Error: Alias name [null] does not identify a key entry during implementing SSL in Tomcat

user_2801200 0
Viewed 13029

I am trying to implement SSL in tomcat 8 first time.

I have third party signed X.509 certificate in the form of .pem file.

However after configuration when I try to start tomcat, it is giving me following error:

22-Nov-2017 18:48:01.735 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["https-jsse-nio-8443"] 22-Nov-2017 18:48:01.897 SEVERE [main] org.apache.coyote.AbstractProtocol.init Failed to initialize end point associated with ProtocolHandler ["https-jsse-nio-8443"] java.lang.IllegalArgumentException: java.io.IOException: Alias name [null] does not identify a key entry at ...

Following are the steps I have followed:

  1. Renamed certificate.pem to certificate.p7b.
  2. Applied following command to inport certificate into keystore:

D:\keytest2>keytool -import -alias tomcat -trustcacerts -file certificate.p7b -keystore keystore.kdb

Enter keystore password: test
Re-enter new password: test

...
...
Certificate was added to keystore

  1. Checked imported certificate:

D:\keytest2>keytool -list -v -keystore keystore.kd

Which gives me following outout:

Keystore type: JKS Keystore provider: SUN

Your keystore contains 1 entry

Alias name: tomcat Creation date: Nov 22, 2017 Entry type: trustedCertEntry ... ...

Tomcat Configuration:

<Connector port="8443" protocol="HTTP/1.1"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true" 
               keystoreFile="file:///D:/keytest2/keystore.kdb" keystorePass="test"
           clientAuth="false" sslProtocol="TLS">

Please guide me where I am doing wrong.

pkcs#11 x509 tomcat ssl java
1 Answers

The issue was due to missing parameter "keyAlias" in tomcat configuration.

However putting alias didnot solve my problem. It started throwing same error with the alias name instead of null :).

As per the comment of @dev_thompson_085, I came to know that I was missing the key file for this process. So I tried same with self-signed X.509 certificate as per the url: https://www.ibm.com/support/knowledgecenter/en/SSWHYP_4.0.0/com.ibm.apimgmt.cmc.doc/task_apionprem_gernerate_self_signed_openSSL.html

And it worked very well with both files.

user_28012000
Related