tomcat和apr中的SSL配置

Question

我在使用apr native lib设置我的tomcat时遇到问题，我有以下内容：

Tomcat: 7.0.42
Java: 1.7.0_40-b43
OS: Centos 6.4 (2.6.32-358.18.1.el6.i686)
APR: 1.3.9
Native lib: 1.1.27
OpenSSL: openssl-1.0.0-27.el6_4.2.i686

我的server.xml看起来像：

...
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" />
...
<Connector port="8443" protocol="HTTP/1.1"
SSLEnabled="true" maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS"
SSLCertificateFile="/tmp/monitoringPortalCert.pem"
SSLCertificateKeyFile="/tmp/monitoringPortalKey.pem"
SSLPassword="hide"
/>
...

我编译了本机库，如下所示：

./configure --with-apr=/usr/bin/apr-1-config --with-ssl=yes --prefix=$CATALINA_HOME 
make && make install

APR加载好了：

Oct 06, 2013 7:55:14 PM org.apache.catalina.core.AprLifecycleListener init
INFO: Loaded APR based Apache Tomcat Native library 1.1.27 using APR version 1.3.9.

但我仍然有这个错误：

SEVERE: Failed to initialize the SSLEngine.
org.apache.tomcat.jni.Error: 70023: This function has not been implemented on this  platform

你们能帮忙了解我的错误在哪里吗？ 我错过了什么？

在此先感谢您的支持。

---

感谢评论Mark，下面是./configure / make && make install results：./ configure

[root@localhost native]# ./configure --with-apr=/usr/bin/apr-1-config --with-ssl=yes --    prefix=$CATALINA_HOME && make && make install
checking build system type... i686-pc-linux-gnu
checking host system type... i686-pc-linux-gnu
checking target system type... i686-pc-linux-gnu
checking for a BSD-compatible install... /usr/bin/install -c
checking for working mkdir -p... yes
Tomcat Native Version: 1.1.27
checking for chosen layout... tcnative
checking for APR... yes
  setting CC to "gcc"
  setting CPP to "gcc -E"
checking for JDK location (please wait)... /usr/java/jdk1.7.0_40 from environment
checking Java platform... checking Java platform...
checking for sablevm... NONE
  adding "-I/usr/java/jdk1.7.0_40/include" to TCNATIVE_PRIV_INCLUDES
checking os_type directory...  linux
  adding "-I/usr/java/jdk1.7.0_40/include/linux" to TCNATIVE_PRIV_INCLUDES
checking for gcc... gcc
checking whether the C compiler works... yes
checking for C compiler default output file name... a.out
checking for suffix of executables...
checking whether we are cross compiling... no
checking for suffix of object files... o
checking whether we are using the GNU C compiler... yes
checking whether gcc accepts -g... yes
checking for gcc option to accept ISO C89... none needed
checking for OpenSSL library... using openssl from /usr/lib and /usr/include
checking OpenSSL library version... ok
checking for OpenSSL DSA support... yes
  setting TCNATIVE_LDFLAGS to "-lssl -lcrypto"
  adding "-DHAVE_OPENSSL" to CFLAGS
  setting TCNATIVE_LIBS to ""
  setting TCNATIVE_LIBS to " /usr/lib/libapr-1.la  -lpthread"
configure: creating ./config.status
config.status: creating tcnative.pc
config.status: creating Makefile
config.status: executing default commands
make[1]: Entering directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-    src/jni/native'
make[1]: Nothing to be done for `local-all'.
make[1]: Leaving directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-    src/jni/native'
make[1]: Entering directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-   src/jni/native'
make[1]: Nothing to be done for `local-all'.
make[1]: Leaving directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-  src/jni/native'
/usr/lib/apr-1/build/mkdir.sh /usr/apache-tomcat-7.0.42/include/apr-1 /usr/apache-   tomcat-7.0.42/lib/pkgconfig \
                 /usr/apache-tomcat-7.0.42/lib /usr/apache-tomcat-7.0.42/bin
/usr/bin/install -c -m 644 tcnative.pc /usr/apache-tomcat-7.0.42/lib/pkgconfig/tcnative-  1.pc
list=''; for i in $list; do \
            ( cd $i ; make DESTDIR= install ); \
    done
/bin/sh /usr/lib/apr-1/build/libtool --mode=install /usr/bin/install -c -m 755     libtcnative-1.la /usr/apache-tomcat-7.0.42/lib
libtool: install: /usr/bin/install -c -m 755 .libs/libtcnative-1.so.0.1.27 /usr/apache-    tomcat-7.0.42/lib/libtcnative-1.so.0.1.27
libtool: install: (cd /usr/apache-tomcat-7.0.42/lib && { ln -s -f libtcnative-  1.so.0.1.27 libtcnative-1.so.0 || { rm -f libtcnative-1.so.0 && ln -s libtcnative-   1.so.0.1.27 libtcnative-1.so.0; }; })
libtool: install: (cd /usr/apache-tomcat-7.0.42/lib && { ln -s -f libtcnative-   1.so.0.1.27 libtcnative-1.so || { rm -f libtcnative-1.so && ln -s libtcnative-1.so.0.1.27   libtcnative-1.so; }; })
libtool: install: /usr/bin/install -c -m 755 .libs/libtcnative-1.lai /usr/apache-tomcat-  7.0.42/lib/libtcnative-1.la
libtool: install: /usr/bin/install -c -m 755 .libs/libtcnative-1.a /usr/apache-tomcat-   7.0.42/lib/libtcnative-1.a
libtool: install: chmod 644 /usr/apache-tomcat-7.0.42/lib/libtcnative-1.a
libtool: install: ranlib /usr/apache-tomcat-7.0.42/lib/libtcnative-1.a
libtool: install: warning: remember to run `libtool --finish /usr/local/apr/lib'

