SSL error in Tomcat 8 Catalina logs
Hi,
We are using Apache Tomcat 8.5.11 and are seeing the below error messages in our logs every second which is filling up the tomcat logs. We are not using openssl anywhere. Do you know what could be reason for this error?
20-Apr-2017 00:37:25.512 WARNING [https-openssl-nio-443-exec-2] org.apache.coyote.AbstractProcessor.populateSslRequestAttributes Exception getting SSL attributes
java.lang.IllegalStateException: SSL session ID not available
at org.apache.tomcat.util.net.openssl.OpenSSLEngine$OpenSSLSession.getId(OpenSSLEngine.java:1048)
at org.apache.tomcat.util.net.jsse.JSSESupport.getSessionId(JSSESupport.java:156)
at org.apache.coyote.AbstractProcessor.populateSslRequestAttributes(AbstractProcessor.java:605)
at org.apache.coyote.AbstractProcessor.action(AbstractProcessor.java:358)
at org.apache.coyote.Request.action(Request.java:393)
at org.apache.catalina.connector.Request.getAttribute(Request.java:900)
at org.apache.catalina.connector.Request.getAttributeNames(Request.java:982)
at org.apache.catalina.connector.RequestFacade.getAttributeNames(RequestFacade.java:298)
at com.pega.pegarules.web.impl.HttpUtilities.extractRequest(HttpUtilities.java:175)
at com.pega.pegarules.web.impl.WebStandardImpl.makeEtierRequest(WebStandardImpl.java:528)
at com.pega.pegarules.web.impl.WebStandardImpl.doPost(WebStandardImpl.java:378)
at sun.reflect.GeneratedMethodAccessor85.invoke(Unknown Source)
Hi,
We are using Apache Tomcat 8.5.11 and are seeing the below error messages in our logs every second which is filling up the tomcat logs. We are not using openssl anywhere. Do you know what could be reason for this error?
20-Apr-2017 00:37:25.512 WARNING [https-openssl-nio-443-exec-2] org.apache.coyote.AbstractProcessor.populateSslRequestAttributes Exception getting SSL attributes
java.lang.IllegalStateException: SSL session ID not available
at org.apache.tomcat.util.net.openssl.OpenSSLEngine$OpenSSLSession.getId(OpenSSLEngine.java:1048)
at org.apache.tomcat.util.net.jsse.JSSESupport.getSessionId(JSSESupport.java:156)
at org.apache.coyote.AbstractProcessor.populateSslRequestAttributes(AbstractProcessor.java:605)
at org.apache.coyote.AbstractProcessor.action(AbstractProcessor.java:358)
at org.apache.coyote.Request.action(Request.java:393)
at org.apache.catalina.connector.Request.getAttribute(Request.java:900)
at org.apache.catalina.connector.Request.getAttributeNames(Request.java:982)
at org.apache.catalina.connector.RequestFacade.getAttributeNames(RequestFacade.java:298)
at com.pega.pegarules.web.impl.HttpUtilities.extractRequest(HttpUtilities.java:175)
at com.pega.pegarules.web.impl.WebStandardImpl.makeEtierRequest(WebStandardImpl.java:528)
at com.pega.pegarules.web.impl.WebStandardImpl.doPost(WebStandardImpl.java:378)
at sun.reflect.GeneratedMethodAccessor85.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
at com.pega.pegarules.internal.bootstrap.PRBootstrap.invokeMethod(PRBootstrap.java:370)
at com.pega.pegarules.internal.bootstrap.PRBootstrap.invokeMethodPropagatingThrowable(PRBootstrap.java:411)
at com.pega.pegarules.boot.internal.extbridge.AppServerBridgeToPega.invokeMethodPropagatingThrowable(AppServerBridgeToPega.java:224)
at com.pega.pegarules.boot.internal.extbridge.AppServerBridgeToPega.invokeMethod(AppServerBridgeToPega.java:273)
at com.pega.pegarules.internal.web.servlet.WebStandardBoot.doPost(WebStandardBoot.java:121)
at com.pega.pegarules.internal.web.servlet.WebStandardBoot.doGet(WebStandardBoot.java:92)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:230)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:192)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:165)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:474)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:624)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:349)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:783)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:798)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1434)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Unknown Source)
Accepted Solution
Pegasystems Inc.
US
As John mentioned, this is most likely a tomcat defect: see this link: http://stackoverflow.com/questions/40512983/tomcat-8-ssl-session-id-not-available. I have verified that if you follow the link, the error will go away.
Pegasystems Inc.
GB
I have never seen this error before: but it looks like an issue with Tomcat; rather than PRPC itself.
The error is discussed in this third-party post (NB; for Tomcat 9): http://stackoverflow.com/questions/38178536/tomcat-ssl-illegalstateexception-ssl-session-id-not-available
Which mentions 'Tomcat Native Library' configuration as a possible reason for the error.
See this Tomcat page for information about that:
http://tomcat.apache.org/native-doc/
Maybe somebody enabled this facility on your system ?
Pegasystems Inc.
GB
Additionally (again, referring to the StackOverFlow Post) : see this : https://tomcat.apache.org/tomcat-8.5-doc/config/http.html#SSL_Support
Search for "disableSessionTickets" in the docs.
Then cross-check with your 'server.xml' - in particular your 'CONNECTORS' section - is this flag set ?
Pai G
IN
hi PritJ,
I have tried the above steps by adding disableSessionTickets="true" in my Connector config in "server.xml" file but it still did not work. We are still seeing this error. Also, I did not enable any tomcat native libraries.
Pegasystems Inc.
GB
So the error is not a PRPC error per say for sure.
Can you try this:
1. Stop Tomcat.
2. *break* your server.xml on purpose: enter in (say) an unfinished tag like "<bad" at top of the file.
3. Restart Tomcat.
Tomcat should fail to start: that will prove the correct 'server.xml' is being picked up.
We need to be sure we are editing the correct 'server.xml' for this configuration : just need to eliminate this as a possibility. (Are you using 'split' configuration etc) ?
Also: consider this test also:
1. Shutdown Tomcat.
2. Rename your 'webapps' directory to 'webapps_backup'.
3. Create an empty 'webapps' directory.
4. Restart Tomcat.
Do you will still the SSL errors ?
(To reverse the test: stop Tomcat; delete the empty 'webapps' directory and rename 'webapps_backup' to 'webapps' again).
Accepted Solution
Pegasystems Inc.
US
As John mentioned, this is most likely a tomcat defect: see this link: http://stackoverflow.com/questions/40512983/tomcat-8-ssl-session-id-not-available. I have verified that if you follow the link, the error will go away.
Pai G
IN
Thanks Kevin. After adding the below line in our connector config, the error went away. sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"