|Summary:||Key password no longer has to be same as keystore password|
|Product:||Tomcat 7||Reporter:||Sebb <sebb>|
|Component:||Documentation||Assignee:||Tomcat Developers Mailing List <dev>|
Description Sebb 2011-03-13 21:21:14 UTC
http://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html#Configuration says: "You MUST use the same password here as was used for the keystore password itself. This is a restriction of the Tomcat implementation." However, surely Tomcat 7 now supports the "keyPass" attribute?
Comment 1 Sebb 2011-03-13 21:23:45 UTC
Does the following paragraph still apply to Tomcat 7? "Note: your private key password and keystore password should be the same. If they differ, you will get an error along the lines of java.io.IOException: Cannot recover key, as documented in Bugzilla issue 38217, which contains further references for this issue."
Comment 2 Sebb 2011-03-13 22:21:09 UTC
I cannot get the keyPass attribute to work, so perhaps it is the other way round - the reference to the keyPass attribute should be removed.
Comment 3 Sebb 2011-03-14 10:19:02 UTC
See also Bug 50928. The attribute "keyPass" is used, but *only* as a default for "keyStorePass". The documentation in http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support says: keyPass : The password used to access the server certificate from the specified keystore file. The default value is "changeit". which is not currently true, so the caveats in SSL Howto do still apply for now.
Comment 4 Mark Thomas 2011-03-15 19:01:06 UTC
Fixed in 7.0.x and will be in 7.0.12 onwards.