Hello James,
> -----Ursprüngliche Nachricht-----
> Von: James H. H. Lampert <jam...@touchtonecorp.com.INVALID>
> Gesendet: Donnerstag, 18. Mai 2023 22:01
> An: Tomcat Users List <users@tomcat.apache.org>
> Betreff: Re: AW: Too many certificates in chain?!? Help!
>
> On 5/18/23 12:18 AM, Thomas Hoffmann (Speed4Trade GmbH) wrote:
> > Which version of tomcat do you use?
> > Is the stack trace truncated in your mail? Is there a "caused by ..."
> > further
> down the stacktrace?
> >
> > It looks like the error is thrown deeper in SSLUtil when creating the ssl
> context.
> > Maybe you can post the full stack trace.
>
> It just gets weirder.
>
> FYI, The customer box is on Tomcat 8.5.73, running under IBM Java
> 8.0.7.20 - pap6480sr7fp20-20221020_01(SR7 FP20), under OS/400 V7R3M0.
>
> I fired up one of our on-site AS/400s (V6R1M0), with a Tomcat server
> (7.0.108, running under Java 6), and started plugging in keystores.
> First, I plugged in the initial self-signed keystore. No problem; launched
> just
> fine. Then I plugged in the signed-and-chained keystore.
> Still no problem; launched just fine. Then I plugged in a copy of the signed-
> and-chained keystore that I'd sent back from the customer box.
> STILL no problem!
>
> I also did a "keytool -list -v -keystore xxxxx.ks" on both the new keystore
> and
> the one that worked, on my own Mac. No problems at all, and they looked
> very similar. But when I tried doing it on the customer AS/400, I got very
> similar error messages to what's in catalina.out.
>
> I don't ordinarily send attachments to list servers, but the "how to ask
> questions the smart way" said it should be OK, if small and relevant, and
> stacktraces tend to get a bit garbled if sent inline, so I've attached a brief
> catalina.out excerpt.
>
> --
> JHHL
The relevant line is:
Caused by: java.io.IOException: Too many certificates in chain
at com.ibm.crypto.provider.JavaKeyStore.engineLoad(Unknown Source)
So the error is raised not by tomcat but by the ibm JDK.
It seems the IBM version does something different than other JDKs
Unfortunately, I can't find any sources. Maybe its closed source from IBM.
Do you have to use the IBM JDK or can you use the same JDK as on your working
machine?
Greetings,
Thomas
