# Site is still not secure

**URL:** <https://community.letsencrypt.org/t/site-is-still-not-secure/96899>\
**Category:** Help\
**Created:** [June 30, 2019, 5:37pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899 "2019-06-30T17:37:30Z")\
**Posts on this page:** 15\
**Page:** 1

<div class="post-metadata">

**Author:** ![nroborea79](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nroborea79](https://community.letsencrypt.org/u/nroborea79)\
**Post date:** [June 30, 2019, 5:37pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/1 "2019-06-30T17:37:30Z")

</div>

I followed the steps outlined in this video: [https://youtu.be/lNcpLlZbBiw](https://youtu.be/lNcpLlZbBiw)  
I completed the following steps and the site is still not secure:  
Any help would be greatly appreciated.

keytool -genkey -alias tomcat -keyalg RSA -keystore /home/serveradmin/.keystor e -keysize 2048

Enter keystore password:  
Re-enter new password:  
What is your first and last name?  
[Unknown]: [spendwithfriends.com](http://spendwithfriends.com)  
What is the name of your organizational unit?  
[Unknown]: spendwithfriends  
What is the name of your organization?  
[Unknown]: spendwithfriends  
What is the name of your City or Locality?  
[Unknown]: Some city  
What is the name of your State or Province?  
[Unknown]: ST  
What is the two-letter country code for this unit?  
[Unknown]: US  
Is [CN=spendwithfriends.com](http://CN=spendwithfriends.com), OU=spendwithfriends, O=spendwithfriends, L=Some city, ST=ST, C=US corr ect?  
[no]: yes

Enter key password for   
(RETURN if same as keystore password):

Warning:  
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an in dustry standard format using “keytool -importkeystore -srckeystore /home/serveradmin/.keystore -destk eystore /home/serveradmin/.keystore -deststoretype pkcs12”.

# keytool -importkeystore -srckeystore /home/serveradmin/.keystore -destkeystore /home/serveradmin/.keystore -deststoretype pkcs12

Enter source keystore password:  
Entry for alias tomcat successfully imported.  
Import command completed: 1 entries successfully imported, 0 entries failed or cancelled

Warning:  
Migrated “/home/serveradmin/.keystore” to Non JKS/JCEKS. The JKS keystore is backed up as “/home/ serveradmin/.keystore.old”.

# keytool -certreq -alias tomcat -file request.csr -keystore /home/serveradmin/. keystore

Enter keystore password:

# openssl req -text -in request.csr Certificate Request:

```
Data:
    Version: 0 (0x0)
    Subject: C=US, ST=ST, L=Some city, O=spendwithfriends, OU=spendwithfriends, CN=spendwithfr iends.com
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
            Public-Key: (2048 bit)
            Modulus:
                
            Exponent: 65537 (0x10001)
    Attributes:
    Requested Extensions:
        X509v3 Subject Key Identifier:
        {content removed}    
Signature Algorithm: sha256WithRSAEncryption
{content removed} 

```

-----BEGIN CERTIFICATE REQUEST-----  
{content removed}  
-----END CERTIFICATE REQUEST-----

# certbot certonly --http-01-port 8080 --csr request.csr --no-bootstrap Saving debug log to /var/log/letsencrypt/letsencrypt.log

How would you like to authenticate with the ACME CA?

* * *

1: Spin up a temporary webserver (standalone)  
2: Place files in webroot directory (webroot)

* * *

Select the appropriate number [1-2] then [enter] (press ‘c’ to cancel): 1  
Plugins selected: Authenticator standalone, Installer None  
Starting new HTTPS connection (1): [acme-v02.api.letsencrypt.org](http://acme-v02.api.letsencrypt.org)  
Server issued certificate; certificate written to /home/waadmin/0000\_cert.pem  
Cert chain written to   
Cert chain written to

IMPORTANT NOTES:

- Congratulations! Your certificate and chain have been saved at:  
/home/serveradmin/0001\_chain.pem  
Your cert will expire on 2019-09-25. To obtain a new or tweaked  
version of this certificate in the future, simply run certbot  
again. To non-interactively renew _all_ of your certificates, run  
“certbot renew”

- If you like Certbot, please consider supporting our work by:

# keytool -import -trustcacerts -alias tomcat -file 0001\_chain.pem -keystore .keystore

Then modified server.xml:

Bounced tomcat

# iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443

# iptables -t nat -I OUTPUT -p tcp -d 127.0.0.1 --dport 443 -j REDIRECT --to-ports 8443

My web server is (include version): Tomcat 8.5.32

The operating system my web server runs on is (include version): RHEL 7.6

I can login to a root shell on my machine (yes or no, or I don’t know): yes

The version of my client is (e.g. output of `certbot --version` or `certbot-auto --version` if you’re using Certbot): 0.34.2

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [June 30, 2019, 5:51pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/2 "2019-06-30T17:51:26Z")

</div>

Hi @nroborea79

> [@nroborea79](#):
>
> Is [CN=spendwithfriends.com](http://CN=spendwithfriends.com)

you have created two different certificates ( [https://check-your-website.server-daten.de/?q=spendwithfriends.com#ct-logs](https://check-your-website.server-daten.de/?q=spendwithfriends.com#ct-logs) ):

| Issuer | not before | not after | Domain names | LE-Duplicate | next LE |
| --- | --- | --- | --- | --- | --- |
| Let's Encrypt Authority X3 | 2019-06-27 | 2019-09-25 | [spendwithfriends.com](http://spendwithfriends.com) - 1 entries | duplicate nr. 1 | |
| Let's Encrypt Authority X3 | 2019-06-21 | 2019-09-19 | [spendwithfriends.com](http://spendwithfriends.com), [www.spendwithfriends.com](http://www.spendwithfriends.com) - 2 entries | | |

The newer is wrong, it has only one domain name. The older is good, there you have both domain names (non-www and www).

