{"id":3015,"date":"2014-05-12T21:35:39","date_gmt":"2014-05-12T13:35:39","guid":{"rendered":"http:\/\/rmohan.com\/?p=3015"},"modified":"2014-05-12T21:41:26","modified_gmt":"2014-05-12T13:41:26","slug":"tomcat-could-not-run-through-ssl-due-to-jsse-invalid_ssl_conf","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=3015","title":{"rendered":"Tomcat could not run through SSL due to jsse.invalid_ssl_conf"},"content":{"rendered":"
\n
\n
\n
\n\n\n\n
\n
\n
SEVERE: Error initializing endpoint<\/code><\/div>\n
java.io.IOException: jsse.invalid_ssl_conf<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>at org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:817)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:522)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>...<\/code><\/div>\n
Caused by: javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled.<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(SSLServerSocketImpl.java:310)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(SSLServerSocketImpl.java:255)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>at org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:813)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>...<\/code><\/div>\n
SEVERE: Failed to initialize connector [Connector[HTTP\/1.1-8443]]<\/code><\/div>\n
LifecycleException:\u00a0 Protocol handler initialization failed: java.io.IOException: jsse.invalid_ssl_conf<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>at org.apache.catalina.connector.Connector.initialize(Connector.java:1024)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)<\/code><\/div>\n
\u00a0\u00a0\u00a0\u00a0<\/code>...<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n

Cause<\/h2>\n

This error might be caused of certain things such as, the keystoretype is not defined in\u00a0server.xml<\/em>\u00a0<\/span>thus the JSSE could not recognized the keystore as the keystore is not on default type which is JKS. Other thing is the certificate has not be imported to keystore that is generated by \u00a0keytool as it\u00a0<\/span>does not<\/strong>\u00a0<\/span>let you\u00a0import an existing private key for which you already have a certificate.<\/p>\n

Resolution<\/h2>\n
\n
\n
    \n
  1. \n

    You need to define the\u00a0<\/span>keystoreType<\/em>\u00a0<\/span>to\u00a0<\/span>server.xml<\/em>\u00a0<\/span>as the default one is JKS. For example under your server.xml would become like this.<\/p>\n

    \n
    \n
    \n
    \n\n\n\n
    \n
    \n
    <<\/code>Connector<\/code>\u00a0<\/span>port<\/code>=<\/code>\"8443\"<\/code>\u00a0<\/span>maxHttpHeaderSize<\/code>=<\/code>\"8192\"<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>maxThreads<\/code>=<\/code>\"150\"<\/code>\u00a0<\/span>minSpareThreads<\/code>=<\/code>\"25\"<\/code>\u00a0<\/span>maxSpareThreads<\/code>=<\/code>\"75\"<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>enableLookups<\/code>=<\/code>\"false\"<\/code>\u00a0<\/span>disableUploadTimeout<\/code>=<\/code>\"true\"<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>acceptCount<\/code>=<\/code>\"100\"<\/code>\u00a0<\/span>scheme<\/code>=<\/code>\"https\"<\/code>\u00a0<\/span>secure<\/code>=<\/code>\"true\"<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>clientAuth<\/code>=<\/code>\"false\"<\/code>\u00a0<\/span>sslProtocol<\/code>=<\/code>\"TLS\"<\/code>\u00a0<\/span>SSLEnabled<\/code>=<\/code>\"true\"<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>URIEncoding<\/code>=<\/code>\"UTF-8\"<\/code>\u00a0<\/span>keystorePass=\"<MY_CERTIFICATE_PASSWORD>\"<\/code><\/div>\n
    \u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/code>keystoreFile=\"<<\/code>MY_CERTIFICATE_LOCATION<\/code>>\" keystoreType=\"PKCS12\"\/>\u00a0<\/code><\/div>\n<\/div>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/li>\n<\/ol>\n<\/div>\n<\/div>\n

     <\/p>\n

    Import private key and certificate into Java Key Store (JKS)<\/h1>\n

    Apache Tomcat and many other Java applications expect to retrieve SSL\/TLS certificates from a Java Key Store (JKS). Jave Virtual Machines usually come with\u00a0<\/span>keytool\u00a0\"\"<\/a>\u00a0<\/span>to help you create a new key store.<\/p>\n

    Keytool helps you to:<\/p>\n