8

I am trying to change server.xml with Tomcat 8.5 and get the following error when trying to start tomcat:

09-Feb-2017 06:23:25.278 WARNING [main] org.apache.catalina.startup.Catalina.load Catalina.start using conf/server.xml: Error at (135, 20) : Multiple SSLHostConfig elements were provided for the host name [default]. Host names must be unique.

Relevant server.xml code:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11AprProtocol" SSLEnabled="true"
           maxThreads="150" scheme="https" secure="true"
           clientAuth="false" >
  <SSLHostConfig>       
                  keystoreFile="/saswork/sasadmin/tomcat/certs/eccerts" 
                   keystorePass="xxxxxxxx"
                   storepass="xxxxxxxx"
                   truststoreFile="/saswork/sasadmin/tomcat/certs/eccerts"
                   sslProtocol="TLS"
 </SSLHostConfig>   

Advice appreciated on what the error means and suggestions on a solution welcome.

4 Answers 4

51

A quite confusing error "Multiple SSLHostConfig elements" when you clearly only have one.

Turns out this is caused by using deprecated directives.

If you put any of these deprecated attributes in the Connector directive, tomcat assumes you are using the old way and auto creates a SSLHostConfig itself, which then conflicts with the one you are creating.

In your particular case you were using clientAuth="false" on the Connector directive which has become certificateVerification="none" on the SSLHostConfig directive

4
  • 4
    I had the very same problem when using, now deprecated, attribute sslProtocol="TLS"
    – eppesuig
    Commented Aug 3, 2018 at 16:33
  • 1
    This is the correct answer. The accepted answer above uses now long-deprecated configuration parameters. Commented Nov 25, 2020 at 18:06
  • @eppesuig as you indicated that sslProtocol is deprecated what is new correct attribute Commented Jun 30, 2022 at 22:24
  • 2
    @AdinduStevens, the new attribute of SSLHostConfig is protocols.
    – eppesuig
    Commented Jul 2, 2022 at 6:05
8

First, your syntax is incorrect for <SSLHostConfig>. It should be:

<SSLHostConfig>       
    <Certificate ... />
 </SSLHostConfig> 

Also, I've had much better luck putting keystorePass inside of <Connector>.

The only <Connector> that works without failing for me is:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
     maxThreads="150" scheme="https" secure="true"
     keystoreFile="keystore.jks" keyAlias="alias"
     keystorePass="password"
     clientAuth="false" sslProtocol="TLS" />

Otherwise these MultipleSSLHostConfig element errors occur.

2
  • 2
    Thanks v much. I had tried the <Connector> approach initially but was getting errors so ventured down the <SSLHostConfig> route. Based on your feedback I tweaked my <Connector> to replicate yours and all is working now.
    – Ecu
    Commented Feb 13, 2017 at 9:43
  • 1
    By using clientAuth="false" you were accidentally creating a default SSL host config in addition to the one you explicitly declared. This made 2, hence the error. See @muttonUp's excellent answer below. Commented Jan 30, 2018 at 22:55
1

Following sample will definitely work for JKS keystore in Tomcat 8.5:

    <Connector protocol="org.apache.coyote.http11.Http11NioProtocol"
    sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"
        port="443" maxThreads="200"
        scheme="https" secure="true" SSLEnabled="true"
    compression="on" compressionMinSize="1048576"
    compressableMimeType="text/html,text/xml,text/plain,text/javascript,text/css,application/json,application/javascript"
    defaultSSLHostConfigName="*.host.com"      >

<SSLHostConfig protocols="TLSv1.2,+TLSv1.1,+TLSv1"
        ciphers="TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256"
        hostName="*.host.com" >
    <Certificate
        certificateKeyAlias="tomcat"
            certificateKeystoreFile="conf/keystore.jks"
            certificateKeystorePassword="changeit" type="RSA" />
    </SSLHostConfig>
</Connector>
2
0

Here's my configure that works:

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           defaultSSLHostConfigName="your.hostname.com">
    <SSLHostConfig hostName="your.hostname.com" protocols="TLSv1.2,+TLSv1.1,+TLSv1">
        <Certificate certificateKeystoreFile="conf/keystore"
                     type="RSA" certificateKeystorePassword="xxx"/>
    </SSLHostConfig>
</Connector>

I had to set the defaultSSLHostConfigName attribute of the connector and the hostName attribute of the SSLHostConfig.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.