Configuring SSL with tomcat 8.5 using .keystore file - Cannot store non-Private keys

user_5387794 0
Viewed 9668

I have a file tomcat (2).keystore file which I have placed in /opt/tomcat/conf directory. The directory permissions are set as below:

root@xxxxxxxxxx:/opt/tomcat# ls -l
total 112
drwxr-x--- 2 root   tomcat  4096 Sep 10 03:04 bin
drwxr-x--- 2 root   tomcat  4096 Sep 28 05:12 conf
drwxr-x--- 2 root   tomcat  4096 Sep 10 03:04 lib
-rw-r----- 1 root   tomcat 57092 Aug  2 21:36 LICENSE
drwxr-x--- 2 tomcat tomcat  4096 Sep 28 05:15 logs
-rw-r----- 1 root   tomcat  1723 Aug  2 21:36 NOTICE
-rw-r----- 1 root   tomcat  7064 Aug  2 21:36 RELEASE-NOTES
-rw-r----- 1 root   tomcat 15946 Aug  2 21:36 RUNNING.txt
drwxr-x--- 2 tomcat tomcat  4096 Sep 28 05:15 temp
drwxr-x--- 8 tomcat tomcat  4096 Sep 28 03:52 webapps
drwxr-x--- 3 tomcat tomcat  4096 Sep 10 03:19 work

And the server.xml has the following connector:

<Connector 
    port="8080" 
    maxThreads="1000"

    protocol="org.apache.coyote.http11.Http11NioProtocol"
    maxHttpHeaderSize="8192"
    emptySessionPath="true"
    connectionTimeout="20000"  
    minSpareThreads="20"  
    acceptCount="100" 
    disableUploadTimeout="true" 
    enableLookups="false" 
    tcpNoDelay="true"

    scheme="https" 
    secure="true" 
    SSLEnabled="true"
    keystoreFile="/opt/tomcat/conf/tomcat (2).keystore" 
    keystorePass="xxxxxx"
    clientAuth="false" 
    sslProtocol="TLS" 
    maxPostSize="97589953"
    URIEncoding="UTF-8"/>

I have also commented out the following:

<!-- <Listener className="org.apache.catalina.core.AprLifecycleListener" SSLEngine="on" /> -->

However, I keep getting the following error in catalina.out:

java.lang.IllegalArgumentException: java.security.KeyStoreException: Cannot store non-PrivateKeys
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114)
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:85)
        at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:225)
        at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:982)
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:244)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:620)
        at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:66)
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:997)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
        at org.apache.catalina.core.StandardService.initInternal(StandardService.java:549)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
        at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:875)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:607)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:630)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:311)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:494)
Caused by: java.security.KeyStoreException: Cannot store non-PrivateKeys
        at sun.security.provider.JavaKeyStore.engineSetKeyEntry(JavaKeyStore.java:258)
        at sun.security.provider.JavaKeyStore$JKS.engineSetKeyEntry(JavaKeyStore.java:56)
        at sun.security.provider.KeyStoreDelegator.engineSetKeyEntry(KeyStoreDelegator.java:117)
        at sun.security.provider.JavaKeyStore$DualFormatJKS.engineSetKeyEntry(JavaKeyStore.java:70)
        at java.security.KeyStore.setKeyEntry(KeyStore.java:1140)
        at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:226)
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:112)
        ... 20 more

Can someone help please? Is there any other thing I need to remove from the server.xml?

EDIT:

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 3 entries

root, Dec 19, 2016, trustedCertEntry, 
Certificate fingerprint (SHA1): xxxx
tomcat, Dec 19, 2016, PrivateKeyEntry, 
Certificate fingerprint (SHA1): xxxx
intermed, Dec 19, 2016, trustedCertEntry, 
Certificate fingerprint (SHA1): xxxxx

I get the above when I run ./keytool -list -keystore "/opt/tomcat/conf/tomcat (2).keystore"

tomcat ssl java
3 Answers

I finally managed to figure out the issue. As the Exception suggests, there's some issue with the tomcat (2).keystore itself. So I checked the certificates in the keystore with $JAVA_HOME/bin/keytool -list -keystore tomcat (2).keystore output of which is:

Keystore type: JKS Keystore provider: SUN

Your keystore contains 3 entries

root, Dec 19, 2016, trustedCertEntry, 
Certificate fingerprint (SHA1): xxxx
tomcat, Dec 19, 2016, PrivateKeyEntry, 
Certificate fingerprint (SHA1): xxxx
intermed, Dec 19, 2016, trustedCertEntry, 
Certificate fingerprint (SHA1): xxxxx

Since the exception suggests that any key other than private keys are offending, I removed the trustedCertEntry using:

$JAVA_HOME/bin/keytool -delete -noprompt -alias intermed -keystore tomcat\ \(2\).keystore -storepass xxxxxx
$JAVA_HOME/bin/keytool -delete -noprompt -alias root -keystore tomcat\ \(2\).keystore -storepass xxxxx

and restarted tomcat. This resolved the issue. Thanks @Gautam and @EJP for assistance.

user_53877940

I believe you're trying to setup SSL support on server. If so, your keystore should only contain your private certificates. Looks like there are some third party public keys in there or you are using JKS keystore with symmetric keys. Best bet to find out is to check the contents of your keystore. Use command

keytool -list -keystore yourkeystorefilename

And see what is in there.

user_68393380
Related