Commercial certificates, Tomcat, and zmcertinstall

[shiva]

I'm running 4.01 on FC5. Executing 'zmcertinstall mta my.crt my.key` installs my commercial certificate properly in Postfix. But running `zmcertinstall mailbox my.crt` freaks out Tomcat, which constantly dumps this error to its log:

SEVERE: Endpoint [SSL: ServerSocket[addr=0.0.0.0/0.0.0.0,port=0,localport=7071]] ignored exception: java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled.
java.net.SocketException: SSL handshake errorjavax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled.
at org.apache.tomcat.util.net.jsse.JSSESocketFactory. acceptSocket(JSSESocketFactory.java:113)
at org.apache.tomcat.util.net.PoolTcpEndpoint.acceptS ocket(PoolTcpEndpoint.java:407)
at org.apache.tomcat.util.net.LeaderFollowerWorkerThr ead.runIt(LeaderFollowerWorkerThread.java:70)
at org.apache.tomcat.util.threads.ThreadPool$ControlR unnable.run(ThreadPool.java:684)
at java.lang.Thread.run(Thread.java:595)

Both the commercial cert and the self-signed cert use RSA. The wiki entries on this topic seem out of date. Any ideas?

[phoenix]

Why are you using a self signed certificate for tomcat when you have a commercial one? Have you followed the instructions on this page? If you have can you tell us at which step it went wrong?

[shiva]

Originally Posted by phoenix

Why are you using a self signed certificate for tomcat when you have a commercial one?

I am attempting to install the commercial one.

Have you followed the instructions on this page? If you have can you tell us at which step it went wrong?

I purchased the cert a while ago, so I didn't bother with generating a CSR. Running `zmcertinstall mailbox my.crt my.key` results in the first branch being executed:

if [ $APP = "mailbox" ]; then
     keytool -import -alias tomcat -keystore ${TCONF}/keystore \
        -trustcacerts -file ${CERTFILE} -storepass zimbra
else
     cp -f $CERTFILE ${CONF}/smtpd.crt
     cp -f $KEYFILE ${CONF}/smtpd.key
fi

I assume that has the same effect as performing steps B and C manually?