title: Apache Tomcat SSL Configuration
body: <p>I am trying to configure SSL onn apache Tomcat Java Servlet application working on Unix but have had no luck despite many attempts and trying to find the answer on the web. Can anyone help please. I did the following action:</p>
  
  <p>Generate a Java keystore and key pair</p>
  
  <pre><code> /usr/lib/jvm/java-6-sun-1.6.0.26/bin/keytool -genkey -v -keyalg RSA -alias tomcat
  -keypass changeit -storepass changeit -keystore /mykeystore/keystore.jks -keysize 2048
  </code></pre>
  
  <p>Generate a certificate signing request</p>
  
  <pre><code>/usr/lib/jvm/java-6-sun-1.6.0.26/bin/keytool -certreq -keyalg RSA -alias tomcat -file
  /mykeystore/tomcat.csr -storepass changeit -keystore /mykeystore/keystore.jks
  </code></pre>
  
  <p>Import a root and intermediate CA certificate</p>
  
  <pre><code>vi /mykeystore/root.crt
  
  /usr/lib/jvm/java-6-sun-1.6.0.26/bin/keytool -import -alias root  -trustcacerts -file
  /mykeystore/root.crt -keystore /mykeystore/keystore.jks
  
  vi /mykeystore/tomcat.crt
  
  /usr/lib/jvm/java-6-sun-1.6.0.26/bin/keytool -import -alias tomcat -file /mykeystore
  /tomcat.crt -keystore /mykeystore/keystore.jks
  </code></pre>
  
  <p>Update server.xml</p>
  
  <pre><code>&lt;-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 --&gt;
  &lt;!--
  &lt;Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
         maxThreads="200"
         scheme="https" secure="true" SSLEnabled="true"
         keystoreFile="/mykeystore/keystore.jks" keystorePass="changeit"
         clientAuth="false" sslProtocol="TLS"/&gt;
  </code></pre>
  
  <p>Restart Tomcat</p>
  
  <pre><code>service apache2 restart
  </code></pre>
  
  <p>I get the error:</p>
  
  <p>Listening for transport dt_socket at address: 8000
  24-May-2012 20:54:10 org.apache.catalina.core.AprLifecycleListener init
  INFO: The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: /usr/lib/jvm/java-6-sun-1.6.0.26/jre/lib/i386/server:/usr/lib/jvm/java-6-sun-1.6.0.26/jre/lib/i386:/usr/lib/jvm/java-6-sun-1.6.0.26/jre/../lib/i386:/usr/java/packages/lib/i386:/lib:/usr/lib
  24-May-2012 20:54:11 org.apache.coyote.http11.Http11Protocol init
  INFO: Initializing Coyote HTTP/1.1 on http-8080
  24-May-2012 20:54:12 org.apache.coyote.http11.Http11Protocol init</p>
  
  <pre><code>SEVERE: Error initializing endpoint
  java.io.IOException: jsse.invalid_ssl_conf
  
  at org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:846)
  at org.apache.tomcat.util.net.jsse.JSSESocketFactory.init(JSSESocketFactory.java:522)
  at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:156)
  at org.apache.tomcat.util.net.JIoEndpoint.init(JIoEndpoint.java:538)
  at org.apache.coyote.http11.Http11Protocol.init(Http11Protocol.java:176)
  at org.apache.catalina.connector.Connector.initialize(Connector.java:1022)
  at org.apache.catalina.core.StandardService.initialize(StandardService.java:703)
  at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:838)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:538)
  at org.apache.catalina.startup.Catalina.load(Catalina.java:562)
  at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
  at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
  at java.lang.reflect.Method.invoke(Method.java:597)
  at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:261)
  at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:413)
  
  Caused by: javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL
  cipher suites which are enabled.
  
  at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(SSLServerSocketImpl.java:310)
  at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(SSLServerSocketImpl.java:255)
  at org.apache.tomcat.util.net.jsse.JSSESocketFactory.checkConfig(JSSESocketFactory.java:842)
  ... 15 more
  </code></pre>
  
  <p>24-May-2012 20:54:12 org.apache.catalina.core.StandardService initialize</p>
  
  <p>Please Help. Many Thanks.</p>