Re: Tomcat 10 MLDSA - failed to start

--Apple-Mail=_CC287D82-F470-4955-A30C-5D4F2CB9CD85
Content-Transfer-Encoding: quoted-printable
Content-Type: text/plain;
	charset=utf-8


> On Jul 14, 2026, at 06:40:59, John Mok <[email protected]> wrote:
>=20
> Hi all,
>=20
> Trying to use MLDSA certificate on Tomcat 10 + OpenJDK 21, but failed
> (see error messages below).


Exact Tomcat and JVM versions? You should always specify those, along =
with the platform you=E2=80=99re running on.


> I hope someone could point me in the right direction.
>=20
> server.xml configuration
> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>=20
>    <Connector port=3D"8443" =
protocol=3D"org.apache.coyote.http11.Http11NioProtocol"
>               maxThreads=3D"150" SSLEnabled=3D"true"
>               maxParameterCount=3D"1000"
>>=20
>        <UpgradeProtocol =
className=3D"org.apache.coyote.http2.Http2Protocol" />
>        <SSLHostConfig>
>            <Certificate certificateKeystoreFile=3D"conf/tomcat10-1.jks"
>                         certificateKeystorePassword=3D"changeit" =
type=3D"MLDSA" />
>        </SSLHostConfig>
>    </Connector>


It looks like you=E2=80=99re trying to use the JVM JSSE provider, but =
AFAICT, JVM 21 does not support MLDSA certificates; you would need JVM =
24 or 25 for that.

Current versions of OpenSSL do support MLDSA, but you have to specify =
that in your <Connector> configuration. Take a look at:

https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html#SSL_and_Tomcat
=
https://tomcat.apache.org/tomcat-10.1-doc/config/http.html#SSL_Support_-_C=
onnector_-_NIO_and_NIO2

  - Chuck


> =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
>=20
> Catalina log reads
>=20
> 14-Jul-2026 18:51:34.645 SEVERE [main]
> org.apache.catalina.util.LifecycleBase.handleSubClassException Failed
> to initialize component [Connector["https-jsse-nio2-8443"]]
> org.apache.catalina.LifecycleException: Protocol handler =
initialization failed
> at =
org.apache.catalina.connector.Connector.initInternal(Connector.java:1084)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122)
> at =
org.apache.catalina.core.StandardService.initInternal(StandardService.java=
:520)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122)
> at =
org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:9=
55)
> at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:709)
> at org.apache.catalina.startup.Catalina.load(Catalina.java:732)
> at =
java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMet=
hodHandleAccessor.java:103)
> at java.base/java.lang.reflect.Method.invoke(Method.java:580)
> at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:299)
> at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472)
> Caused by: java.lang.IllegalArgumentException: Error creating =
SSLContext
> at =
org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJ=
sseEndpoint.java:121)
> at =
org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsse=
Endpoint.java:78)
> at org.apache.tomcat.util.net.Nio2Endpoint.bind(Nio2Endpoint.java:137)
> at =
org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoi=
nt.java:1434)
> at =
org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:144=
7)
> at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:932)
> at =
org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protoco=
l.java:82)
> at =
org.apache.catalina.connector.Connector.initInternal(Connector.java:1082)
> ... 11 more
> Caused by: java.security.UnrecoverableKeyException: Get Key failed:
> Given final block not properly padded. Such issues can arise if a bad
> key is used during decryption.
> at =
java.base/sun.security.pkcs12.PKCS12KeyStore.internalGetKey(PKCS12KeyStore=
.java:458)
> at =
java.base/sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.j=
ava:300)
> at =
java.base/sun.security.util.KeyStoreDelegator.engineGetKey(KeyStoreDelegat=
or.java:93)
> at java.base/java.security.KeyStore.getKey(KeyStore.java:1095)
> at =
org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:384=
)
> at =
org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:2=
65)
> at =
org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJ=
sseEndpoint.java:119)
> ... 18 more
> Caused by: javax.crypto.BadPaddingException: Given final block not
> properly padded. Such issues can arise if a bad key is used during
> decryption.
> at =
java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:861)
> at =
java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.j=
ava:941)
> at =
java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:734)
> at =
java.base/com.sun.crypto.provider.PBES2Core.engineDoFinal(PBES2Core.java:2=
03)
> at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2265)
> at =
java.base/sun.security.pkcs12.PKCS12KeyStore.lambda$internalGetKey$0(PKCS1=
2KeyStore.java:374)
> at =
java.base/sun.security.pkcs12.PKCS12KeyStore$RetryWithZero.run(PKCS12KeySt=
ore.java:257)
> at =
java.base/sun.security.pkcs12.PKCS12KeyStore.internalGetKey(PKCS12KeyStore=
.java:365)
> ... 24 more
> 14-Jul-2026 18:51:34.648 INFO [main]
> org.apache.catalina.startup.Catalina.load Server initialization in
> [6138] milliseconds
>=20
> Thank you,
> John MOK
>=20
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: [email protected]
> For additional commands, e-mail: [email protected]
>=20


--Apple-Mail=_CC287D82-F470-4955-A30C-5D4F2CB9CD85--