解決tomcat6.0.33 配置SSL時報“No Certificate file specified or invalid file format”異常

配置tomcat的SSL雙向握手中，由於6.0.33版本中默認啓用了APR（APR是通過JNI訪問的可移植庫，可以提高Tomcat的性能和伸縮性），所以採用傳統的配置方式（如下）會報異常；

 

傳統的SSL配置：

 

< Connector   port = "443"   protocol = "HTTP/1.1"   SSLEnabled = "true"
           maxThreads = "150"   scheme = "https"   secure = "true"
           clientAuth = "true"   sslProtocol = "TLS"
           keystoreFile = "conf/keystore/test.jks"   keystorePass = "111111"
           truststoreFile = "conf/keystore/test.jks"     truststorePass = "111111"

 

 

 

 

異常如下：

 

2011 - 10 - 27   9 : 26 : 03  org.apache.coyote.http11.Http11AprProtocol init
嚴重: Error initializing endpoint
java.lang.Exception: No Certificate file specified or invalid file format
    at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
    at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:733 )
    at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107 )
    at org.apache.catalina.connector.Connector.initialize(Connector.java:1022 )
    at org.apache.catalina.core.StandardService.initialize(StandardService.java:703 )
    at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838 )
    at org.apache.catalina.startup.Catalina.load(Catalina.java:538 )
    at org.apache.catalina.startup.Catalina.load(Catalina.java:562 )
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39 )
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25 )
    at java.lang.reflect.Method.invoke(Method.java:585 )
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261 )
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413 )
2011 - 10 - 27   9 : 26 : 03  org.apache.catalina.core.StandardService initialize
嚴重: Failed to initialize connector [Connector[HTTP/1.1 - 443 ]]
LifecycleException:  Protocol handler initialization failed: java.lang.Exception: No Certificate file specified or invalid file format
    at org.apache.catalina.connector.Connector.initialize(Connector.java:1024 )
    at org.apache.catalina.core.StandardService.initialize(StandardService.java:703 )
    at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838 )
    at org.apache.catalina.startup.Catalina.load(Catalina.java:538 )
    at org.apache.catalina.startup.Catalina.load(Catalina.java:562 )
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39 )
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25 )
    at java.lang.reflect.Method.invoke(Method.java:585 )
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261 )
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413 )

 

 解決辦法是採用下面的配置：

 

< Connector   port = "443"   protocol = "org.apache.coyote.http11.Http11Protocol"   SSLEnabled = "true"
           maxThreads = "150"   scheme = "https"   secure = "true"
           clientAuth = "true"   sslProtocol = "TLS"
           keystoreFile = "conf/keystore/testpsira.jks"   keystorePass = "111111"
           truststoreFile = "conf/keystore/testpsira.jks"     truststorePass = "111111"

 

其實就是將protocol="HTTP/1.1"替換爲protocol="org.apache.coyote.http11.Http11Protocol"，問題得以解決；

APR給Tomcat的性能提升起到很大作用，建議配置APR方式。

 

題外話：

如果辨別Tomcat是否採用APR：

啓動Tomcat時，如果採用APR，日誌中會有如下信息：

 

信息: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].

 

 

如果沒有采用APR，啓動時則顯示類似的信息：

 

信息: The APR based Apache Tomcat Native library which allows optimal performance  in  production environments was  not  found on the java.library.path: ....後面省略

 

 轉