But I see only timeouts:

| Domainname | Http-Status | redirect | Sec. | G |
| --- | --- | --- | --- | --- |
| • [http://spendwithfriends.com/](http://spendwithfriends.com/) | | | | |
| 52.165.170.145 | 200 | | 0.290 | H |
| | | | | |
| • [http://www.spendwithfriends.com/](http://www.spendwithfriends.com/) | | | | |
| 52.165.170.145 | 200 | | 0.296 | H |
| | | | | |
| • [https://spendwithfriends.com/](https://spendwithfriends.com/) | | | | |
| 52.165.170.145 | -14 | | 10.027 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |
| • [https://www.spendwithfriends.com/](https://www.spendwithfriends.com/) | | | | |
| 52.165.170.145 | -14 | | 10.030 | T |
| Timeout - The operation has timed out | | | | |
| | | | | |

So I don't know which certificate is used.

What says

```nohighlight
certbot certificates

```

You should see the old and the new certificate.

Start the row

```nohighlight
keytool -import -trustcacerts -alias tomcat -file 0001_chain.pem -keystore .keystore

```

with the old certificate with both domain names.

Works your Tomcat internal?

```nohighlight
curl https://spendwithfriends.com/
curl https://www.spendwithfriends.com/

```

---

<div class="post-metadata">

**Author:** ![nroborea79](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nroborea79](https://community.letsencrypt.org/u/nroborea79)\
**Post date:** [June 30, 2019, 6:50pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/3 "2019-06-30T18:50:10Z")

</div>

Thank you for the fast response!

Here are the outputs:

# certbot certificates

Saving debug log to /var/log/letsencrypt/letsencrypt.log

* * *

Found the following certs:  
Certificate Name: [spendwithfriends.com](http://spendwithfriends.com)  
Domains: [spendwithfriends.com](http://spendwithfriends.com) [www.spendwithfriends.com](http://www.spendwithfriends.com)  
Expiry Date: 2019-09-19 02:25:04+00:00 (VALID: 80 days)  
Certificate Path: /etc/letsencrypt/live/spendwithfriends.com/fullchain.pem  
Private Key Path: /etc/letsencrypt/live/spendwithfriends.com/privkey.pem

* * *

Looks like this ends with an error:

# keytool -import -trustcacerts -alias tomcat -file /opt/tomcat/conf/ssl/chain.pem -keystore .keystore

Enter keystore password:  
keytool error: java.lang.Exception: Public keys in reply and keystore don’t match

Not sure what needs done to correct this.

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [June 30, 2019, 6:51pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/4 "2019-06-30T18:51:48Z")

</div>

You have to add the private key of this other certificate.

---

<div class="post-metadata">

**Author:** ![nroborea79](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nroborea79](https://community.letsencrypt.org/u/nroborea79)\
**Post date:** [June 30, 2019, 6:56pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/5 "2019-06-30T18:56:18Z")

</div>

Please forgive me for so many questions. I am very new to ssl and securing sites. So do I need to rerun:

# keytool -genkey -alias tomcat -keyalg RSA -keystore /home/waadmin/.keystore -keysize 2048

and input both www and non-www versions of the url?

---

<div class="post-metadata">

**Author:** ![JuergenAuer](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/juergenauer/32/26491_2.png) [@JuergenAuer](https://community.letsencrypt.org/u/JuergenAuer)\
**Post date:** [June 30, 2019, 7:43pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/6 "2019-06-30T19:43:45Z")

</div>

I don’t know, I’ve never used tomcat.

That command `keytool -genkey` looks like a new private key is generated. But you have already the private key in your certbot folder. So you have only to import the correct private key.

Check the documentation of `keytool` how to import an existing private key.

---

<div class="post-metadata">

**Author:** ![nroborea79](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nroborea79](https://community.letsencrypt.org/u/nroborea79)\
**Post date:** [July 18, 2019, 3:49am UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/7 "2019-07-18T03:49:35Z")

</div>

I have completed numerous step-by-step instructions to establish ssl on tomcat using letsencrypt pem files with none of them succeeding. Here are the most recent steps:

$ /etc/letsencrypt/live/spendwithfriends.com  
openssl pkcs12 -export -out fullchain\_and\_key.p12 -in fullchain.pem -inkey privkey.pem -name tomcat

keytool -importkeystore -deststorepass a1rPl@n31 -destkeypass pswd -destkeystore swf.jks -srckeystore fullchain\_and\_key.p12 -srcstoretype PKCS12 -srcstorepass pswd1 -alias tomcat

vi /opt/tomcat/conf/server.xml

Commented out:  
Connector port=“8080” protocol=“HTTP/1.1”  
connectionTimeout=“20000”  
redirectPort=“8443”

Uncommented:  
Connector executor=“tomcatThreadPool”  
port=“8080” protocol=“HTTP/1.1”  
connectionTimeout=“20000”  
redirectPort=“8443”

Configured:  
Connector port=“8443”  
protocol=“org.apache.coyote.http11.Http11Protocol”  
maxThreads=“150”  
SSLEnabled=“true”  
scheme=“https”  
secure=“true”  
keystoreFile="/etc/letsencrypt/live/spendwithfriends.com/swf.jks"  
keystorePass=“pswd”  
clientAuth=“false” sslProtocol=“TLS”

Bounced tomcat.

