This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit bbf1cd9afe9e0b32bf0488c39130647addf35b2e Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 23:07:52 2026 +0200 Non-exportable Windows keys require JSSE --- webapps/docs/ssl-howto.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/webapps/docs/ssl-howto.xml b/webapps/docs/ssl-howto.xml index 480414d3b9..54668050f4 100644 --- a/webapps/docs/ssl-howto.xml +++ b/webapps/docs/ssl-howto.xml @@ -547,6 +547,13 @@ with a configured alias, ensure that the renewed certificate is available under that alias. Reloading does not select a different alias or prefer a certificate with a later expiry date.</p> +<p>If the certificate's private key is marked non-exportable, pin the JSSE implementation by adding +<code>sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"</code> +to the <strong>Connector</strong>. A connector otherwise selects an OpenSSL +implementation automatically when one is available, and OpenSSL cannot use a +private key it is unable to read, so initialization fails. An exportable key works +with either implementation.</p> + <p>Two points to note:</p> <ul> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
