Tomcat8 SSL/双向SSL通信问题咨询（含SSL配置代码）

First, let's recap your connector configuration for reference:

<Connector port="8743" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="500" scheme="https" secure="true" connectionTimeout="300000" keystoreType="pkcs12" keystoreFile="D:\apps\certs\runtime\certs\testserver.pfx" keystorePass="test" truststoreFile="D:\apps\certs\runtime\caLists\truststore" truststorePass="test" truststoreType="jks" clientAuth="want" sslProtocol="TLS" />

Here are actionable steps to diagnose and fix your SSL/mutual SSL problems:

• Validate Certificate and Truststore Integrity
  Use the keytool utility to confirm your server certificate and truststore are valid and accessible:

  • Check the PKCS12 server certificate:

    keytool -list -v -storetype pkcs12 -keystore D:\apps\certs\runtime\certs\testserver.pfx -storepass test
    

    Verify this command runs without errors and shows the correct certificate details (subject, issuer, validity period).
  • Check the JKS truststore:

    keytool -list -v -keystore D:\apps\certs\runtime\caLists\truststore -storepass test
    

    Ensure the truststore contains the root/intermediate CA certificates that signed your client certificates (required for mutual SSL to work).

• Review Connector Configuration Parameters

  • clientAuth="want" means clients can present a certificate but aren't required to. If you need strict mutual SSL (clients must provide a valid certificate), change this to clientAuth="true".
  • The sslProtocol="TLS" parameter is somewhat vague in Tomcat 8. For better control and security, use sslEnabledProtocols="TLSv1.2,TLSv1.3" to explicitly enable modern TLS versions (avoid outdated protocols like TLSv1.0).
  • Consider switching the protocol to org.apache.coyote.http11.Http11NioProtocol instead of HTTP/1.1—this NIO-based protocol offers better SSL performance and more consistent behavior.

• Check Tomcat Logs for Errors
  Look at Tomcat's core logs (catalina.out, localhost.log in your Tomcat logs directory) for startup or runtime errors. Common issues you might see:

  • "Failed to initialize end point associated with ProtocolHandler": Indicates a problem loading the keystore/truststore (wrong path, incorrect password, corrupted file).
  • "SSL handshake failed": Points to issues with client certificate validation or TLS protocol mismatches.

• Test SSL Connections Directly

  • Use openssl to test basic server SSL connectivity:

    openssl s_client -connect your-server-ip:8743
    

    This will show you if the server presents its certificate correctly and if the TLS handshake completes.
  • For mutual SSL testing, add your client certificate and key to the command:

    openssl s_client -connect your-server-ip:8743 -cert client-cert.pem -key client-key.pem
    

    If the handshake fails here, it's likely a truststore issue (your server doesn't trust the client's CA).

• Verify File Permissions
  Ensure the user running Tomcat has read access to both testserver.pfx and the truststore file. On Windows, check the file's security settings to confirm the Tomcat service account (or the user running Tomcat manually) has permission to read these files.

内容的提问来源于stack exchange，提问作者Subash Suyambuthangam