And still \> site is not secure. ¯\_(ツ)\_/¯

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [July 18, 2019, 4:35am UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/8 "2019-07-18T04:35:25Z")

</div>

Let’s simplify your commands and configuration a little bit.

Begin in the Tomcat directory:

```
cd /opt/tomcat/

```

Define which certificate we’re working with:

```
export CERT_DOMAIN=spendwithfriends.com

```

Convert from Certbot PEMs to PKCS#12:

```
openssl pkcs12 -export -out $CERT_DOMAIN.p12 \
-in /etc/letsencrypt/live/$CERT_DOMAIN/fullchain.pem \
-inkey /etc/letsencrypt/live/$CERT_DOMAIN/privkey.pem \
-passout pass:changeit

```

Then convert from PKCS#12 to JKS:

```
rm -f $CERT_DOMAIN.jks && keytool -importkeystore \
-destkeystore $CERT_DOMAIN.jks \
-srckeystore $CERT_DOMAIN.p12 -srcstoretype PKCS12 \
-deststoretype JKS -srcstorepass changeit -deststorepass changeit

```

Then configure a connector in Tomcat (Tomcat 9 in this case). Note, the absence of the keystore password below only works if you leave the above passwords as `changeit`:

```xml
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
            maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="spendwithfriends.com.jks"
                      type="RSA" />
    </SSLHostConfig>
</Connector>

```

While Tomcat is running, check that it is serving the certificate:

```
openssl s_client -connect localhost:8443 -showcerts | openssl x509 -noout -subject -issuer -dates

```

Assuming you see your certificate’s details appear, that’s all working. Any remaining problems, you can blame on your iptables DNAT.

Edit: I noticed you’re using Tomcat 8, so I’ve also tested these instructions on Tomcat 8.5.43.

---

<div class="post-metadata">

**Author:** ![nroborea79](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nroborea79](https://community.letsencrypt.org/u/nroborea79)\
**Post date:** [July 19, 2019, 2:16am UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/9 "2019-07-19T02:16:56Z")

</div>

\_az,

Thank you very much for the help. I greatly appreciate it. I performed the steps successfully as directed. However, when I perform:

> [@](#):
>
> openssl s\_client -connect localhost:8443 -showcerts | openssl x509 -noout -subject -issuer -dates

it just hangs on the cmd line.

 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/1/7/17c0540039028c49a159e054e8e9fbe0a873b973.png)

I tried the command without the pipe resulting in this output:

> [@](#):
>
> openssl s\_client -connect localhost:8443 -showcerts

It hangs on the cmd line after it states connected.  
 ![image](https://global.discourse-cdn.com/letsencrypt/original/3X/b/3/b304f6d014c5b3c7092f699bdc86a7d0e36c9737.png)

Never have seen this before. Does this mean I have issues with my iptables DNAT?

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [July 19, 2019, 6:35am UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/10 "2019-07-19T06:35:36Z")

</div>

It’s unlikely that iptables is interfering with loopback traffic.

I think it probably means you messed up your `server.xml`. Show the contents of that file, as well as the catalina log for you last server startup.

---

<div class="post-metadata">

**Author:** ![nroborea79](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nroborea79](https://community.letsencrypt.org/u/nroborea79)\
**Post date:** [July 20, 2019, 4:02am UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/11 "2019-07-20T04:02:07Z")

</div>

server.xml:

