This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 11.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 2ecc91ee39457428f5b6608d108164b4ba2fe03f Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 23:07:52 2026 +0200 Non-exportable Windows keys require JSSE --- webapps/docs/ssl-howto.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/webapps/docs/ssl-howto.xml b/webapps/docs/ssl-howto.xml index 10aae1da39..e35a268913 100644 --- a/webapps/docs/ssl-howto.xml +++ b/webapps/docs/ssl-howto.xml @@ -543,6 +543,13 @@ with a configured alias, ensure that the renewed certificate is available under that alias. Reloading does not select a different alias or prefer a certificate with a later expiry date.</p> +<p>If the certificate's private key is marked non-exportable, pin the JSSE implementation by adding +<code>sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"</code> +to the <strong>Connector</strong>. A connector otherwise selects an OpenSSL +implementation automatically when one is available, and OpenSSL cannot use a +private key it is unable to read, so initialization fails. An exportable key works +with either implementation.</p> + <p>Two points to note:</p> <ul> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
