1

I want to use an ssl certificate on Tomcat 9 over my user's web site, he gives me this files:

xxxxxxx.crt
xxxxxxx.pem
sf_bundle-g2-g1.crt

I'm creating a jks file to use in Tomcat:

 keytool -importcert -keystore file.jks -storepass pass -file sf_bundle-g2-g1.crt -alias unal
 keytool -importcert -keystore file.jks -storepass pass -file xxxxxxx.pem -alias unaledu
 keytool -importcert -keystore file.jks -storepass pass -file xxxxxxx.crt -alias unaleduco

When configure on Tomcat

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
     maxThreads="150" scheme="https" secure="true"
     keystoreFile="/opt/tomcat/apache-tomcat-9.0.40/certs/file.jks" keystorePass="pass" keyAlias="unaleduco"
     clientAuth="false" sslProtocol="TLS" sslVerifyClient="optional"
     sslEnabledProtocols="TLSv1.2,TLSv1.1,SSLv2Hello"/>

I'm getting this error:

21-Jun-2021 21:31:25.462 INFORMACIÓN [main] org.apache.coyote.AbstractProtocol.init Inicializando el manejador de protocolo ["https-jsse-nio-443"]

21-Jun-2021 21:31:25.668 GRAVE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Fallo al iniciar el componente [Connector[HTTP/1.1-443]]
org.apache.catalina.LifecycleException: Falló la inicialización del manejador de protocolo
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:1042)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
    at org.apache.catalina.core.StandardService.initInternal(StandardService.java:533)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
    at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1057)
    at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:724)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:746)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:302)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472)
Caused by: java.lang.IllegalArgumentException: El nombre de Alias [unaleduco] no identifica una entrada de clave
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:99)
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
    at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:216)
    at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1141)
    at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1154)
    at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:592)
    at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:80)
    at org.apache.catalina.connector.Connector.initInternal(Connector.java:1039)
    ... 13 more
Caused by: java.io.IOException: El nombre de Alias [unaleduco] no identifica una entrada de clave
    at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:336)
    at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:246)
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:97)
    ... 20 more

How can i use this certificate?

davids182009
  • 441
  • 3
  • 7
  • 26
  • Those files are probably all PEM encoded (base64 surrounded by `-----BEGIN ...` and `-----END ...`). You need to find which one contains a private key. – Piotr P. Karwasz Jun 22 '21 at 04:21
  • All files that i have begin with `-----BEGIN CERTIFICATE-----` and finish with `-----END CERTIFICATE-----` which file is missing? – davids182009 Jun 22 '21 at 13:48
  • You need to find the private key: usually you generate a public-private keypair on your computer and send the public key to the CA. Some CA's generate it for you. Cf. [Public-key cryptography](https://en.wikipedia.org/wiki/Public-key_cryptography) – Piotr P. Karwasz Jun 22 '21 at 14:08
  • this file could be a one with .key extension? – davids182009 Jun 22 '21 at 14:15
  • Probably yes. If you have your key in PEM format, check [this question](https://stackoverflow.com/q/49386683/11748454) instead of going through the hassle of creating a PKCS12 keystore. – Piotr P. Karwasz Jun 22 '21 at 14:23

0 Answers0