mar 14, 2011 4:20:31 PM org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
SEVERE: Socket accept failed
java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled.
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.acceptSocket(JSSESocketFactory.java:150)
at org.apache.tomcat.util.net.JIoEndpoint$Acceptor.run(JIoEndpoint.java:310)
at java.lang.Thread.run(Unknown Source)
Mar 14, 2011 4:20:31 PM org.apache.tomcat.util.net.JIoEndpoint$Acceptor run
SEVERE: Socket accept failed
List the entires in the keystore using 使用列出密钥库中的entires
keytool -list -keystore D:\Tomcat\ukdp.keystore -storepass 123456
If the entry isn't there, you need to import it as a PrivateKeyEntry . 如果该条目不存在,则需要将其作为PrivateKeyEntry导入。 If it's there, see that it's type is PrivateKeyEntry and not trustedCertEntry .
如果它在那里,请看它的类型是PrivateKeyEntry而不是trustedCertEntry 。
If the type is trustedCertEntry and you want to change it, the process I found is as follows: 如果类型是trustedCertEntry并且您想要更改它,我找到的过程如下:
#Convert to the key type to pkcs12
openssl pkcs12 -export -inkey myserverkey.key -in myserver.crt -out tempstore.p12
#Import to keystore:
keytool -importkeystore -srckeystore tempstore.p12 -srcstoretype PKCS12 -destkeystore keystore.jks
#List:
keytool -list -v -keystore keystore.jks
#Note the alias, usually gets "1", we need to change it
#Change alias:
keytool -changealias -alias 1 -destalias mywantedkeyalias -keystore keystore.jks
With the obvious changes of myserverkey.key , myserver.crt , keystore.jks and mywantedkeyalias 随着myserverkey.key , myserver.crt , keystore.jks和mywantedkeyalias的明显变化
What's in your keystore for a start. 什么在你的密钥库中开始。
keytool -list -keystore D:\Tomcat\ukdp.keystore -storepass 123456
If there is really no "udkp" key here's your problem. 如果真的没有“udkp”键这就是你的问题。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.