解决tomcat6.0.33 配置SSL时报“No Certificate file specified or invalid file format”异常

配置tomcat的SSL双向握手中，由于6.0.33版本中默认启用了APR（APR是通过JNI访问的可移植库，可以提高Tomcat的性能和伸缩性），所以采用传统的配置方式（如下）会报异常；

 

传统的SSL配置：

<
Connector
 
port
=
"443"
 
protocol
=
"HTTP/1.1"
 
SSLEnabled
=
"true"
           maxThreads
=
"150"
 
scheme
=
"https"
 
secure
=
"true"
           clientAuth
=
"true"
 
sslProtocol
=
"TLS"
           keystoreFile
=
"conf/keystore/test.jks"
 
keystorePass
=
"111111"
           truststoreFile
=
"conf/keystore/test.jks"
   
truststorePass
=
"111111"

 

 

 

异常如下：

2011
-
10
-
27
 
9
:
26
:
03
 org.apache.coyote.http11.Http11AprProtocol init
严重: Error initializing endpoint
java.lang.Exception: No Certificate file specified or invalid file format
    at org.apache.tomcat.jni.SSLContext.setCertificate(Native Method)
    at org.apache.tomcat.util.net.AprEndpoint.init(AprEndpoint.java:733
)
    at org.apache.coyote.http11.Http11AprProtocol.init(Http11AprProtocol.java:107
)
    at org.apache.catalina.connector.Connector.initialize(Connector.java:1022
)
    at org.apache.catalina.core.StandardService.initialize(StandardService.java:703
)
    at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838
)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:538
)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:562
)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39
)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25
)
    at java.lang.reflect.Method.invoke(Method.java:585
)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261
)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413
)
2011
-
10
-
27
 
9
:
26
:
03
 org.apache.catalina.core.StandardService initialize
严重: Failed to initialize connector [Connector[HTTP/1.1
-
443
]]
LifecycleException:  Protocol handler initialization failed: java.lang.Exception: No Certificate file specified or invalid file format
    at org.apache.catalina.connector.Connector.initialize(Connector.java:1024
)
    at org.apache.catalina.core.StandardService.initialize(StandardService.java:703
)
    at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838
)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:538
)
    at org.apache.catalina.startup.Catalina.load(Catalina.java:562
)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39
)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25
)
    at java.lang.reflect.Method.invoke(Method.java:585
)
    at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261
)
    at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413
)

 解决办法是采用下面的配置：

<
Connector
 
port
=
"443"
 
protocol
=
"org.apache.coyote.http11.Http11Protocol"
 
SSLEnabled
=
"true"
           maxThreads
=
"150"
 
scheme
=
"https"
 
secure
=
"true"
           clientAuth
=
"true"
 
sslProtocol
=
"TLS"
           keystoreFile
=
"conf/keystore/testpsira.jks"
 
keystorePass
=
"111111"
           truststoreFile
=
"conf/keystore/testpsira.jks"
   
truststorePass
=
"111111"

其实就是将protocol="HTTP/1.1"替换为protocol="org.apache.coyote.http11.Http11Protocol"，问题得以解决；

APR给Tomcat的性能提升起到很大作用，建议配置APR方式。

 

题外话：

如果辨别Tomcat是否采用APR：

启动Tomcat时，如果采用APR，日志中会有如下信息：

信息: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].

 

如果没有采用APR，启动时则显示类似的信息：

信息: The APR based Apache Tomcat Native library which allows optimal performance 
in
 production environments was 
not
 found on the java.library.path: ....后面省略

 转