Re: Tomcat 10 MLDSA - failed to start

On Tue, Jul 14, 2026 at 10:03=E2=80=AFPM Chuck Caldarale <[email protected]>=
 wrote:
>
>
> > On Jul 14, 2026, at 06:40:59, John Mok <[email protected]> wrote:
> >
> > Hi all,
> >
> > Trying to use MLDSA certificate on Tomcat 10 + OpenJDK 21, but failed
> > (see error messages below).
>
>
> Exact Tomcat and JVM versions? You should always specify those, along wit=
h the platform you=E2=80=99re running on.
>
>
> > I hope someone could point me in the right direction.
> >
> > server.xml configuration
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> >
> >    <Connector port=3D"8443" protocol=3D"org.apache.coyote.http11.Http11=
NioProtocol"
> >               maxThreads=3D"150" SSLEnabled=3D"true"
> >               maxParameterCount=3D"1000"
> >>
> >        <UpgradeProtocol className=3D"org.apache.coyote.http2.Http2Proto=
col" />
> >        <SSLHostConfig>
> >            <Certificate certificateKeystoreFile=3D"conf/tomcat10-1.jks"
> >                         certificateKeystorePassword=3D"changeit" type=
=3D"MLDSA" />
> >        </SSLHostConfig>
> >    </Connector>
>
>
> It looks like you=E2=80=99re trying to use the JVM JSSE provider, but AFA=
ICT, JVM 21 does not support MLDSA certificates; you would need JVM 24 or 2=
5 for that.

And it's not really going to work anyway.

> Current versions of OpenSSL do support MLDSA, but you have to specify tha=
t in your <Connector> configuration. Take a look at:
>
> https://tomcat.apache.org/tomcat-10.1-doc/ssl-howto.html#SSL_and_Tomcat
> https://tomcat.apache.org/tomcat-10.1-doc/config/http.html#SSL_Support_-_=
Connector_-_NIO_and_NIO2

You can have the OpenSSL listener enabled in server.xml, OpenSSL in
your system, and Java 25, and it works.
<Listener className=3D"org.apache.catalina.core.OpenSSLLifecycleListener"
SSLEngine=3D"on" />
Or use tomcat-native if running on older Java versions.

Also for now it's best to avoid using a keystore.

R=C3=A9my

>   - Chuck
>
>
> > =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
> >
> > Catalina log reads
> >
> > 14-Jul-2026 18:51:34.645 SEVERE [main]
> > org.apache.catalina.util.LifecycleBase.handleSubClassException Failed
> > to initialize component [Connector["https-jsse-nio2-8443"]]
> > org.apache.catalina.LifecycleException: Protocol handler initialization=
 failed
> > at org.apache.catalina.connector.Connector.initInternal(Connector.java:=
1084)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122)
> > at org.apache.catalina.core.StandardService.initInternal(StandardServic=
e.java:520)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122)
> > at org.apache.catalina.core.StandardServer.initInternal(StandardServer.=
java:955)
> > at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:122)
> > at org.apache.catalina.startup.Catalina.load(Catalina.java:709)
> > at org.apache.catalina.startup.Catalina.load(Catalina.java:732)
> > at java.base/jdk.internal.reflect.DirectMethodHandleAccessor.invoke(Dir=
ectMethodHandleAccessor.java:103)
> > at java.base/java.lang.reflect.Method.invoke(Method.java:580)
> > at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:299)
> > at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:472)
> > Caused by: java.lang.IllegalArgumentException: Error creating SSLContex=
t
> > at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(Abs=
tractJsseEndpoint.java:121)
> > at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(Abstra=
ctJsseEndpoint.java:78)
> > at org.apache.tomcat.util.net.Nio2Endpoint.bind(Nio2Endpoint.java:137)
> > at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(Abstract=
Endpoint.java:1434)
> > at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.ja=
va:1447)
> > at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:932)
> > at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11P=
rotocol.java:82)
> > at org.apache.catalina.connector.Connector.initInternal(Connector.java:=
1082)
> > ... 11 more
> > Caused by: java.security.UnrecoverableKeyException: Get Key failed:
> > Given final block not properly padded. Such issues can arise if a bad
> > key is used during decryption.
> > at java.base/sun.security.pkcs12.PKCS12KeyStore.internalGetKey(PKCS12Ke=
yStore.java:458)
> > at java.base/sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyS=
tore.java:300)
> > at java.base/sun.security.util.KeyStoreDelegator.engineGetKey(KeyStoreD=
elegator.java:93)
> > at java.base/java.security.KeyStore.getKey(KeyStore.java:1095)
> > at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.ja=
va:384)
> > at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.=
java:265)
> > at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(Abs=
tractJsseEndpoint.java:119)
> > ... 18 more
> > Caused by: javax.crypto.BadPaddingException: Given final block not
> > properly padded. Such issues can arise if a bad key is used during
> > decryption.
> > at java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:8=
61)
> > at java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(Cipher=
Core.java:941)
> > at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java=
:734)
> > at java.base/com.sun.crypto.provider.PBES2Core.engineDoFinal(PBES2Core.=
java:203)
> > at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2265)
> > at java.base/sun.security.pkcs12.PKCS12KeyStore.lambda$internalGetKey$0=
(PKCS12KeyStore.java:374)
> > at java.base/sun.security.pkcs12.PKCS12KeyStore$RetryWithZero.run(PKCS1=
2KeyStore.java:257)
> > at java.base/sun.security.pkcs12.PKCS12KeyStore.internalGetKey(PKCS12Ke=
yStore.java:365)
> > ... 24 more
> > 14-Jul-2026 18:51:34.648 INFO [main]
> > org.apache.catalina.startup.Catalina.load Server initialization in
> > [6138] milliseconds
> >
> > Thank you,
> > John MOK
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: [email protected]
> > For additional commands, e-mail: [email protected]
> >
>