\<?xml version="1.0" encoding="UTF-8"?\> 

```
<!--The connectors can use a shared executor, you can define one or more named thread pools-->
<!--
<Executor name="tomcatThreadPool" namePrefix="catalina-exec-"
    maxThreads="150" minSpareThreads="4"/>
-->

<!-- A "Connector" represents an endpoint by which requests are received
     and responses are returned. Documentation at :
     Java HTTP Connector: /docs/config/http.html
     Java AJP Connector: /docs/config/ajp.html
     APR (HTTP/AJP) Connector: /docs/apr.html
     Define a non-SSL/TLS HTTP/1.1 Connector on port 8080
-->

<Connector port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />

<!-- A "Connector" using the shared thread pool-->
<!--
<Connector executor="tomcatThreadPool"
           port="8080" protocol="HTTP/1.1"
           connectionTimeout="20000"
           redirectPort="8443" />
-->

<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443
     This connector uses the NIO implementation. The default
     SSLImplementation will depend on the presence of the APR/native
     library and the useOpenSSL attribute of the
     AprLifecycleListener.
     Either JSSE or OpenSSL style configuration may be used regardless of
     the SSLImplementation selected. JSSE style configuration is used below.
-->

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="spendwithfriends.com.jks"
                     type="RSA" />
    </SSLHostConfig>
</Connector>

<!-- Define a SSL/TLS HTTP/1.1 Connector on port 8443 with HTTP/2
     This connector uses the APR/native implementation which always uses
     OpenSSL for TLS.
     Either JSSE or OpenSSL style configuration may be used. OpenSSL style
     configuration is used below.
-->

<!-- Define an AJP 1.3 Connector on port 8009 -->
<Connector port="8009" protocol="AJP/1.3" redirectPort="8443" />

<!-- An Engine represents the entry point (within Catalina) that processes
     every request. The Engine implementation for Tomcat stand alone
     analyzes the HTTP headers included with the request, and passes them
     on to the appropriate Host (virtual host).
     Documentation at /docs/config/engine.html -->

<!-- You should set jvmRoute to support load-balancing via AJP ie :
<Engine name="Catalina" defaultHost="localhost" jvmRoute="jvm1">
-->
<Engine name="Catalina" defaultHost="localhost">

  <!--For clustering, please take a look at documentation at:
      /docs/cluster-howto.html (simple how to)
      /docs/config/cluster.html (reference documentation) -->
  <!--
  <Cluster className="org.apache.catalina.ha.tcp.SimpleTcpCluster"/>
  -->

  <!-- Use the LockOutRealm to prevent attempts to guess user passwords
       via a brute-force attack -->
  <Realm className="org.apache.catalina.realm.LockOutRealm">
    <!-- This Realm uses the UserDatabase configured in the global JNDI
         resources under the key "UserDatabase". Any edits
         that are performed against this UserDatabase are immediately
         available for use by the Realm. -->
    <Realm className="org.apache.catalina.realm.UserDatabaseRealm"
           resourceName="UserDatabase"/>
  </Realm>

  <Host name="localhost" appBase="webapps"
        unpackWARs="true" autoDeploy="true">

    <!-- SingleSignOn valve, share authentication between web applications
         Documentation at: /docs/config/valve.html -->
    <!--
    <Valve className="org.apache.catalina.authenticator.SingleSignOn" />
    -->

    <!-- Access log processes all example.
         Documentation at: /docs/config/valve.html
         Note: The pattern used is equivalent to using pattern="common" -->
    <Valve className="org.apache.catalina.valves.AccessLogValve" directory="logs"
           prefix="localhost_access_log" suffix=".txt"
           pattern="%h %l %u %t &quot;%r&quot; %s %b" />

  </Host>
</Engine>

```

catalina.out:

