0

I try to use SSL on spring boot 2.5.0 with embeded tomcat 9.0.46 but tomcat can not load keystore file.
The name and password are correct

This is how I imported: keytool -import -alias nameAlias -file myCertificate.crt -keystore file.p12 -storepass password

Here is application properties:

server.port=8443
server.ssl.key-store=classpath:keystore/file.p12
server.ssl.key-store-password=password
server.ssl.keyStoreType=PKCS12
server.ssl.key-alias=nameAlias

org.springframework.context.ApplicationContextException: Failed to start bean 'webServerStartStop'; nested exception is org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat server at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:181) ~[spring-context-5.3.7.jar:5.3.7] at org.springframework.context.support.DefaultLifecycleProcessor.access$200(DefaultLifecycleProcessor.java:54) ~[spring-context-5.3.7.jar:5.3.7] at org.springframework.context.support.DefaultLifecycleProcessor$LifecycleGroup.start(DefaultLifecycleProcessor.java:356) ~[spring-context-5.3.7.jar:5.3.7] at java.base/java.lang.Iterable.forEach(Iterable.java:75) ~[na:na] at org.springframework.context.support.DefaultLifecycleProcessor.startBeans(DefaultLifecycleProcessor.java:155) ~[spring-context-5.3.7.jar:5.3.7] at org.springframework.context.support.DefaultLifecycleProcessor.onRefresh(DefaultLifecycleProcessor.java:123) ~[spring-context-5.3.7.jar:5.3.7] at org.springframework.context.support.AbstractApplicationContext.finishRefresh(AbstractApplicationContext.java:935) ~[spring-context-5.3.7.jar:5.3.7] at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:586) ~[spring-context-5.3.7.jar:5.3.7] at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:145) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:758) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:438) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:337) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1336) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.boot.SpringApplication.run(SpringApplication.java:1325) ~[spring-boot-2.5.0.jar:2.5.0] at backend.careermdhub.CareermdhubApplication.main(CareermdhubApplication.java:14) ~[classes/:na] Caused by: org.springframework.boot.web.server.WebServerException: Unable to start embedded Tomcat server at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:229) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.boot.web.servlet.context.WebServerStartStopLifecycle.start(WebServerStartStopLifecycle.java:43) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.context.support.DefaultLifecycleProcessor.doStart(DefaultLifecycleProcessor.java:178) ~[spring-context-5.3.7.jar:5.3.7] ... 14 common frames omitted Caused by: java.lang.IllegalArgumentException: standardService.connector.startFailed at org.apache.catalina.core.StandardService.addConnector(StandardService.java:243) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.addPreviouslyRemovedConnectors(TomcatWebServer.java:282) ~[spring-boot-2.5.0.jar:2.5.0] at org.springframework.boot.web.embedded.tomcat.TomcatWebServer.start(TomcatWebServer.java:213) ~[spring-boot-2.5.0.jar:2.5.0] ... 16 common frames omitted Caused by: org.apache.catalina.LifecycleException: Protocol handler start failed at org.apache.catalina.connector.Connector.startInternal(Connector.java:1075) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:183) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.catalina.core.StandardService.addConnector(StandardService.java:239) ~[tomcat-embed-core-9.0.46.jar:9.0.46] ... 18 common frames omitted Caused by: java.lang.IllegalArgumentException: Alias name [nameAlias] does not identify a key entry at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:99) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:258) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1204) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.tomcat.util.net.AbstractEndpoint.start(AbstractEndpoint.java:1290) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.coyote.AbstractProtocol.start(AbstractProtocol.java:614) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.catalina.connector.Connector.startInternal(Connector.java:1072) ~[tomcat-embed-core-9.0.46.jar:9.0.46] ... 20 common frames omitted Caused by: java.io.IOException: Alias name [nameAlias] does not identify a key entry at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:336) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:246) ~[tomcat-embed-core-9.0.46.jar:9.0.46] at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:97) ~[tomcat-embed-core-9.0.46.jar:9.0.46] ... 26 common frames omitted

Alex
  • 23
  • 5
  • 2
    Does this answer your question? [SSL Certificate on Tomcat - Alias name does not identify a key](https://stackoverflow.com/questions/11303107/ssl-certificate-on-tomcat-alias-name-does-not-identify-a-key) – Piotr P. Karwasz Jul 26 '21 at 07:36
  • 1
    Your entry in the keystore is probably of type `trustedCertEntry` (without a private key), whereas it should be of type `privateKeyEntry`. – Piotr P. Karwasz Jul 26 '21 at 07:38
  • @Piotr P. Karwasz How can I change to privateKeyEntry? – Alex Jul 26 '21 at 10:01
  • @Piotr P. Karwasz I have only one entry, which is trustedCertEntry. – Alex Jul 26 '21 at 10:06
  • 1
    Please [edit](https://stackoverflow.com/posts/68525583/edit) your question and add the procedure you used to generate the keystore. Probably you forgot to import the private key. – Piotr P. Karwasz Jul 26 '21 at 10:22
  • @Piotr P. Karwasz I edited – Alex Jul 26 '21 at 10:35
  • 1
    The `file.p12` keystore must already contain your private key under the `nameAlias` alias for your `keytool -import` command to work. If your private key is not in PKCS12 format, check [this question](https://stackoverflow.com/q/906402/11748454). – Piotr P. Karwasz Jul 26 '21 at 11:38
  • @Piotr P. Karwasz I have two files .p7b and .crt, whatever I try to do I don't get privateKeyEntry – Alex Jul 26 '21 at 12:44
  • 1
    None of those files contains your private key: cf. [this question](https://stackoverflow.com/q/53853917/11748454). You need to clarify this with your CA: usually you generate a pair of private/public key yourself and send the public key to the CA, so it can issue a certificate. If you lost the private key the certificate is useless. Sometimes the CA generates both the keypair and the certificate. – Piotr P. Karwasz Jul 26 '21 at 13:01
  • 1
    @Piotr P. Karwasz Thanks for the help, I managed to merge the private key and the certificate, to get a .p12 via openssl – Alex Jul 26 '21 at 14:29

0 Answers0