# Using let's encrypt with tomcat

**URL:** <https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082>\
**Category:** Server\
**Created:** [August 28, 2017, 10:10am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082 "2017-08-28T10:10:46Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![horus.developer](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@horus.developer](https://community.letsencrypt.org/u/horus.developer)\
**Post date:** [August 28, 2017, 10:10am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/1 "2017-08-28T10:10:46Z")

</div>

So i need to install ssl on tomcat and with self signed certificates we get not secure message, i tried to get the ssl working with pem keys from let’s encrypt that i have on my website, so is there a way to get you CA working on tomcat too?

---

<div class="post-metadata">

**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\
**Post date:** [August 28, 2017, 12:16pm UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/2 "2017-08-28T12:16:36Z")

</div>

Tomcat uses either Java keystore files or pfx files. Personally, I find the latter easier to deal with, but if you prefer to use Java keystore files, [there is a guide here](https://community.letsencrypt.org/t/tutorial-java-keystores-jks-with-lets-encrypt/34754).

To generate a PFX file, with certificates already issued by certbot:

```
cd /etc/letsencrypt/live/yourdomain.com
openssl pkcs12 -export -out bundle.pfx -inkey privkey.pem -in cert.pem -certfile chain.pem -password pass:apassword

```

You can also do this in a [renew hook](https://certbot.eff.org/docs/using.html#renewing-certificates) too so you don’t have to do it manually every three months.

Then, configure tomcat to use it, e.g.:

```auto
<Connector
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="/etc/letsencrypt/live/yourdomain.com/bundle.pfx" keystorePass="apassword"
           clientAuth="false" sslProtocol="TLS" keystoreType="PKCS12"/>

```

If you don’t have a certificate yet and tomcat is listening on port 80, you can obtain one with the http-01 verification method, e.g.

```
sudo certbot certonly --webroot -w /path/to/tomcat/webapps -d yourdomain.com -d www.yourdomain.com

```

EDIT: I updated the tomcat configuration with sahsanu’s advice downthread.

---

<div class="post-metadata">

**Author:** ![horus.developer](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@horus.developer](https://community.letsencrypt.org/u/horus.developer)\
**Post date:** [August 29, 2017, 12:07pm UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/3 "2017-08-29T12:07:30Z")

</div>

Hello i tried this solution but website won’t launch, then i tried to do the guide but when i’m trying to connect with  
TXT Records it won’t work, and i reached the limit. Any other solution?

---

<div class="post-metadata">

**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\
**Post date:** [August 29, 2017, 8:28pm UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/4 "2017-08-29T20:28:42Z")

</div>

Please paste the contents of your `catalina.out` log file so we can figure out what went wrong.

If you’ve reached the limit you have at least five valid certificates on your local machine, so please make sure you don’t delete any certificates from `/etc/letsencrypt` so you are not stuck for a week.

---

<div class="post-metadata">

**Author:** ![horus.developer](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@horus.developer](https://community.letsencrypt.org/u/horus.developer)\
**Post date:** [August 30, 2017, 8:23am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/5 "2017-08-30T08:23:45Z")

</div>

This is the catalina.out:

Aug 29, 2017 8:57:19 AM org.apache.catalina.core.StandardService initInternal  
SEVERE: Failed to initialize connector [Connector[org.apache.coyote.http11.Http11NioProtocol-8443]]  
org.apache.catalina.LifecycleException: Failed to initialize component [Connector[org.apache.coyote.http11.Http11NioProtocol-8443]]  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)  
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:814)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
at org.apache.catalina.startup.Catalina.load(Catalina.java:624)  
at org.apache.catalina.startup.Catalina.load(Catalina.java:649)  
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)  
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)  
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)  
at java.lang.reflect.Method.invoke(Method.java:606)  
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)  
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:450)  
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed  
at org.apache.catalina.connector.Connector.initInternal(Connector.java:976)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
… 12 more  
Caused by: java.io.FileNotFoundException: /etc/letsencrypt/live/famousgadget.pt/bundle.pfx (Permission denied)  
at java.io.FileInputStream.open(Native Method)  
at java.io.FileInputStream.(FileInputStream.java:146)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:400)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)  
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:490)  
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:610)  
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:423)  
at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)  
at org.apache.catalina.connector.Connector.initInternal(Connector.java:974)  
… 13 more

