Tomcat 8: Invalid keystore format

Question

I try to configure SSL into my new project. I do it for the first time and i got some problems.

Some items to the projects:

A part of my server.xml:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
            maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
            keystoreFile="/PATHTO/src/main/resources/keystore.p12"
            keystorePass="STOREPASS" clientAuth="false" sslProtocol="TLS" />

A part of my application.properties:

spring.profiles.active=https
server.port=8443
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-password=STOREPASS
server.ssl.keyStoreType=PKCS12
server.ssl.keyAlias=tomcat

The command that i use to generate the keystore:

keytool -genkey -alias tomcat -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore keystore.p12 -validity 3650

And the keystore.p12 is in the same folder like the application.properties.

The error of the console:

java.io.IOException: Invalid keystore format
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:650)
    at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
    at java.security.KeyStore.load(KeyStore.java:1445)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:437)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:336)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:594)
    at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:534)
    at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:363)
    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:732)
    at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:457)
    at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:120)
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:960)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.core.StandardService.initInternal(StandardService.java:567)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:851)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:576)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:599)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:497)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:310)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:484)

Has someone any ideas?

Thanks. Cheers.

You're not declaring `keyStoreType=PKCS12` in `server.xml`, it seems (the default is `JKS`). — Mick Mnemonic, Oct 25 '15 at 22:53
I added keyStoreType="PKCS12" into server.xml but i got the same errors. — emoleumassi, Oct 25 '15 at 23:13
Are you sure that the path in `keystoreFile` can be accessed? — Mick Mnemonic, Oct 25 '15 at 23:52
As commented [here](https://stackoverflow.com/a/26071504) there could be a 'filtering' problem when the keystore is treated as text rather than binary. Set resource's `false` in your `maven-resources-plugin` (see e.g. [here](https://stackoverflow.com/a/19502504)), or use `` rather than `` in your `maven-cargo-plugin` (see https://codehaus-cargo.github.io/cargo/Configuration+files+option.html) — krevelen, Mar 14 '18 at 08:16

user207421 · Answer 1 · 2021-10-14T03:24:30.253

3

You need to specify keyStoreType, as the format is PKCS12, not JKS.

edited Oct 14 '21 at 03:24

answered Oct 26 '15 at 09:54

user207421

305,947
44
307
483

@MickMnemonic So he claims, but this is still the correct answer, unless he has a corrupt file. – user207421 Dec 05 '16 at 07:44

score 3 · Answer 2 · edited Feb 14 '16 at 00:55

3

To elaborate on EJP's answer and detail to Mick Mnemonic that this is not entirely correct.

OP did not set that in the server.xml rather the application.properties

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
        maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
        keystoreFile="/PATHTO/src/main/resources/keystore.p12"
        keystorePass="STOREPASS" clientAuth="false" sslProtocol="TLS"
        keystoreType="PKCS12" />

You will note that on the last line of the "Connector" element I have added keystoreType="PKCS12" to allow the connector to correctly load the file.

Your stack trace is a dead give away on this one.

edited Feb 14 '16 at 00:55

halfer

19,824
17
99
186

answered Oct 26 '15 at 10:51

Dave G

9,639
36
41

The comments specifically talk about `server.xml`, not `application.properties`: "I added keyStoreType="PKCS12" into server.xml but i got the same errors" – Mick Mnemonic Oct 26 '15 at 11:07
I apologize for that but it remains the issue. – Dave G Oct 26 '15 at 11:37
Not necessarily. You would get the same error message if `keystore.p12` was damaged/corrupted. You _might_ also get the same error if the path was inaccessible as the exception signals a very generic I/O failure (see line 650 at [JavaKeyStore.java](http://grepcode.com/file/repository.grepcode.com/java/root/jdk/openjdk/8u40-b25/sun/security/provider/JavaKeyStore.java#JavaKeyStore)). – Mick Mnemonic Oct 26 '15 at 12:39
i checked the user rights. The path is accessible: ls -a keystore.p12 return 666 – emoleumassi Oct 26 '15 at 20:50

Tomcat 8: Invalid keystore format

2 Answers2