> [@](#):
>
> OpenJDK 64-Bit Server VM warning: If the number of processors is expected to increase from one, then you should configure the number of parallel GC threads appropriately using -XX:ParallelGCThreads=N  
> 20-Jul-2019 03:46:18.695 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server version: Apache Tomcat/8.5.32  
> 20-Jul-2019 03:46:18.697 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server built: Jun 20 2018 19:50:35 UTC  
> 20-Jul-2019 03:46:18.697 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server number: 8.5.32.0  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name: Linux  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version: 3.10.0-957.el7.x86\_64  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture: amd64  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home: /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version: 1.8.0\_191-b12  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Vendor: Oracle Corporation  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA\_BASE: /opt/tomcat  
> 20-Jul-2019 03:46:18.698 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log CATALINA\_HOME: /opt/tomcat  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.config.file=/opt/tomcat/conf/logging.properties  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.util.logging.manager=org.apache.juli.ClassLoaderLogManager  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.awt.headless=true  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.security.egd=file:/dev/./urandom  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djdk.tls.ephemeralDHKeySize=2048  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.protocol.handler.pkgs=org.apache.catalina.webresources  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dorg.apache.catalina.security.SecurityListener.UMASK=0027  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Xms512M  
> 20-Jul-2019 03:46:18.699 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Xmx1024M  
> 20-Jul-2019 03:46:18.700 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -XX:+UseParallelGC  
> 20-Jul-2019 03:46:18.700 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dignore.endorsed.dirs=  
> 20-Jul-2019 03:46:18.700 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.base=/opt/tomcat  
> 20-Jul-2019 03:46:18.716 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Dcatalina.home=/opt/tomcat  
> 20-Jul-2019 03:46:18.716 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Command line argument: -Djava.io.tmpdir=/opt/tomcat/temp  
> 20-Jul-2019 03:46:18.716 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent The APR based Apache Tomcat Native library which allows optimal performance in production environments was not found on the java.library.path: [/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib]  
> 20-Jul-2019 03:46:18.899 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["http-nio-8080"]  
> 20-Jul-2019 03:46:18.911 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read  
> 20-Jul-2019 03:46:18.930 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["https-jsse-nio-8443"]  
> 20-Jul-2019 03:46:19.308 SEVERE [main] org.apache.catalina.core.StandardService.initInternal Failed to initialize connector [Connector[HTTP/1.1-8443]]  
> org.apache.catalina.LifecycleException: Failed to initialize component [Connector[HTTP/1.1-8443]]  
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:112)  
> at org.apache.catalina.core.StandardService.initInternal(StandardService.java:549)  
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)  
> at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:875)  
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)  
> at org.apache.catalina.startup.Catalina.load(Catalina.java:632)  
> at org.apache.catalina.startup.Catalina.load(Catalina.java:655)  
> at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)  
> at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)  
> at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)  
> at java.lang.reflect.Method.invoke(Method.java:498)  
> at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:309)  
> at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:492)  
> Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed  
> at org.apache.catalina.connector.Connector.initInternal(Connector.java:995)  
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:107)  
> ... 12 more  
> Caused by: java.lang.IllegalArgumentException: Keystore was tampered with, or password was incorrect  
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:116)  
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:87)  
> at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:225)  
> at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1086)  
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.init(AbstractJsseEndpoint.java:268)  
> at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:581)  
> at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:68)  
> at org.apache.catalina.connector.Connector.initInternal(Connector.java:993)  
> ... 13 more  
> Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect  
> at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:780)  
> at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56)  
> at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224)  
> at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70)  
> at java.security.KeyStore.load(KeyStore.java:1445)  
> at org.apache.tomcat.util.net.SSLUtilBase.getStore(SSLUtilBase.java:139)  
> at org.apache.tomcat.util.net.SSLHostConfigCertificate.getCertificateKeystore(SSLHostConfigCertificate.java:204)  
> at org.apache.tomcat.util.net.jsse.JSSEUtil.getKeyManagers(JSSEUtil.java:184)  
> at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:114)  
> ... 20 more  
> Caused by: java.security.UnrecoverableKeyException: Password verification failed  
> at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:778)  
> ... 28 more
> 
> 20-Jul-2019 03:46:19.309 INFO [main] org.apache.coyote.AbstractProtocol.init Initializing ProtocolHandler ["ajp-nio-8009"]  
> 20-Jul-2019 03:46:19.310 INFO [main] org.apache.tomcat.util.net.NioSelectorPool.getSharedSelector Using a shared selector for servlet write/read  
> 20-Jul-2019 03:46:19.314 INFO [main] org.apache.catalina.startup.Catalina.load Initialization processed in 1454 ms  
> 20-Jul-2019 03:46:19.356 INFO [main] org.apache.catalina.core.StandardService.startInternal Starting service [Catalina]  
> 20-Jul-2019 03:46:19.357 INFO [main] org.apache.catalina.core.StandardEngine.startInternal Starting Servlet Engine: Apache Tomcat/8.5.32  
> 20-Jul-2019 03:46:19.363 SEVERE [Catalina-startStop-1] org.apache.catalina.startup.HostConfig.beforeStart Unable to create directory for deployment: [/opt/tomcat/conf/Catalina/localhost]  
> 20-Jul-2019 03:46:19.411 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployWAR Deploying web application archive [/opt/tomcat/webapps/admin-manager.war]  
> 20-Jul-2019 03:46:20.007 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployWAR Deployment of web application archive [/opt/tomcat/webapps/admin-manager.war] has finished in [596] ms  
> 20-Jul-2019 03:46:20.008 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployWAR Deploying web application archive [/opt/tomcat/webapps/ROOT.war]  