Aug 29, 2017 8:57:19 AM org.apache.catalina.startup.Catalina load  
INFO: Initialization processed in 2371 ms  
Aug 29, 2017 8:57:19 AM org.apache.catalina.core.StandardService startInternal  
INFO: Starting service Catalina  
Aug 29, 2017 8:57:19 AM org.apache.catalina.core.StandardEngine startInternal  
INFO: Starting Servlet Engine: Apache Tomcat/7.0.28  
Aug 29, 2017 8:57:19 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/birt-viewertest  
Aug 29, 2017 8:57:21 AM org.apache.catalina.startup.TaglibUriRule body  
INFO: TLD skipped. URI: [http://www.eclipse.org/birt/taglibs/birt.tld](http://www.eclipse.org/birt/taglibs/birt.tld) is already defined  
Aug 29, 2017 8:57:30 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/birt-runtime-4\_4\_1  
Aug 29, 2017 8:57:31 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/JavaBridge  
Aug 29, 2017 8:57:33 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/ROOT  
Aug 29, 2017 8:57:33 AM org.apache.coyote.AbstractProtocol start  
INFO: Starting ProtocolHandler [“http-bio-8082”]  
Aug 29, 2017 8:57:33 AM org.apache.catalina.startup.Catalina start  
INFO: Server startup in 13837 ms

---

<div class="post-metadata">

**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\
**Post date:** [August 30, 2017, 9:51am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/6 "2017-08-30T09:51:42Z")

</div>

> [@horus.developer](#):
>
> Caused by: java.io.FileNotFoundException: /etc/letsencrypt/live/famousgadget.pt/bundle.pfx **(Permission denied)**

The user tomcat is running as does not have access to the pfx file. You could copy it to the tomcat directory or [set an acl](https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/3/html/System_Administration_Guide/s1-acls-setting.html) granting the appropriate user account access.

---

<div class="post-metadata">

**Author:** ![horus.developer](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@horus.developer](https://community.letsencrypt.org/u/horus.developer)\
**Post date:** [August 31, 2017, 8:32am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/7 "2017-08-31T08:32:11Z")

</div>

I did it now i get the following log:

Aug 31, 2017 8:20:49 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/.well-known  
Aug 31, 2017 8:25:43 AM org.apache.coyote.AbstractProtocol pause  
INFO: Pausing ProtocolHandler [“http-bio-8082”]  
Aug 31, 2017 8:25:43 AM org.apache.coyote.AbstractProtocol pause  
INFO: Pausing ProtocolHandler [“http-nio-8443”]  
Aug 31, 2017 8:25:43 AM org.apache.catalina.core.StandardService stopInternal  
INFO: Stopping service Catalina  
Aug 31, 2017 8:25:43 AM org.apache.catalina.loader.WebappClassLoader clearReferencesThreads  
SEVERE: The web application [/JavaBridge] appears to have started a thread named [JavaBridgeFastCGIRunner] but has failed to stop it. This is very likely to create a memory leak.  
Aug 31, 2017 8:25:43 AM org.apache.coyote.AbstractProtocol stop  
INFO: Stopping ProtocolHandler [“http-bio-8082”]  
Aug 31, 2017 8:25:43 AM org.apache.coyote.AbstractProtocol destroy  
INFO: Destroying ProtocolHandler [“http-bio-8082”]  
Aug 31, 2017 8:25:43 AM org.apache.coyote.AbstractProtocol stop  
INFO: Stopping ProtocolHandler [“http-nio-8443”]  
Aug 31, 2017 8:25:43 AM org.apache.coyote.AbstractProtocol destroy  
INFO: Destroying ProtocolHandler [“http-nio-8443”]  
Aug 31, 2017 8:25:47 AM org.apache.coyote.AbstractProtocol init  
INFO: Initializing ProtocolHandler [“http-bio-8082”]  
Aug 31, 2017 8:25:47 AM org.apache.coyote.AbstractProtocol init  
INFO: Initializing ProtocolHandler [“http-nio-8443”]  
Aug 31, 2017 8:25:47 AM org.apache.coyote.AbstractProtocol init  
SEVERE: Failed to initialize end point associated with ProtocolHandler [“http-nio-8443”]  
java.io.IOException: Invalid keystore format  
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:650)  
at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)  
at java.security.KeyStore.load(KeyStore.java:1214)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)  
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:490)  
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:610)  
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:423)  
at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)  
at org.apache.catalina.connector.Connector.initInternal(Connector.java:974)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:814)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
at org.apache.catalina.startup.Catalina.load(Catalina.java:624)  
at org.apache.catalina.startup.Catalina.load(Catalina.java:649)  
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)  
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)  
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)  
at java.lang.reflect.Method.invoke(Method.java:606)  
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)  
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:450)

