Tomcat 10 SSLHostConfig 问题 - 协议处理程序无法启动 - 必须定义属性certificateFile

Question

我在 macOS 上有 Tomcat 10.0.18（通过 Homebrew）。

在我的server.xml我有

 <Connector port="8443" protocol="org.apache.coyote.http11.Http11Nio2Protocol"
            maxThreads="20" SSLEnabled="true" scheme="https" secure="true" clientAuth="true" defaultSSLHostConfigName="test">
     <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
     <SSLHostConfig>
         <hostName>test</hostName>
         <protocols>TLSv1.2</protocols>
         <certificateVerification>required</certificateVerification>
         <Certificate>
             <caCertificateFile>/Users/jonesn/src/egeria/master/open-metadata-resources/open-metadata-deployment/certificates/EgeriaRootCA.p12</caCertificateFile>
             <certificateFile>/Users/jonesn/src/egeria/master/open-metadata-resources/open-metadata-deployment/certificates/EgeriaServerChassis.p12</certificateFile>
             <certificateKeyPassword>egeria</certificateKeyPassword>
         </Certificate>
     </SSLHostConfig>
 </Connector>

但是，当我启动并连接时，我看到一个错误：

30-Mar-2022 09:51:08.547 INFO [main] org.apache.coyote.http11.AbstractHttp11Protocol.configureUpgradeProtocol The ["https-jsse-nio2-8443"] connector has been configured to
support negotiation to [h2] via ALPN
30-Mar-2022 09:51:08.547 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["https-jsse-nio2-8443"]
30-Mar-2022 09:51:21.162 WARNING [main] org.apache.tomcat.util.net.Nio2Endpoint.shutdownExecutor The executor associated with thread pool [https-jsse-nio2-8443] has not ful
ly shutdown. Some application threads may still be running.
30-Mar-2022 09:51:21.163 SEVERE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to initialize component [Connector[org.apache.coyote.http11.Htt
p11Nio2Protocol-8443]]
        org.apache.catalina.LifecycleException: Protocol handler initialization failed
                at org.apache.catalina.connector.Connector.initInternal(Connector.java:1055)
                at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                at org.apache.catalina.core.StandardService.initInternal(StandardService.java:556)
                at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1042)
                at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:136)
                at org.apache.catalina.startup.Catalina.load(Catalina.java:747)
                at org.apache.catalina.startup.Catalina.load(Catalina.java:769)
                at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
                at java.base/java.lang.reflect.Method.invoke(Method.java:577)
                at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:305)
                at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:475)
        Caused by: java.lang.IllegalArgumentException: SSLHostConfig attribute certificateFile must be defined when using an SSL connector
                at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:99)
                at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
                at org.apache.tomcat.util.net.Nio2Endpoint.bind(Nio2Endpoint.java:132)
                at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1192)
                at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1205)
                at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:580)
                at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:82)
                at org.apache.catalina.connector.Connector.initInternal(Connector.java:1052)
                ... 11 more
        Caused by: java.io.IOException: SSLHostConfig attribute certificateFile must be defined when using an SSL connector
                at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:310)
                at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:245)
                at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:97)
                ... 18 more
30-Mar-2022 09:51:21.164 INFO [main] org.apache.catalina.startup.Catalina.load Server initialization in [13255] milliseconds

是的，据我所知，我确实拥有被赋予的价值。

背景——只是使用我生成的一些自签名证书来测试我们的开源项目的一些相互 SSL 配置。我们使用 Spring Boot 服务器端，各种 Java、Python、Go、Node 等客户端——但为了调试/理解，我只是尝试使用带有curl/HTTPie 客户端的基本 Tomcat。

上面的文件.p12应该包含正确的证书/密钥组合，但这是我正在探索的领域。我可以适应，使用单独的 PEM，通过目录尝试链，但是第一个问题似乎更多的是关于定义配置的基础知识，这也是我试图理解的 - 对 Tomcat 相当陌生。

Answer 1

我想通了 - 所以为了未来读者的利益，我会回答我自己的问题。

解析问题归结为格式。我习惯于编辑其他 XML 文件，例如 maven，我尝试的上述格式是典型的。tomcat 对我来说是新的，所以我意识到它需要是：

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Nio2Protocol"
               maxThreads="20" SSLEnabled="true" scheme="https" secure="true" clientAuth="true" defaultSSLHostConfigName="test">
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol" />
        <SSLHostConfig hostName="test" protocols="TLSv1.2" certificateVerification="required">
            <Certificate
                caCertificateFile="/Users/jonesn/src/egeria/master/open-metadata-resources/open-metadata-deployment/certificates/EgeriaRootCA.p12"
                certificateFile="/Users/jonesn/src/egeria/master/open-metadata-resources/open-metadata-deployment/certificates/EgeriaServerChassis.p12"
                certificateKeyPassword="egeria"
            />
        </SSLHostConfig>
    </Connector>

我现在遇到其他异常 - 但这是特定于证书的，我正在调试。我分享这个是为了专门回答为什么找不到属性的问题。