> 20-Jul-2019 03:46:24.038 INFO [localhost-startStop-1] org.apache.jasper.servlet.TldScanner.scanJars At least one JAR was scanned for TLDs yet contained no TLDs. Enable debug logging for this logger for a complete list of JARs that were scanned but no TLDs were found in them. Skipping unneeded JARs during scanning can improve startup time and JSP compilation time.  
> 03:46:24.462 [localhost-startStop-1] DEBUG org.springframework.web.context.support.StandardServletEnvironment - Adding PropertySource 'servletConfigInitParams' with lowest search precedence  
> 03:46:24.475 [localhost-startStop-1] DEBUG org.springframework.web.context.support.StandardServletEnvironment - Adding PropertySource 'servletContextInitParams' with lowest search precedence  
> 03:46:24.479 [localhost-startStop-1] DEBUG org.springframework.web.context.support.StandardServletEnvironment - Adding PropertySource 'jndiProperties' with lowest search precedence  
> 03:46:24.479 [localhost-startStop-1] DEBUG org.springframework.web.context.support.StandardServletEnvironment - Adding PropertySource 'systemProperties' with lowest search precedence  
> 03:46:24.480 [localhost-startStop-1] DEBUG org.springframework.web.context.support.StandardServletEnvironment - Adding PropertySource 'systemEnvironment' with lowest search precedence  
> 03:46:24.480 [localhost-startStop-1] DEBUG org.springframework.web.context.support.StandardServletEnvironment - Initialized StandardServletEnvironment with PropertySources [StubPropertySource@1158843957 {name='servletConfigInitParams', properties=java.lang.Object@2ff45b0a}, StubPropertySource@671817031 {name='servletContextInitParams', properties=java.lang.Object@53d8d39a}, JndiPropertySource@48925938 {name='jndiProperties', properties=org.springframework.jndi.JndiLocatorDelegate@fcbbbae}, MapPropertySource@2145021493 {name='systemProperties', properties={java.vendor=Oracle Corporation, sun.java.launcher=SUN\_STANDARD, catalina.base=/opt/tomcat, sun.management.compiler=HotSpot 64-Bit Tiered Compilers, catalina.useNaming=true, os.name=Linux, sun.boot.class.path=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/resources.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/rt.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/sunrsasign.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/jsse.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/jce.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/charsets.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/jfr.jar:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/classes, java.util.logging.config.file=/opt/tomcat/conf/logging.properties, java.vm.specification.vendor=Oracle Corporation, java.runtime.version=1.8.0\_191-b12, user.name=tomcat, tomcat.util.scan.StandardJarScanFilter.jarsToScan=log4j-web\*.jar,log4j-taglib\*.jar,log4javascript\*.jar,slf4j-taglib\*.jar, shared.loader=, tomcat.util.buf.StringCache.byte.enabled=true, java.naming.factory.initial=org.apache.naming.java.javaURLContextFactory, user.language=en, sun.boot.library.path=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/amd64, jdk.tls.ephemeralDHKeySize=2048, java.version=1.8.0\_191, java.util.logging.manager=org.apache.juli.ClassLoaderLogManager, user.timezone=Etc/UTC, sun.arch.data.model=64, java.util.concurrent.ForkJoinPool.common.threadFactory=org.apache.catalina.startup.SafeForkJoinWorkerThreadFactory, java.endorsed.dirs=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/endorsed, sun.cpu.isalist=, sun.jnu.encoding=UTF-8, [file.encoding.pkg=sun.io](http://file.encoding.pkg=sun.io), package.access=sun.,org.apache.catalina.,org.apache.coyote.,org.apache.jasper.,org.apache.tomcat., file.separator=/, java.specification.name=Java Platform API Specification, java.class.version=52.0, user.country=US, java.home=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre, java.vm.info=mixed mode, os.version=3.10.0-957.el7.x86\_64, path.separator=:, java.vm.version=25.191-b12, java.protocol.handler.pkgs=org.apache.catalina.webresources, java.awt.printerjob=sun.print.PSPrinterJob, sun.io.unicode.encoding=UnicodeLittle, awt.toolkit=sun.awt.X11.XToolkit, package.definition=sun.,java.,org.apache.catalina.,org.apache.coyote.,org.apache.jasper.,org.apache.naming.,org.apache.tomcat., java.naming.factory.url.pkgs=org.apache.naming, java.security.egd=file:/dev/./urandom, user.home=/opt/tomcat, org.apache.catalina.security.SecurityListener.UMASK=0027, java.specification.vendor=Oracle Corporation, tomcat.util.scan.StandardJarScanFilter.jarsToSkip=bootstrap.jar,commons-daemon.jar,tomcat-juli.jar,annotations-api.jar,el-api.jar,jsp-api.jar,servlet-api.jar,websocket-api.jar,jaspic-api.jar,catalina.jar,catalina-ant.jar,catalina-ha.jar,catalina-storeconfig.jar,catalina-tribes.jar,jasper.jar,jasper-el.jar,ecj-_.jar,tomcat-api.jar,tomcat-util.jar,tomcat-util-scan.jar,tomcat-coyote.jar,tomcat-dbcp.jar,tomcat-jni.jar,tomcat-websocket.jar,tomcat-i18n-en.jar,tomcat-i18n-es.jar,tomcat-i18n-fr.jar,tomcat-i18n-ja.jar,tomcat-juli-adapters.jar,catalina-jmx-remote.jar,catalina-ws.jar,tomcat-jdbc.jar,tools.jar,commons-beanutils_.jar,commons-codec\*.jar,commons-collections\*.jar,commons-dbcp\*.jar,commons-digester\*.jar,commons-fileupload\*.jar,commons-httpclient\*.jar,commons-io\*.jar,commons-lang\*.jar,commons-logging\*.jar,commons-math\*.jar,commons-pool\*.jar,jstl.jar,taglibs-standard-spec-_.jar,geronimo-spec-jaxrpc_.jar,wsdl4j\*.jar,ant.jar,ant-junit\*.jar,aspectj\*.jar,jmx.jar,h2\*.jar,hibernate\*.jar,httpclient\*.jar,jmx-tools.jar,jta\*.jar,log4j\*.jar,mail\*.jar,slf4j\*.jar,xercesImpl.jar,xmlParserAPIs.jar,xml-apis.jar,junit.jar,junit-_.jar,hamcrest-_.jar,easymock-_.jar,cglib-_.jar,objenesis-_.jar,ant-launcher.jar,cobertura-_.jar,asm-_.jar,dom4j-_.jar,icu4j-_.jar,jaxen-_.jar,jdom-_.jar,jetty-_.jar,oro-_.jar,servlet-api-_.jar,tagsoup-_.jar,xmlParserAPIs-_.jar,xom-_.jar, java.library.path=/usr/java/packages/lib/amd64:/usr/lib64:/lib64:/lib:/usr/lib, java.vendor.url=[http://java.oracle.com/](http://java.oracle.com/), java.vm.vendor=Oracle Corporation, common.loader="${catalina.base}/lib","${catalina.base}/lib/_.jar","${catalina.home}/lib","${catalina.home}/lib/\*.jar", java.runtime.name=OpenJDK Runtime Environment, sun.java.command=org.apache.catalina.startup.Bootstrap start, java.class.path=/opt/tomcat/bin/bootstrap.jar:/opt/tomcat/bin/tomcat-juli.jar, java.vm.specification.name=Java Virtual Machine Specification, java.vm.specification.version=1.8, catalina.home=/opt/tomcat, sun.cpu.endian=little, sun.os.patch.level=unknown, java.awt.headless=true, java.io.tmpdir=/opt/tomcat/temp, java.vendor.url.bug=[http://bugreport.sun.com/bugreport/](http://bugreport.sun.com/bugreport/), server.loader=, os.arch=amd64, java.awt.graphicsenv=sun.awt.X11GraphicsEnvironment, java.ext.dirs=/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.191.b12-1.el7\_6.x86\_64/jre/lib/ext:/usr/java/packages/lib/ext, user.dir=/, line.separator=  
