Hi Chris
We are planning to setup JSSE keystore-based certificate configuration so I
have removed tcnative-1.dll file in
C:\apache-tomcat-6.0.24-windows-x64\apache-tomcat-6.0.24\bin path. Still no
success, below are the error message
I have attached server.xml in this.
Error Message
24-Oct-2012 14:52:36 org.apache.catalina.core.AprLifecycleListener init
INFO: The APR based Apache Tomcat Native library which allows optimal performanc
e in production environments was not found on the java.library.path: C:\Program
Files\Java\jdk1.6.0_30\bin;C:\Windows\Sun\Java\bin;C:\Windows\system32;C:\Window
s;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\Wi
ndowsPowerShell\v1.0\;C:\Program Files\Java\jdk1.6.0_30\bin;.
24-Oct-2012 14:52:36 org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8080
24-Oct-2012 14:52:38 org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8443
24-Oct-2012 14:52:38 org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 2702 ms
24-Oct-2012 14:52:38 org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
24-Oct-2012 14:52:38 org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.24
24-Oct-2012 14:52:38 org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deploying configuration descriptor host-manager.xml
24-Oct-2012 14:52:38 org.apache.catalina.startup.HostConfig deployDescriptor
INFO: Deploying configuration descriptor manager.xml
24-Oct-2012 14:52:39 org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory docs
24-Oct-2012 14:52:39 org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory examples
24-Oct-2012 14:52:39 org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory ROOT
24-Oct-2012 14:52:40 org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8080
24-Oct-2012 14:52:40 org.apache.coyote.http11.Http11Protocol start
INFO: Starting Coyote HTTP/1.1 on http-8443
24-Oct-2012 14:52:40 org.apache.jk.common.ChannelSocket init
INFO: JK: ajp13 listening on /0.0.0.0:8009
24-Oct-2012 14:52:40 org.apache.jk.server.JkMain start
INFO: Jk running ID=0 time=0/32 config=null
24-Oct-2012 14:52:40 org.apache.catalina.startup.Catalina start
INFO: Server startup in 1986 ms
Thank you
Regards
Kumaresh Gopalsamy
-----Original Message-----
From: Christopher Schultz [mailto:ch...@christopherschultz.net]
Sent: 24 October 2012 14:42
To: Tomcat Users List
Subject: Re: Tomcat 6.0.24 SSL Setup issue
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Kumaresh,
On 10/24/12 6:38 AM, KumareshGopalsamy wrote:
> I have followed below steps to setup SSL
>
> Details Tomcat 6.0.24 Windows server 2008 R2 Datacenter
Since you are using SSL, I suspect you are interested in protecting your data.
You should seriously upgrade to the latest Tomcat 6.0.36, as there are known
vulnerabilities with your version:
http://tomcat.apache.org/security-6.html
> <Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
> maxThreads="150" scheme="https" secure="true" clientAuth="false"
> sslProtocol="TLS" keystorePass="changeit" keystoreFile="
> C:\apache-tomcat-6.0.24-windows-x64\key \.keystore"/>
This is a JSSE keystore-based certificate configuration.
> 22-Oct-2012 11:21:43 org.apache.catalina.core.AprLifecycleListener
> init INFO: Loaded APR based Apache Tomcat Native library 1.1.19.
> 22-Oct-2012 11:21:43 org.apache.catalina.core.AprLifecycleListener
> init INFO: APR capabilities: IPv6 [true], sendfile [true], accept
> filters [false], random [true].
You are using APR (tcnative).
> INFO: Initializing Coyote HTTP/1.1 on http-8080 22-Oct-2012
> 11:21:44 org.apache.coyote.http11.Http11AprProtocol init
Your <Connector> is auto-choosing APR-based HTTP/1.1 protocol.
> SEVERE: Error initializing endpoint
>
> java.lang.Exception: No Certificate file specified or invalid file
> format
APR uses a different file format and configuration from the BIO and NIO
HTTP/1.1 connectors.
So, either you need to re-do your certificates so that you have separate
PEM-encoded files on the disk like httpd does, and configure them appropriately
(http://tomcat.apache.org/tomcat-6.0-doc/apr.html#HTTPS) or you need to change
your <Connector> to use a non-APR connector like this for BIO:
<Connector protocol="org.apache.coyote.http11.Http11Protocol"
Or like this for NIO:
<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
Or you can disable APR by commenting-out the <Listener> in server.xml, or you
can just remove the tcnative* binaries from your Tomcat installation.