make && make install：

make[1]: Entering directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-   src/jni/native'
make[1]: Nothing to be done for `local-all'.
make[1]: Leaving directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-  src/jni/native'
make[1]: Entering directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-   src/jni/native'
make[1]: Nothing to be done for `local-all'.
make[1]: Leaving directory `/usr/apache-tomcat-7.0.42/bin/tomcat-native-1.1.27-   src/jni/native'
/usr/lib/apr-1/build/mkdir.sh /usr/apache-tomcat-7.0.42/include/apr-1 /usr/apache-   tomcat-7.0.42/lib/pkgconfig \
                 /usr/apache-tomcat-7.0.42/lib /usr/apache-tomcat-7.0.42/bin
/usr/bin/install -c -m 644 tcnative.pc /usr/apache-tomcat-7.0.42/lib/pkgconfig/tcnative- 1.pc
list=''; for i in $list; do \
            ( cd $i ; make DESTDIR= install ); \
    done
/bin/sh /usr/lib/apr-1/build/libtool --mode=install /usr/bin/install -c -m 755     libtcnative-1.la /usr/apache-tomcat-7.0.42/lib
libtool: install: /usr/bin/install -c -m 755 .libs/libtcnative-1.so.0.1.27 /usr/apache-  tomcat-7.0.42/lib/libtcnative-1.so.0.1.27
libtool: install: (cd /usr/apache-tomcat-7.0.42/lib && { ln -s -f libtcnative-   1.so.0.1.27 libtcnative-1.so.0 || { rm -f libtcnative-1.so.0 && ln -s libtcnative-  1.so.0.1.27 libtcnative-1.so.0; }; })
libtool: install: (cd /usr/apache-tomcat-7.0.42/lib && { ln -s -f libtcnative-  1.so.0.1.27 libtcnative-1.so || { rm -f libtcnative-1.so && ln -s libtcnative-1.so.0.1.27    libtcnative-1.so; }; })
libtool: install: /usr/bin/install -c -m 755 .libs/libtcnative-1.lai /usr/apache-tomcat-  7.0.42/lib/libtcnative-1.la
libtool: install: /usr/bin/install -c -m 755 .libs/libtcnative-1.a /usr/apache-tomcat-  7.0.42/lib/libtcnative-1.a
libtool: install: chmod 644 /usr/apache-tomcat-7.0.42/lib/libtcnative-1.a
libtool: install: ranlib /usr/apache-tomcat-7.0.42/lib/libtcnative-1.a
libtool: install: warning: remember to run `libtool --finish /usr/local/apr/lib'

似乎一切都很好，但错误并不是不言自明的

Answer 1

我也遇到了确切的问题。 问题是它没有检测到正确安装的本机库。

当您安装本机库时，首先安装它们。

对于Ubuntu：sudo apt-get install libapr1-dev libssl-dev

这些库是必需的而不是libtcnative。 成功安装后，以这种方式配置您的应用程序。

sudo ./configure --with-apr=`which apr-1-config` --with-java-home=$JAVA_HOME --with-ssl=yes --prefix=$CATALINA_HOME

这里CATALINA_HOME是您设置的tomcat主页或直接使用/ opt / apache_tomcat_version

然后

sudo make
sudo make install

安装完成后，它将更新您已将文件库放入tomcat的lib文件夹中。

像这样配置你的setenv

export LD_LIBRARY_PATH=/opt/apache-tomcat-7.0.42/lib:$LD_LIBRARY_PATH

重启你的tomcat，你们都完成了！

干杯

Answer 2

返回并查看./configure的结果，因为它看起来还没有找到OpenSSL库。

Answer 3

在Ubuntu 12.04 ，就像Mark Thomas在上面指出的那样，我在构建tcnative （tomcat native）库之前没有安装必备库。 正如官方网页上所提到的，我所要做的就是：

apt-get install libapr1.0-dev libssl-dev

然后重建tomcat本机库，即重做configure ， make && make install

Answer 4

从我的角度来看，在RHEL 6.6系统上工作时，我不得不分叉/复制已经存在的Tomcat分支（例如/ opt / tomcat / DEFAULT_BRANCH / conf / opt / tomcat / DEFAULT_BRANCH / etc），这是已知的 - 已经使用以前的叉子。

因此重新编译不是一个选项，即使我按照本文中的建议尝试重新编译，我总是在Catalina.out中遇到相同的SSL引擎问题

我最后要做的是评论server.xml文件中的“Listener className”条目（第27行）然后我按照以下步骤进行操作：

https://dzone.com/articles/setting-ssl-tomcat-5-minutes

希望这有助于某人。

Answer 5

另一个可能的原因是版本openssl所用libcnative是从版本不同openssl目前使用tomcat 。 因此，您可以使用以下选项重新编译libcnative ：

--with-ssl=`the openssl directory used by tomcat`

它可能适用于有许多不同版本的libcrypto.so.1.0.0的操作系统。