How to Enable SSL on Tomcat 7 on Linux?

[James Dekker]

Am using JDK 1.6, tomcat 7.0.32, and Red Hat Linux.

I need help setting up SSL on my local tomcat instance.

After looking at the instructions on the official tomcat 7 website:

http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html

I followed the directions like this:

(1) cd $CATALINA_HOME/conf

(2) Create a certificate and store it in a new key store.

keytool -genkey -alias tomcat -keyalg RSA -keystore keystore.jks

(3) Uncomment the SSL connector configuration in Tomcat's conf/server.xml, specifying your key store file and password.

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
			   clientAuth="false" sslProtocol="TLS" 
			   keystoreFile="./conf/keystore.jks"
			   keystorePass="mypassword"
/>

(4) Export the certificate from the key store.

keytool -exportcert -alias tomcat -file tomcat.crt -keystore keystore.jks

When I tried to (which would have been Step # 5) import the certificate into the trust store.

keytool -importcert -alias tomcat -file tomcat.crt -trustcacerts -keystore $JAVA_HOME/jre/lib/security/cacerts

I get the following prompt for my password (after which I entered in "mypassword"):
Enter keystore password:

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

(I disregarded this step by the way because I found it on Google but not on the official Tomcat7-SSL-Howto documentation - please let me know if its necessary).

My full server.xml file (located under $CATALINA_HOME/conf):

<?xml version="1.0" encoding="UTF-8"?>
<Server port="8005" shutdown="SHUTDOWN">
	<Listener SSLEngine="on" className="org.apache.catalina.core.AprLifecycleListener"/>
	<Listener className="org.apache.catalina.core.JasperListener"/>
	<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener"/>
	<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener"/>
	<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener"/>
	<GlobalNamingResources>
	       <Resource auth="Container" 
			  description="User database that can be updated and saved" 
			  factory="org.apache.catalina.users.MemoryUserDatabaseFactory" 
			  name="UserDatabase" 
			  pathname="conf/tomcat-users.xml" 
			  type="org.apache.catalina.UserDatabase"/>
	</GlobalNamingResources>
	<Service name="Catalina">
	<Connector connectionTimeout="20000" port="8080" protocol="HTTP/1.1" redirectPort="8443"/>
	<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
			   clientAuth="false" sslProtocol="TLS" 
			   keystoreFile="./conf/keystore.jks"
			   keystorePass="mypassword"
	/>
	<Connector port="8009" protocol="AJP/1.3" redirectPort="8443"/>
	<Engine defaultHost="localhost" name="Catalina">
	<Realm className="org.apache.catalina.realm.LockOutRealm">
		<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase"/>
	</Realm>
	<Host appBase="webapps" autoDeploy="true" name="localhost" unpackWARs="true">
	 <Valve className="org.apache.catalina.valves.AccessLogValve" 
			directory="logs" 
			pattern="%h %l %u %t "%r" %s %b" 
			prefix="localhost_access_log." 
			suffix=".txt"/>
    </Host>
    </Engine>
  </Service>
</Server>

Tomcat's server output:

INFO: Initializing ProtocolHandler ["http-bio-8080"]
Dec 17, 2012 5:17:59 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["http-bio-8443"]
Dec 17, 2012 5:17:59 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["ajp-bio-8009"]
Dec 17, 2012 5:43:08 PM org.apache.catalina.startup.Catalina start
Dec 17, 2012 5:43:08 PM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["http-bio-8080"]
Dec 17, 2012 5:43:08 PM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["http-bio-8443"]
Dec 17, 2012 5:43:08 PM org.apache.coyote.AbstractP
INFO: Server startup in 9611 ms

When I go to my bash shell and type this in:

curl -X GET https://localhost:8443

I get the following error output:

curl -X GET https://localhost:8443
curl: (60) Peer certificate cannot be authenticated with known CA certificates
More details here: http://curl.haxx.se/docs/sslcerts.html

curl performs SSL certificate verification by default, using a "bundle"
 of Certificate Authority (CA) public keys (CA certs). If the default
 bundle file isn't adequate, you can specify an alternate file
 using the --cacert option.
If this HTTPS server uses a certificate signed by a CA represented in
 the bundle, the certificate verification probably failed due to a
 problem with the certificate (it might be expired, or the name might
 not match the domain name in the URL).
If you'd like to turn off curl's verification of the certificate, use
 the -k (or --insecure) option.

Am I missing a step here?

I just want to enable SSL on Tomcat 7 and test it using curl.

Would appreciate it if someone could point me in the right direction.

Thanks for taking the time to read this.

[Tim Holloway]

I recommend using an absolute path for your keystore location.

Also, this message:

keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

Cannot be ignored.

[K. Gil]

> keytool error: java.io.IOException: Keystore was tampered with, or password was incorrect

Java's default cacerts password is "changeit"