傳統的SSL配置:
- <Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"
- maxThreads="150" scheme="https" secure="true"
- clientAuth="true" sslProtocol="TLS"
- keystoreFile="conf/keystore/test.jks" keystorePass="111111"
- truststoreFile="conf/keystore/test.jks" truststorePass="111111"
異常如下:
- 2011-10-27 9:26:03 org.apache.coyote.http11.Http11AprProtocol init
- 嚴重: Error initializing endpoint
- java.lang.Exception: No Certificate file specified or invalid file format
- at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
- at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:733)
- at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107)
- at org.apache.catalina.connector.Connector.initialize(Connector.java:1022)
- at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
- at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
- at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
- at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
- at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
- at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
- at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
- at java.lang.reflect.Method.invoke(Method.java:585)
- at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
- at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
- 2011-10-27 9:26:03 org.apache.catalina.core.StandardService initialize
- 嚴重: Failed to initialize connector [Connector[HTTP/1.1-443]]
- LifecycleException: Protocol handler initialization failed: java.lang.Exception: No Certificate file specified or invalid file format
- at org.apache.catalina.connector.Connector.initialize(Connector.java:1024)
- at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
- at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
- at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
- at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
- at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
- at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
- at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
- at java.lang.reflect.Method.invoke(Method.java:585)
- at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
- at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
解決辦法是採用下面的配置:
- <Connector port="443" protocol="org.apache.coyote.http11.Http11Protocol" SSLEnabled="true"
- maxThreads="150" scheme="https" secure="true"
- clientAuth="true" sslProtocol="TLS"
- keystoreFile="conf/keystore/testpsira.jks" keystorePass="111111"
- truststoreFile="conf/keystore/testpsira.jks" truststorePass="111111"
其實就是將protocol="HTTP/1.1"替換爲protocol="org.apache.coyote.http11.Http11Protocol",問題得以解決;
APR給Tomcat的性能提升起到很大作用,建議配置APR方式。
題外話:
如果辨別Tomcat是否採用APR:
啓動Tomcat時,如果採用APR,日誌中會有如下信息:
- 信息: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
如果沒有采用APR,啓動時則顯示類似的信息:
- 信息: The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: ....後面省略
Tomcat6.0.33版本自動集成了APR,之前的版本沒有集成,需要手工配置,網上搜索會有很多這方面的教程。