Всем доброго времени суток!
Помогите, пожалуйста, решить проблему.
Требовалось заменить сертификат на новый в связи с истечением срока действия.
На сервере сертификат хранится в формате JKS.
В конфиге ничего не менял, конвертировал из PFX в JKS с помощью keytool с тем же именем, что в конфиге (с именем старого сертификата), задал тот же пароль и алиас:
C:\>cd C:\Program Files (x86)\Java\jre1.8.0_171\bin\
C:\Program Files (x86)\Java\jre1.8.0_171\bin>keytool.exe
Key and Certificate Management Tool
Commands:
-certreq Generates a certificate request
-changealias Changes an entry's alias
-delete Deletes an entry
-exportcert Exports certificate
-genkeypair Generates a key pair
-genseckey Generates a secret key
-gencert Generates certificate from a certificate request
-importcert Imports a certificate or a certificate chain
-importpass Imports a password
-importkeystore Imports one or all entries from another keystore
-keypasswd Changes the key password of an entry
-list Lists entries in a keystore
-printcert Prints the content of a certificate
-printcertreq Prints the content of a certificate request
-printcrl Prints the content of a CRL file
-storepasswd Changes the store password of a keystore
Use "keytool -command_name -help" for usage of command_name
C:\Program Files (x86)\Java\jre1.8.0_171\bin>keytool -v -list -storetype pkcs12
-keystore astrobl_2019.pfx
Enter keystore password:
Keystore type: PKCS12
Keystore provider: SunJSSE
Your keystore contains 1 entry
Alias name: {4c2553fb-cc3c-4d55-945a-ae0cccccdce1}
Creation date: 04.05.2018
Entry type: PrivateKeyEntry
<...>
*******************************************
*******************************************
C:\Program Files (x86)\Java\jre1.8.0_171\bin>keytool -importkeystore -deststorep
ass 1234567890 -srcalias {4c2553fb-cc3c-4d55-945a-ae0cccccdce1} -destkeystore te
st.jks -srckeystore astrobl_2019.pfx -srcstoretype pkcs12 -srcstorepass 12345 -d
estalias tomcat
Importing keystore astrobl_2019.pfx to test.jks...
Existing entry alias {4c2553fb-cc3c-4d55-945a-ae0cccccdce1} exists, overwrite? [
no]: yes
Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS
12 which is an industry standard format using "keytool -importkeystore -srckeyst
ore test.jks -destkeystore test.jks -deststoretype pkcs12".
После этого через WinSCP копирую полученный JKS на виртуалку, заменяю сертификат в нужной папке, перезапускаю tomcat.
После этого все падает, в логах ошибки и варнинги:
05.05.2018 11:32:43 org.apache.tomcat.util.digester.SetPropertiesRule begin
WARNING: [SetPropertiesRule]{Server/Service/Engine/Host/Context} Setting property 'debug' to '10' did not find a matching property.
05.05.2018 11:32:44 ru.CryptoPro.ssl.d <init>
WARNING: %% No appropriate keys for handshake
05.05.2018 11:32:44 org.apache.coyote.http11.Http11Protocol init
SEVERE: Error initializing endpoint
java.io.IOException: jsse.invalid_ssl_conf
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:846)
<...>
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
Caused by: javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled.
at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(SSLServerSocketImpl.java:310)
at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(SSLServerSocketImpl.java:255)
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:842)
... 15 more
05.05.2018 11:32:44 org.apache.catalina.core.StandardService initialize
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-8443]]
LifecycleException: Protocol handler initialization failed: java.io.IOException: jsse.invalid_ssl_conf
at org.apache.catalina.connector.Connector.initialize(Connector.java:1051)
<...>
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
05.05.2018 11:32:44 org.apache.coyote.http11.Http11Protocol init
INFO: Initializing Coyote HTTP/1.1 on http-8080
05.05.2018 11:32:44 org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 784 ms
05.05.2018 11:32:44 org.apache.catalina.core.StandardService start
INFO: Starting service Catalina
05.05.2018 11:32:44 org.apache.catalina.core.StandardEngine start
INFO: Starting Servlet Engine: Apache Tomcat/6.0.35
Configuring logging from /sitex/saml/oiosaml-sp.log4j.xml, saving logs in /sitex/saml
log4j:WARN No appenders could be found for logger (com.netflix.config.sources.URLConfigurationSource).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See
http://logging.apache.or...4j/1.2/faq.html#noconfig for more info.
11:34:56,333 WARN [SXDsMap.setClassData:534] Error while creating javaBean for SXClass Application. sx.smev.ppu.beans.Application
<...>
11:35:05,849 WARN [IndexedDiskCache.reset:963] Region [dataCache] Reseting cache
Подскажите, что я делаю не так?
Отредактировано пользователем 6 мая 2018 г. 21:47:41(UTC)
| Причина: Не указана