> , java.vm.name=OpenJDK 64-Bit Server VM, ignore.endorsed.dirs=, file.encoding=UTF-8, java.specification.version=1.8}}, SystemEnvironmentPropertySource@1787504215 {name='systemEnvironment', properties={PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin, SHELL=/bin/nologin, CATALINA\_PID=/opt/tomcat/temp/tomcat.pid, JAVA\_HOME=/usr/lib/jvm/jre, CATALINA\_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC, CATALINA\_HOME=/opt/tomcat, JAVA\_OPTS=-Djava.awt.headless=true -Djava.security.egd=file:/dev/./urandom -Djdk.tls.ephemeralDHKeySize=2048 -Djava.protocol.handler.pkgs=org.apache.catalina.webresources -Dorg.apache.catalina.security.SecurityListener.UMASK=0027, JDK\_JAVA\_OPTIONS= --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED, USER=tomcat, LANG=en\_US.UTF-8, CATALINA\_BASE=/opt/tomcat, LOGNAME=tomcat, PWD=/, SHLVL=1, HOME=/opt/tomcat, \_=/usr/lib/jvm/jre/bin/java}}]  
> 03:46:24.483 [localhost-startStop-1] DEBUG org.springframework.web.context.support.StandardServletEnvironment - Replacing PropertySource 'servletContextInitParams' with 'servletContextInitParams'
> 
> . \_\_\_\_ \_ \_\_ \_ \_  
> /\ / _' \_\_ \_ () \_\_ \_\_ \_ \ \ \   
> ( ( )\__\_ | '\_ | '_| | '_ / _` | \ \ \   
> \/ )| |)| | | | | || (| | ) ) ) )  
> ' | __| .\_\_|| |_|_| |_\__ , | / / / /  
> =========|_|==============|_/=///_/  
> :: Spring Boot :: (v1.5.14.RELEASE)
> 
> 2019-07-20 03:46:26.011 INFO 11669 --- [ost-startStop-1] c.s.SpendwithfriendsApplication : Starting SpendwithfriendsApplication v0.0.1 on testVM with PID 11669 (/opt/tomcat/webapps/ROOT/WEB-INF/classes started by tomcat in /)  
> 2019-07-20 03:46:26.012 INFO 11669 --- [ost-startStop-1] c.s.SpendwithfriendsApplication : No active profile set, falling back to default profiles: default  
> 2019-07-20 03:46:26.734 INFO 11669 --- [ost-startStop-1] ationConfigEmbeddedWebApplicationContext : Refreshing org.springframework.boot.context.embedded.AnnotationConfigEmbeddedWebApplicationContext@7cd96125: startup date [Sat Jul 20 03:46:26 UTC 2019]; root of context hierarchy  
> 2019-07-20 03:46:30.095 INFO 11669 --- [ost-startStop-1] trationDelegate$BeanPostProcessorChecker : Bean 'org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration' of type [org.springframework.transaction.annotation.ProxyTransactionManagementConfiguration$$EnhancerBySpringCGLIB$$9ce1af0d] is not eligible for getting processed by all BeanPostProcessors (for example: not eligible for auto-proxying)  
> 2019-07-20 03:46:30.232 INFO 11669 --- [ost-startStop-1] o.s.web.context.ContextLoader : Root WebApplicationContext: initialization completed in 3499 ms  
> 2019-07-20 03:46:31.474 INFO 11669 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean : Mapping filter: 'errorPageFilter' to: [/_]  
> 2019-07-20 03:46:31.474 INFO 11669 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean : Mapping filter: 'characterEncodingFilter' to: [/_]  
> 2019-07-20 03:46:31.475 INFO 11669 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean : Mapping filter: 'hiddenHttpMethodFilter' to: [/_]  
> 2019-07-20 03:46:31.475 INFO 11669 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean : Mapping filter: 'httpPutFormContentFilter' to: [/_]  
> 2019-07-20 03:46:31.475 INFO 11669 --- [ost-startStop-1] o.s.b.w.servlet.FilterRegistrationBean : Mapping filter: 'requestContextFilter' to: [/_]  
> 2019-07-20 03:46:31.476 INFO 11669 --- [ost-startStop-1] .s.DelegatingFilterProxyRegistrationBean : Mapping filter: 'springSecurityFilterChain' to: [/_]  
> 2019-07-20 03:46:31.476 INFO 11669 --- [ost-startStop-1] o.s.b.w.servlet.ServletRegistrationBean : Mapping servlet: 'dispatcherServlet' to [/]  
> 2019-07-20 03:46:34.382 INFO 11669 --- [ost-startStop-1] j.LocalContainerEntityManagerFactoryBean : Building JPA container EntityManagerFactory for persistence unit 'default'  
> 2019-07-20 03:46:34.426 INFO 11669 --- [ost-startStop-1] o.hibernate.jpa.internal.util.LogHelper : HHH000204: Processing PersistenceUnitInfo [  
> name: default  
> ...]  
> 2019-07-20 03:46:34.588 INFO 11669 --- [ost-startStop-1] org.hibernate.Version : HHH000412: Hibernate Core {5.0.12.Final}  
> 2019-07-20 03:46:34.589 INFO 11669 --- [ost-startStop-1] org.hibernate.cfg.Environment : HHH000206: hibernate.properties not found  
> 2019-07-20 03:46:34.611 INFO 11669 --- [ost-startStop-1] org.hibernate.cfg.Environment : HHH000021: Bytecode provider name : javassist  
> 2019-07-20 03:46:34.712 INFO 11669 --- [ost-startStop-1] o.hibernate.annotations.common.Version : HCANN000001: Hibernate Commons Annotations {5.0.1.Final}  
> 2019-07-20 03:46:35.023 INFO 11669 --- [ost-startStop-1] org.hibernate.dialect.Dialect : HHH000400: Using dialect: org.hibernate.dialect.MySQL5Dialect  
> 2019-07-20 03:46:36.305 INFO 11669 --- [ost-startStop-1] org.hibernate.tool.hbm2ddl.SchemaUpdate : HHH000228: Running hbm2ddl schema update  
> 2019-07-20 03:46:36.863 INFO 11669 --- [ost-startStop-1] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'  
> 2019-07-20 03:46:38.938 INFO 11669 --- [ost-startStop-1] o.s.s.web.DefaultSecurityFilterChain : Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@79df094c, org.springframework.security.web.context.SecurityContextPersistenceFilter@4aa53370, org.springframework.security.web.header.HeaderWriterFilter@7424d316, org.springframework.security.web.authentication.logout.LogoutFilter@5aa05f27, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@450eabb2, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@3541b1c9, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@16f97dbb, org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter@591f4d7d, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@563b0da4, org.springframework.security.web.session.SessionManagementFilter@7b393a23, org.springframework.security.web.access.ExceptionTranslationFilter@27a91754, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@55c8ea5c]  
> 2019-07-20 03:46:41.914 INFO 11669 --- [ost-startStop-1] b.a.s.AuthenticationManagerConfiguration :
> 
> 2019-07-20 03:46:42.236 INFO 11669 --- [ost-startStop-1] o.s.j.e.a.AnnotationMBeanExporter : Registering beans for JMX exposure on startup  
> 2019-07-20 03:46:42.283 INFO 11669 --- [ost-startStop-1] c.s.SpendwithfriendsApplication : Started SpendwithfriendsApplication in 17.781 seconds (JVM running for 24.64)  
> 20-Jul-2019 03:46:42.314 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployWAR Deployment of web application archive [/opt/tomcat/webapps/ROOT.war] has finished in [22,306] ms  
> 20-Jul-2019 03:46:42.328 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/opt/tomcat/webapps/docs]  
> 20-Jul-2019 03:46:42.359 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/opt/tomcat/webapps/docs] has finished in [31] ms  
> 20-Jul-2019 03:46:42.359 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/opt/tomcat/webapps/examples]  
> 20-Jul-2019 03:46:42.648 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/opt/tomcat/webapps/examples] has finished in [289] ms  
> 20-Jul-2019 03:46:42.648 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/opt/tomcat/webapps/host-manager]  
> 20-Jul-2019 03:46:42.699 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/opt/tomcat/webapps/host-manager] has finished in [51] ms  
> 20-Jul-2019 03:46:42.699 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deploying web application directory [/opt/tomcat/webapps/manager]  
> 20-Jul-2019 03:46:42.726 INFO [localhost-startStop-1] org.apache.catalina.startup.HostConfig.deployDirectory Deployment of web application directory [/opt/tomcat/webapps/manager] has finished in [27] ms

