title: Mutual authentication with Tomcat 7
body: <p>I'm trying to set up a Java web service running in Tomcat 7 to use mutual (2-way) authentication.  It seems like no matter what I do, connecting to the service on the secure port isn't working.</p>
  
  <p>Here's what I did to create certificates and keystores and such:</p>
  
  <pre><code>//create the key and certificate for the tomcat server.
  keytool -genkey -v -alias tomcat -keyalg RSA -validity 3650 -keystore tomcat.keystore
  
  //create the key and certificate for the client machine.
  keytool -genkey -v -alias clientkey -keyalg RSA -storetype PKCS12 -keystore client.p12
  
  //export the client key
  keytool -export -alias clientkey -keystore client.p12 -storetype PKCS12 -rfc -file client.cer
  
  //import the client key into the server keystore
  keytool -import -v -file client.cer -keystore tomcat.keystore
  </code></pre>
  
  <p>Here's the connector in the server.xml file:</p>
  
  <pre><code>&lt;Connector port="8443"
      maxThreads="150"
      scheme="https"
      secure="true"
      sslProtocol="TLS"
      clientAuth="true"
      keystoreFile="tomcat.keystore"
      keystorePass="tomcat"
      truststoreFile="tomcat.keystore"
      truststorePass="tomcat"/&gt;
  </code></pre>
  
  <p>The tomcat-users.xml file looks like this:</p>
  
  <pre><code>&lt;tomcat-users&gt;
      &lt;role rolename="tomcat"/&gt;
      &lt;role rolename="admin"/&gt;
      &lt;!-- note that the actual values for CN, OU, O, L, ST are different, but they match the values created in the client certificate --&gt;
      &lt;user username="CN=name, OU=unit, O=org, L=locality, ST=state, C=US" password="null" roles="admin" /&gt;
  &lt;/tomcat-users&gt;
  </code></pre>
  
  <p>The following are set on startup:</p>
  
  <pre><code>-Djavax.net.ssl.keyStoreType=jks
  -Djavax.net.ssl.keyStore=tomcat.keystore
  -Djavax.net.ssl.keyStorePassword=tomcat
  -Djavax.net.ssl.trustStore=tomcat.keystore
  -Djavax.net.ssl.trustStorePassword=tomcat
  -Djavax.net.debug=SSL
  </code></pre>
  
  <p>Finally, I copied the client.p12 file to my client machine, and imported it into Firefox's client certificates.</p>
  
  <p>First problem:
  When I hit an endpoint on my service (example - <a href="https://my.server.com:8443/test">https://my.server.com:8443/test</a>) from Firefox, I get the response "Secure Connection Failed".  SSL received a record that exceeded the maximum permissible length. (Error code: ssl_error_rx_record_too_long) </p>
  
  <p>Second problem:
  I don't really want to run this connector on port 8443.  I want to run it on port 7800 (which is our company standard for HTTPS).  When I change the port on the Connector to 7800 and try to hit the endpoint (example - <a href="https://my.server.com:7800/test">https://my.server.com:7800/test</a>) then it never resolves the page.</p>
  
  <p>So, somewhere I'm obviously missing a crucial piece.  Can anyone see my error?</p>
  
  <p>UPDATE: after feedback from @Dave G</p>
  
  <p>Running the command:</p>
  
  <pre><code>openssl s_client -connect localhost:8443 -showcerts
  </code></pre>
  
  <p>produces the following output:</p>
  
  <pre><code>CONNECTED(00000003)
  140642290976584:error:140770FC:SSL routines:SSL23_GET_SERVER_HELLO:unknown protocol:s23_clnt.c:766:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 7 bytes and written 263 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  ---
  </code></pre>
  
  <p>I also added -Djavax.net.debug=SSL to the startup.  This generates the following in the beginning of the catalina.out file:</p>
  
  <pre><code>trustStore is: tomcat.keystore
  trustStore type is : jks
  trustStore provider is :
  init truststore
  adding as trusted cert:
    Subject: CN=localhost, OU=unit, O=org, L=Springfield, ST=MO, C=US
    Issuer:  CN=localhost, OU=unit, O=org, L=Springfield, ST=MO, C=US
    Algorithm: RSA; Serial number: 0x5485b5a5
    Valid from Mon Dec 08 14:28:53 UTC 2014 until Thu Dec 05 14:28:53 UTC 2024
  
  adding as trusted cert:
    Subject: CN=William Jackson, OU=unit, O=org, L=Springfield, ST=MO, C=US
    Issuer:  CN=William Jackson, OU=unit, O=org, L=Springfield, ST=MO, C=US
    Algorithm: RSA; Serial number: 0x5485b6af
    Valid from Mon Dec 08 14:33:19 UTC 2014 until Sun Mar 08 14:33:19 UTC 2015
  
  trigger seeding of SecureRandom
  done seeding SecureRandom
  </code></pre>
  
  <p>And then a LOT of:</p>
  
  <pre><code>Ignoring unavailable cipher suite: &lt;suite name&gt;
  Ignoring unsupported cipher suite: &lt;suite name&gt;
  </code></pre>