Ssl – Can Tomcat reload its SSL certificate without being restarted

ssltomcat

I have a background process that can update the keystore Tomcat uses for its SSL credentials. I would like to be able to have Tomcat reload this automatically without needing a manual restart.

Is it possible to have Tomcat reload this without restarting, or is there a programmatic way that it could be done instead?

Best Answer

I don't believe there is a way to do it automatically although your background process could restart tomcat automatically. The keystore only gets read once when the jvm is initialized. There might be a solution if you were to write your own handler that periodically re-checks the keystore but I personally haven't found any examples of this on the Internet.

Related Solutions

Ssl – How to update SSL certificate with Tomcat 5.5

The fact that it's registering as a TrustedCert would seem to indicate that there's no key for tomcat3. It's likely that the new certificate was requested for the existing key tomcat2. Keys themselves don't expire, just the certificates.

You can request a new certificate at any time either by generating a new cert signing request or by reusing the original one either of which is fine. Take a backup copy of your keystore and then import the certificate for the tomcat2 alias.

%JAVA_HOME%\bin\keytool -import -keystore companyname.keystore -alias tomcat2 -file 2009cert.cer

After that, you'll also want to point your tomcat instance back at tomcat2.

Ssl – Untrusted certificate warning on replacement SSL certificate

The problem ended up being that I when I entered the domain name for the Distinguished Name information while generating the key, I used an asterisk, e.g.: *.myserver.com, thinking this would cover me for myserver.com, www.myserver.com, etc. However, the asterisk is only appropriate for "wildcard" certificates, which I apparently don't have.

So I regenerated the key using just "myserver.com", and it worked just fine. And for some reason it still works for both "myserver.com" and "www.myserver.com".

Incidentally, this site was very helpful to me in diagnosing this problem:

http://www.sslshopper.com/ssl-checker.html

Best Answer

Related Solutions

Ssl – How to update SSL certificate with Tomcat 5.5

Ssl – Untrusted certificate warning on replacement SSL certificate

Related Topic