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [July 20, 2019, 9:12am UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/12 "2019-07-20T09:12:59Z")

</div>

> [@nroborea79](#):
>
> Caused by: java.lang.IllegalArgumentException: Keystore was tampered with, or password was incorrect

Gotta pay attention to exceptions when Tomcat starts!

Are you sure you ran the `openssl` and `keytool` commands verbatim?

What version is your JDK and OpenSSL?

```
openssl version
java -version

```

---

<div class="post-metadata">

**Author:** ![nroborea79](https://avatars.discourse-cdn.com/v4/letter/n/258eb7/32.png) [@nroborea79](https://community.letsencrypt.org/u/nroborea79)\
**Post date:** [July 25, 2019, 10:07pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/13 "2019-07-25T22:07:39Z")

</div>

Yes, I saw that in the stacktrace and attempted to troubleshoot with no success. Yes, I followed your instructions very strictly and entered the commands verbatim aside from changing the password.

OpenSSL 1.0.2k-fips 26 Jan 2017

openjdk version “1.8.0\_191”  
OpenJDK Runtime Environment (build 1.8.0\_191-b12)  
OpenJDK 64-Bit Server VM (build 25.191-b12, mixed mode)

---

<div class="post-metadata">

**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\
**Post date:** [July 25, 2019, 10:29pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/14 "2019-07-25T22:29:19Z")

</div>

Dunno man.

I just copy-pasted my instructions into a completely blank Ubuntu Xenial server (closest package versions to yours I could find) and they work as expected.

```
root@3e27207abe20:/# openssl version
OpenSSL 1.0.2g 1 Mar 2016
root@3e27207abe20:/# java -version
openjdk version "1.8.0_212"
OpenJDK Runtime Environment (build 1.8.0_212-8u212-b03-0ubuntu1.16.04.1-b03)
OpenJDK 64-Bit Server VM (build 25.212-b03, mixed mode)

apache-tomcat-8.5.43.tar.gz
```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [August 24, 2019, 10:29pm UTC](https://community.letsencrypt.org/t/site-is-still-not-secure/96899/15 "2019-08-24T22:29:24Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.