(Код ошибки: ssl_error_rx_record_too_long) Tomcat + OpenSSL

Question

Я пытаюсь включить SSL в своем Tomcat.Но когда я запускаю Tomcat и захожу на https://localhost:8443, я вижу

An error occurred during a connection to localhost:8443.

SSL received a record that exceeded the maximum permissible length.

(Error code: ssl_error_rx_record_too_long)

. Для этого я использовал CA.sh для генерации закрытого ключа и подписанного сертификата, например:

progerlaptop:/usr/share/ssl/misc # ./CA.sh -newca
CA certificate filename (or enter to create)

Making CA certificate ...
Generating a 1024 bit RSA private key
................................++++++
.............................................++++++
writing new private key to './demoCA/private/./cakey.pem'
Enter PEM pass phrase: pass
Verifying - Enter PEM pass phrase: pass
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:UK
State or Province Name (full name) [Some-State]:Chernihiv
Locality Name (eg, city) []:Chernihiv
Organization Name (eg, company) [Internet Widgits Pty Ltd]:University
Organizational Unit Name (eg, section) []:student
Common Name (eg, YOUR name) []:localhost
Email Address []:proger@localhost

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/./cakey.pem:
Check that the request matches the signature
Signature ok
Certificate Details:
        Serial Number:
            c6:55:7e:58:1b:4d:9c:7e
        Validity
            Not Before: Nov 25 13:17:31 2010 GMT
            Not After : Nov 24 13:17:31 2013 GMT
        Subject:
            countryName               = UK
            stateOrProvinceName       = Chernihiv
            organizationName          = University
            organizationalUnitName    = student
            commonName                = localhost
            emailAddress              = proger@localhost
        X509v3 extensions:
            X509v3 Subject Key Identifier: 
                C7:98:1E:68:A7:3A:C4:B2:46:C8:88:99:C8:D5:CA:66:D3:94:23:66
            X509v3 Authority Key Identifier: 
                keyid:C7:98:1E:68:A7:3A:C4:B2:46:C8:88:99:C8:D5:CA:66:D3:94:23:66

            X509v3 Basic Constraints: 
                CA:TRUE
Certificate is to be certified until Nov 24 13:17:31 2013 GMT (1095 days)

Write out database with 1 new entries
Data Base Updated
progerlaptop:/usr/share/ssl/misc # ./CA.sh -newreq
Generating a 1024 bit RSA private key
............++++++
.........................++++++
writing new private key to 'newkey.pem'
Enter PEM pass phrase: pass
Verifying - Enter PEM pass phrase: pass
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:UK
State or Province Name (full name) [Some-State]:Chernihiv
Locality Name (eg, city) []:Chernihiv
Organization Name (eg, company) [Internet Widgits Pty Ltd]:University
Organizational Unit Name (eg, section) []:student
Common Name (eg, YOUR name) []:localhost
Email Address []:proger@localhost

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:
Request is in newreq.pem, private key is in newkey.pem

progerlaptop:/usr/share/ssl/misc # CA.sh -sign
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem: pass
...
Sign the certificate? [y/n]:y
...
Signed certificate is in newcert.pem

Скопировал ключ и сертификат в мой каталог Tomcat.

cp newcert.pem newkey.pem /path/to/tomcat-6.0.29/ssl/

Добавлен Соединитель к моему server.xml:

   <Connector port="8443" maxHttpHeaderSize="8192" 
      maxThreads="150" minSpareThreads="25" maxSpareThreads="75" 
      enableLookups="false" disableUploadTimeout="true" 
      acceptCount="100" scheme="https" secure="true" 
      SSLEngine="on". 
      SSLCertificateFile="${catalina.base}/ssl/newcert.pem" 
      SSLCertificateKeyFile="${catalina.base}/ssl/newkey.pem". 
      SSLPassword="pass"/>

Затем я запускаю catalina.sh run.И когда я перехожу на https://localhost:8443/, я вижу эту неприятную ошибку.Когда я делаю неправильно?Заранее спасибо

Answer 1

Tomcat 6 и выше? Вам нужно установить SSLEnabled = "true", как уже отвечено здесь или здесь .

Answer 2

Мне удалось решить эту проблему, изменив значение port .Значение 443 было зарезервировано, поэтому я поставил 1443, перезапустите Tomcat, и он заработал.

Мой Connector:

<Connector port="1443" protocol="HTTP/1.1" SSLEnabled="true"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLS" keystoreFile="D:/path_to_ca.jks" 
    keystorePass="somePass" />

Теперь URL-адрес:

https://localhost:1443/index.jsp

Ура!

Answer 3

У меня была такая же проблема. Я исправил это, добавив protocol="org.apache.coyote.http11.Http11NioProtocol" к разъему

Answer 4

Надеюсь, у вас должен быть файл хранилища ключей на вашем компьютере.

Убедитесь, что в файле server.xml есть ссылка на ссылку , которая может помочь вам решить

     <Connector port=”8443” maxHttpHeaderSize=”8192″
      maxThreads=”150″ minSpareThreads=”25″ maxSpareThreads=”75″
      enableLookups=”false” disableUploadTimeout=”true”
      acceptCount=”100″ scheme=”https” secure=”true”
      **keystoreFile=”/../../../Tomcat/mycert.jks”**
      clientAuth=”false” sslProtocol=”TLS>

Answer 5

Похоже, вы используете APR / OpenSSL для https, и в этом случае SSLEngine = "on" является правильным.

Вы установили libtcnative?

Предположим, кот 6: http://tomcat.apache.org/tomcat-6.0-doc/ssl-howto.html

Быстрые шаги:

tar zxf tomcat-native-1.1.20-src.tar.gz
cd tomcat-native-1.1.20-src/jni/native/
./configure --with-apr=/usr/bin/apr-1-config --with-ssl=yes
make && make install
cd /usr/java/default/jre/lib/amd64/
ln -s /usr/local/apr/lib/libtcnative-1.so

Когда вы запускаете tomcat, вы должны увидеть эту строку в вашем catalina.out:

INFO: Loaded APR based Apache Tomcat Native library 1.1.20.

Альтернативой является использование JSSE и добавление ваших сертификатов / ключей в хранилище ключей Java (файл .keystore). Я нахожу java keystore боль в заднице, чтобы использовать, поэтому я обычно иду с APR.