1

I am trying to implement SSL for Tomcat on CentOS 6.7. It's not a tick nesting issue, nor does SELinux apply, as other posts address - at least I don't think they do.

The server.xml file has entry:

<Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
               port="443" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS"
               keystoreFile="/usr/share/tomcat/.keystore" keystorePass="password-omitted-for-security"  />

The password is correct and been validated using keytool.

Tomcat owns the file too:

-rwxrwxrwx.   1 tomcat tomcat 7192 Sep  2  2014 .keystore

What would cause the following in catalina.out:

    SEVERE: Failed to initialize end point associated with ProtocolHandler ["http-nio-443"]
    java.net.SocketException: Permission denied
        at sun.nio.ch.Net.bind0(Native Method)
        at sun.nio.ch.Net.bind(Net.java:437)
        at sun.nio.ch.Net.bind(Net.java:429)
        at sun.nio.ch.ServerSocketChannelImpl.bind(ServerSocketChannelImpl.java:223)
        at sun.nio.ch.ServerSocketAdaptor.bind(ServerSocketAdaptor.java:74)
        at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:475)
        at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:651)
        at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:434)
        at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)
        at org.apache.catalina.connector.Connector.initInternal(Connector.java:978)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:821)
        at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:638)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:663)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:497)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:253)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:427)

Per Apache, Tomcat7 should run as daemon. However, their instructions throw their own exception:

-bash: ./bin/jsvc: No such file or directory

So, they mention I may need to specify the VM if client uses different, which it does:

echo $JAVA_HOME
/usr/java/jdk1.7.0_79

and Tomcat7 uses:

/usr/java/jre1.8.0_51

so I used from within $CATALINA_HOME:

./bin/jsvc \ -classpath $CATALINA_HOME/bin/bootstrap.jar:$CATALINA_HOME/bin/tomcat-juli.jar \ 
    -outfile $CATALINA_BASE/logs/catalina.out \ -errfile $CATALINA_BASE/logs/catalina.err \ -Dcatalina.home=$CATALINA_HOME \ 
    -Dcatalina.base=$CATALINA_BASE \ 
    -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager \ 
    -Djava.util.logging.config.file=$CATALINA_BASE/conf/logging.properties \ 
    -jvm /usr/java/jre1.8.0_51 \ 
    org.apache.catalina.startup.Bootstrap

with same results:

-bash: ./bin/jsvc: No such file or directory

Please advise

Roy Hinkley
  • 295
  • 1
  • 5
  • 15
  • Does http://stackoverflow.com/questions/19946292/error-on-configure-tomcat-with-ssl-certificate-using-apr-library-on-ubuntu help? – garethTheRed Feb 20 '16 at 21:59
  • @garethTheRed No, but it reminded me I forgot to set it back to using JSSE. – Roy Hinkley Feb 20 '16 at 22:09
  • 1
    Using a **port below 1024** requires root or capability http://unix.stackexchange.com/questions/10735/linux-allowing-an-user-to-listen-to-a-port-below-1024 http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-l . Easier to do like everyone else: run Tomcat on 8443 and use iptables or a NAT like your router to map external 443 to your 8443. – dave_thompson_085 Feb 21 '16 at 03:03
  • @dave_thompson_085 - I believe your comment is pointing in the right direction - Tomcat needs to run as a `daemon` to access port 443. Trouble is, I cannot get these instructions to work: http://tomcat.apache.org/tomcat-7.0-doc/setup.html – Roy Hinkley Feb 21 '16 at 17:13
  • Running it as daemon or not, by default it runs as tomcat, which is not able to bind to ports < 1024; there are comments here about otherwise. I personally would prefer to have as front end Apache especially if serving services to the Internet at large. As about running it with privileges ports: http://java-notes.com/index.php/installing-tomcat-with-http-port-80-on-linux – Rui F Ribeiro Feb 21 '16 at 20:05
  • @RuiFRibeiro You are correct, but it starts with elevated privileges and establishes ports first. See http://stackoverflow.com/questions/5544713/starting-tomcat-on-port-80-on-centos-release-5-5-final – Roy Hinkley Feb 21 '16 at 20:08

0 Answers0