I have set up a Spring Boot application to utilize HTTPS with a certificate (not self-signed) in a PKCS12 keystore.
I created the keystore like this:
openssl pkcs12 -export -inkey key -in cert -certfile interm -out tls-keystore.p12 -name tomcat
The configuration properties:
server.ssl.key-store=/etc/app/tls-keystore.p12
server.ssl.key-store-password=password
server.ssl.key-alias=tomcat
I am using a trust store (a different file) which is a copy of the default JVM keystore with two extra certs inserted (so we can talk to a local service that uses self-signed certs).
The SSL works, but there are a number of warnings in the log:
2020-03-12 13:23:14.842 WARN 11572 --- [ main] org.apache.tomcat.util.net.SSLUtilBase : jsseUtil.trustedCertNotValid
There are 30 of these. It doesn't seem like they can correspond to certificates in the keystore I've created, because it only has one entry.
Looking at the code it appears that the warning was intended to be rendered as a more informative message, but failed: http://svn.apache.org/viewvc/tomcat/trunk/java/org/apache/tomcat/util/net/SSLUtilBase.java?revision=1854079&view=markup&pathrev=1854079#l296
If either SSL or the alternate trust store are turned off, the warnings don't appear.
I did enable debugging: -Djavax.net.debug=ssl:handshake:keymanager:trustmanager -Djava.security.debug=jca,certpath,provider
which resulted in quite a bit of extra information logged, but none adjacent to the warnings in question.
What is causing these warnings and what should I do about them?