tomcat SSL配置异常-“No Certificate file specified or invalid file format”-优快云博客

参考自以下文章：

http://wmljava.iteye.com/blog/1218722

http://www.cnblogs.com/GYoungBean/archive/2013/03/20/2971045.html

很奇怪的问题,同样的tomcat版本(6.0.36),最基本的ssl配置。在win7-32bit专业版下没有任何问题，而在win-64bit旗舰版下报“No Certificate file specified or invalid file format”。

原配置如下：

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" 
               keystoreFile="D:/keystore/.keystore" keystorePass="111111"/>

修改后配置如下：

<Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" 
               keystoreFile="D:/keystore/.keystore" keystorePass="111111"/>

修改了protocol属性值后问题解决。

------------------------分割线---------------------------------

PS:重翻了下tomcat官方6.0的文档(http://tomcat.apache.org/tomcat-6.0-doc/config/http.html#SSL Support) 其中(如下图所示)，应该以上两种配置是相同的。至于为什么会报错就很难理解。这是为什么？

在配置tomcat的SSL双向握手中，由于6.0.33版本中默认启用了APR（APR是通过JNI访问的可移植库，可以提高Tomcat的性能和伸缩性），所以采用传统的配置方式（如下）会报异常；

传统的SSL配置：

Xml代码

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="true" sslProtocol="TLS"
keystoreFile="conf/keystore/test.jks" keystorePass="111111"
truststoreFile="conf/keystore/test.jks" truststorePass="111111"

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
		   maxThreads="150" scheme="https" secure="true"
		   clientAuth="true" sslProtocol="TLS"
		   keystoreFile="conf/keystore/test.jks" keystorePass="111111"
		   truststoreFile="conf/keystore/test.jks"   truststorePass="111111"

异常如下：

Java代码

2011-10-27 9:26:03 org.apache.coyote.http11.Http11AprProtocol init
严重: Error initializing endpoint
java.lang.Exception: No Certificate file specified or invalid file format
at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:733)
at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107)
at org.apache.catalina.connector.Connector.initialize(Connector.java:1022)
at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
2011-10-27 9:26:03 org.apache.catalina.core.StandardService initialize
严重: Failed to initialize connector [Connector[HTTP/1.1-443]]
LifecycleException: Protocol handler initialization failed: java.lang.Exception: No Certificate file specified or invalid file format
at org.apache.catalina.connector.Connector.initialize(Connector.java:1024)
at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:585)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)

2011-10-27 9:26:03 org.apache.coyote.http11.Http11AprProtocol init
严重: Error initializing endpoint
java.lang.Exception: No Certificate file specified or invalid file format
	at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
	at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:733)
	at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107)
	at org.apache.catalina.connector.Connector.initialize(Connector.java:1022)
	at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
	at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:585)
	at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
	at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
2011-10-27 9:26:03 org.apache.catalina.core.StandardService initialize
严重: Failed to initialize connector [Connector[HTTP/1.1-443]]
LifecycleException:  Protocol handler initialization failed: java.lang.Exception: No Certificate file specified or invalid file format
	at org.apache.catalina.connector.Connector.initialize(Connector.java:1024)
	at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
	at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
	at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
	at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
	at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
	at java.lang.reflect.Method.invoke(Method.java:585)
	at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
	at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)

解决办法是采用下面的配置：

Xml代码

<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
maxThreads="150" scheme="https" secure="true"
clientAuth="true" sslProtocol="TLS"
keystoreFile="conf/keystore/testpsira.jks" keystorePass="111111"
truststoreFile="conf/keystore/testpsira.jks" truststorePass="111111"

<Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
		   maxThreads="150" scheme="https" secure="true"
		   clientAuth="true" sslProtocol="TLS"
		   keystoreFile="conf/keystore/testpsira.jks" keystorePass="111111"
		   truststoreFile="conf/keystore/testpsira.jks"   truststorePass="111111"

其实就是将protocol="HTTP/1.1"替换为protocol="org.apache.coyote.http11.Http11Protocol"，问题得以解决；

APR给Tomcat的性能提升起到很大作用，建议配置APR方式。

题外话：

如果辨别Tomcat是否采用APR：

启动Tomcat时，如果采用APR，日志中会有如下信息：

Python代码

信息: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].

信息: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].

如果没有采用APR，启动时则显示类似的信息：

Python代码

信息: The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: ....后面省略

信息: The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: ....后面省略

Tomcat6.0.33版本自动集成了APR，之前的版本没有集成，需要手工配置，网上搜索会有很多这方面的教程。