Aug 31, 2017 8:25:47 AM org.apache.catalina.core.StandardService initInternal  
SEVERE: Failed to initialize connector [Connector[org.apache.coyote.http11.Http11NioProtocol-8443]]  
org.apache.catalina.LifecycleException: Failed to initialize component [Connector[org.apache.coyote.http11.Http11NioProtocol-8443]]  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:106)  
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:559)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:814)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
at org.apache.catalina.startup.Catalina.load(Catalina.java:624)  
at org.apache.catalina.startup.Catalina.load(Catalina.java:649)  
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)  
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)  
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)  
at java.lang.reflect.Method.invoke(Method.java:606)  
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:281)  
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:450)  
Caused by: org.apache.catalina.LifecycleException: Protocol handler initialization failed  
at org.apache.catalina.connector.Connector.initInternal(Connector.java:976)  
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:102)  
… 12 more  
Caused by: java.io.IOException: Invalid keystore format  
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:650)  
at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)  
at java.security.KeyStore.load(KeyStore.java:1214)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:407)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeystore(JSSESocketFactory.java:306)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:565)  
at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getKeyManagers(JSSESocketFactory.java:505)  
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:490)  
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:610)  
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:423)  
at org.apache.coyote.http11.AbstractHttp11JsseProtocol.init(AbstractHttp11JsseProtocol.java:119)  
at org.apache.catalina.connector.Connector.initInternal(Connector.java:974)  
… 13 more

Aug 31, 2017 8:25:47 AM org.apache.catalina.startup.Catalina load  
INFO: Initialization processed in 2204 ms  
Aug 31, 2017 8:25:47 AM org.apache.catalina.core.StandardService startInternal  
INFO: Starting service Catalina  
Aug 31, 2017 8:25:47 AM org.apache.catalina.core.StandardEngine startInternal  
INFO: Starting Servlet Engine: Apache Tomcat/7.0.28  
Aug 31, 2017 8:25:47 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/birt-viewertest  
Aug 31, 2017 8:25:49 AM org.apache.catalina.startup.TaglibUriRule body  
INFO: TLD skipped. URI: [http://www.eclipse.org/birt/taglibs/birt.tld](http://www.eclipse.org/birt/taglibs/birt.tld) is already defined  
Aug 31, 2017 8:25:56 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/birt-runtime-4\_4\_1  
Aug 31, 2017 8:25:58 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/.well-known  
Aug 31, 2017 8:25:59 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/JavaBridge  
Aug 31, 2017 8:26:00 AM org.apache.catalina.startup.HostConfig deployDirectory  
INFO: Deploying web application directory /var/lib/tomcat7/webapps/ROOT  
Aug 31, 2017 8:26:00 AM org.apache.coyote.AbstractProtocol start  
INFO: Starting ProtocolHandler [“http-bio-8082”]  
Aug 31, 2017 8:26:01 AM org.apache.catalina.startup.Catalina start  
INFO: Server startup in 13275 ms

---

<div class="post-metadata">

**Author:** ![Patches](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/patches/32/17145_2.png) [@Patches](https://community.letsencrypt.org/u/Patches)\
**Post date:** [August 31, 2017, 8:57am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/8 "2017-08-31T08:57:38Z")

</div>

Do you have `keystoreType="JKS"` or so in your `<Connector>`?

If so, change it to `PKCS12` or remove the attribute completely and it will autodetect it.

[I deleted this because I could totally believe @sahsanu that it was required, but then I remembered that I switched my UniFi controller from JKS to PKCS12 without touching its Tomcat configuration, so maybe it depends on the Tomcat version? At any rate, being explicit won’t hurt, so do what he says.]

---

<div class="post-metadata">

**Author:** ![sahsanu](https://sea3.discourse-cdn.com/letsencrypt/user_avatar/community.letsencrypt.org/sahsanu/32/89984_2.png) [@sahsanu](https://community.letsencrypt.org/u/sahsanu)\
**Post date:** [August 31, 2017, 8:59am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/9 "2017-08-31T08:59:28Z")

</div>

Hi @horus.developer,

Following @Patches example conf, try to add `keystoreType="PKCS12"` to the conf and try again.

```
<Connector
           protocol="org.apache.coyote.http11.Http11NioProtocol"
           port="443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreType="PKCS12" keystoreFile="/etc/letsencrypt/live/yourdomain.com/bundle.pfx" keystorePass="apassword"
           clientAuth="false" sslProtocol="TLS"/> 

```

Cheers,  
sahsanu

---

<div class="post-metadata">

**Author:** ![horus.developer](https://avatars.discourse-cdn.com/v4/letter/h/8e8cbc/32.png) [@horus.developer](https://community.letsencrypt.org/u/horus.developer)\
**Post date:** [August 31, 2017, 9:42am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/10 "2017-08-31T09:42:27Z")

</div>

Hello all!  
Thank you very much!! It’s working!

Have a nice day!

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\
**Post date:** [September 30, 2017, 9:42am UTC](https://community.letsencrypt.org/t/using-lets-encrypt-with-tomcat/41082/11 "2017-09-30T09:42:32Z")

</div>

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.