Hope that helps,
- -chris
-----BEGIN PGP SIGNATURE-----
Version: GnuPG/MacGPG2 v2.0.17 (Darwin)
Comment: GPGTools - http://gpgtools.org
Comment: Using GnuPG with Mozilla - http://www.enigmail.net/
iEYEARECAAYFAlCH8CYACgkQ9CaO5/Lv0PDVNgCgpOVZad9f/o87to6fWwezplHC
9Y4AnRnh3k72yIizIGQUCJeX7pYZrj61
=QUfe
-----END PGP SIGNATURE-----
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
Did you know that the PHS Group offers live and replica Christmas trees through
its PHS Greenleaf division? From desk top displays to 30ft trees, you can have
a stylish Christmas for your premises, without the hassle. Visit
http://www.phsgreenleaf.co.uk
<?xml version='1.0' encoding='utf-8'?>
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Note: A "Server" is not itself a "Container", so you may not
define subcomponents such as "Valves" at this level.
Documentation at /docs/config/server.html
-->
<Server port="8005" shutdown="SHUTDOWN">
<!--APR library loader. Documentation at /docs/apr.html -->
<Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="off" />
<!--Initialize Jasper prior to webapps are loaded. Documentation at /docs/jasper-howto.html -->
<Listener className="org.apache.catalina.core.JasperListener" />
<!-- Prevent memory leaks due to use of particular java/javax APIs-->
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<!-- JMX Support for the Tomcat server. Documentation at /docs/non-existent.html -->
<Listener className="org.apache.catalina.mbeans.ServerLifecycleListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<!-- Global JNDI resources
Documentation at /docs/jndi-resources-howto.html
-->
<GlobalNamingResources>
<!-- Editable user database that can also be used by
UserDatabaseRealm to authenticate users
-->
<Resource name="UserDatabase" auth="Container"
type="org.apache.catalina.UserDatabase"
description="User database that can be updated and saved"
factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>
<!-- A "Service" is a collection of one or more "Connectors" that share
a single "Container" Note: A "Service" is not itself a "Container",
so you may not define subcomponents such as "Valves" at this level.
Documentation at /docs/config/service.html
-->
<Service name="Catalina">
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
maxThreads="150" minSpareThreads="4"/>
-->
<!-- A "Connector" represents an endpoint by which requests are received
and responses are returned. Documentation at :
Java HTTP Connector: /docs/config/http.html (blocking & non-blocking)
Java AJP Connector: /docs/config/ajp.html
APR (HTTP/AJP) Connector: /docs/apr.html
Define a non-SSL HTTP/1.1 Connector on port 8080
-->
<Connector port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
port="8080" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" />
-->
<!-- Define a SSL HTTP/1.1 Connector on port 8443
This connector uses the JSSE configuration, when using APR, the
connector should be using the OpenSSL style configuration
described in the APR documentation -->
<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" keystorePass="changeit" keystoreFile="C:\apache-tomcat-6.0.24-windows-x64\key\.keystore" />
<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />
<!-- An Engine represents the entry point (within Catalina) that processes
every request. The Engine implementation for Tomcat stand alone
analyzes the HTTP headers included with the request, and passes them
on to the appropriate Host (virtual host).
Documentation at /docs/config/engine.html -->
<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">
<!--For clustering, please take a look at documentation at:
/docs/cluster-howto.html (simple how to)
/docs/config/cluster.html (reference documentation) -->
<!--
<Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
-->
<!-- The request dumper valve dumps useful debugging information about
the request and response data received and sent by Tomcat.
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.valves.RequestDumperValve"/>
-->
<!-- This Realm uses the UserDatabase configured in the global JNDI
resources under the key "UserDatabase". Any edits
that are performed against this UserDatabase are immediately
available for use by the Realm. -->
<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
resourceName="UserDatabase"/>
<!-- Define the default virtual host
Note: XML Schema validation will not work with Xerces 2.2.
-->
<Host name="localhost" appBase="webapps"
unpackWARs="true" autoDeploy="true"
xmlValidation="false" xmlNamespaceAware="false">
<!-- SingleSignOn valve, share authentication between web applications
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.authenticator.SingleSignOn" />
-->
<!-- Access log processes all example.
Documentation at: /docs/config/valve.html -->
<!--
<Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
prefix="localhost_access_log." suffix=".txt" pattern="common" resolveHosts="false"/>
-->
</Host>
</Engine>
</Service>
</Server>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscr...@tomcat.apache.org
For additional commands, e-mail: users-h...@tomcat.apache.org
