Tomcat 10+OpenJDK17 SSL配置失败问题求助

问题原因 #

Tomcat 10重构了SSL配置模型，引入SSLHostConfig组件统一管理多主机SSL设置。你当前配置错误地将defaultSSLHostConfigName设为密钥库文件名tntkeystore.jks，但并未创建对应主机名的SSLHostConfig元素，导致Tomcat无法匹配到指定的SSL配置项。而Tomcat 9仍兼容旧版全局SSL属性配置逻辑，无需显式定义SSLHostConfig，所以相同配置能正常运行。

解决方案 #

方案1：移除错误的defaultSSLHostConfigName配置 #

如果不需要多主机SSL配置，直接删除该行即可，Tomcat会自动使用默认的SSLHostConfig，同时保留原有的密钥库等核心SSL配置：

修改后的代码：

private Connector createSecuredConnector() {
        try {
            // Create key store file
            final File file = File.createTempFile(getClass().getName(), ".keystore");
            copyInputStreamToFile(getKeyStoreAsStream(), file);
            // Create connector
            final Connector result = new Connector("org.apache.coyote.http11.Http11NioProtocol");
            result.setPort(HTTPS_PORT.getIntValue());
            result.setScheme("https");
            result.setSecure(true);
            result.setProperty("maxHttpHeaderSize","12288");
            // 移除错误的defaultSSLHostConfigName配置
            //result.setProperty("defaultSSLHostConfigName","tntkeystore.jks");
            //result.setProperty("compression", "on");
            result.setProperty("compressableMimeType",
                    "text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml,application/vnd.ms-fontobject,application/font-sfnt");
            result.setProperty("SSLEnabled", "true");
            result.setProperty("keystoreFile", file.getPath());
            result.setProperty("keystorePass", "axway*");
            result.setProperty("sslProtocol", "TLSv1.2");
            result.setProperty("sslEnabledProtocols", "TLSv1.2");
            result.setProperty("ciphers", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384," +
                    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA256," +
                    "TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_SHA,TLS_ECDHE_RSA_WITH_AES_256_SHA384," +
                    "TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,TLS_ECDHE_RSA_WITH_AES_256_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_128_SHA256," +
                    "TLS_DHE_RSA_WITH_AES_128_SHA,TLS_DHE_DSS_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_256_SHA256,TLS_DHE_DSS_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_256_SHA");
            return result;
        } catch (final IOException e) {
            throw new RuntimeException(e);
        }
    }

方案2：显式配置SSLHostConfig（如需多主机支持） #

如果需要为特定主机绑定专属SSL配置，需显式创建SSLHostConfig对象并关联到Connector：

private Connector createSecuredConnector() {
        try {
            // Create key store file
            final File file = File.createTempFile(getClass().getName(), ".keystore");
            copyInputStreamToFile(getKeyStoreAsStream(), file);
            // Create connector
            final Connector result = new Connector("org.apache.coyote.http11.Http11NioProtocol");
            result.setPort(HTTPS_PORT.getIntValue());
            result.setScheme("https");
            result.setSecure(true);
            result.setProperty("maxHttpHeaderSize","12288");
            
            // 创建SSLHostConfig并设置主机名
            SSLHostConfig sslHostConfig = new SSLHostConfig("your-hostname");
            // 绑定密钥库配置到SSLHostConfig
            sslHostConfig.setKeystoreFile(file.getPath());
            sslHostConfig.setKeystorePass("axway*");
            sslHostConfig.setSslProtocol("TLSv1.2");
            sslHostConfig.setSslEnabledProtocols("TLSv1.2");
            sslHostConfig.setCiphers("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384," +
                    "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,TLS_DHE_DSS_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA256," +
                    "TLS_ECDHE_ECDSA_WITH_AES_128_SHA256,TLS_ECDHE_RSA_WITH_AES_128_SHA,TLS_ECDHE_ECDSA_WITH_AES_128_SHA,TLS_ECDHE_RSA_WITH_AES_256_SHA384," +
                    "TLS_ECDHE_ECDSA_WITH_AES_256_SHA384,TLS_ECDHE_RSA_WITH_AES_256_SHA,TLS_ECDHE_ECDSA_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_128_SHA256," +
                    "TLS_DHE_RSA_WITH_AES_128_SHA,TLS_DHE_DSS_WITH_AES_128_SHA256,TLS_DHE_RSA_WITH_AES_256_SHA256,TLS_DHE_DSS_WITH_AES_256_SHA,TLS_DHE_RSA_WITH_AES_256_SHA");
            
            // 将SSLHostConfig添加到Connector
            result.addSslHostConfig(sslHostConfig);
            // 设置defaultSSLHostConfigName为刚才定义的主机名
            result.setProperty("defaultSSLHostConfigName","your-hostname");
            
            result.setProperty("compressableMimeType",
                    "text/html,text/xml,text/plain,text/css,text/javascript,application/javascript,application/json,application/xml,application/vnd.ms-fontobject,application/font-sfnt");
            result.setProperty("SSLEnabled", "true");
            
            return result;
        } catch (final IOException e) {
            throw new RuntimeException(e);
        }
    }

关键说明 #

• Tomcat 10强制要求SSL配置通过SSLHostConfig管理，旧版直接在Connector上设置全局SSL属性的方式已被标记为过时，部分场景会触发配置错误。
• defaultSSLHostConfigName的值必须是已添加到Connector的SSLHostConfig的主机名，不能随意设置为密钥库文件名或其他无关值。

内容的提问来源于stack exchange，提问作者Vivek Srivastava