Re: certificates from windows cert store with autoenrollment from AD CS

Sat, 17 Oct 2026 05:56:18 -0700 

Dimitris,

On 10/16/26 8:11 PM, Dimitris Soumis wrote:

On Fri, Oct 16, 2026 at 1:22 PM Christopher Schultz <
[email protected]> wrote:


Christoph,

On 10/15/26 4:06 PM, von Wittich, Christoph wrote:

I would like to use certificates from windows cert store with

autoenrollment from AD CS to automate certifcate deployment.






Tomcat 11

JRE 25

Windows Server 2025



Snippet from server.xml    {CN} is the server hostname which matches the

CN of the certificate




     <SSLHostConfig>

              <Certificate certificateKeystoreFile=""

                           certificateKeystorePassword=""



  certificateKeystoreType="Windows-MY-LOCALMACHINE"




  certificateKeyAlias="{CN}"




  protocols="TLSv1.2,TLSv1.3"




  />


           </SSLHostConfig>





I gave "Local Service" read access to the certifcate in the windows cert

store.


I do not want to set the displayname of the certifcate as I cannot set

it with autoenrollment from the template.




In most cases this configuation works fine - at least as long as there

is just one certificate with the CN. But as I have another cert for "Remote
Desktop Authentication" on the machines, sometimes I tried to load the
wrong one which fails because the user does not have permission to read the
key and the key usage does not match.




Why does it try to load the wrong cert? It should check for the correct

key usage (Server Auth) instead of just trying to get the first cert with
the correct alias (here CN).


I am not sure if this has to be fixed in tomcat or in jdk...

This sounds like a bit of an unusual use case (multiple certs with the
same DN but completely different applications), but my sense is that it
*should* be supported.

(I have a long-standing annoyance from stunnel where you cannot have two
trusted certificates with the same DN: stunnel will only choose one of
them, ever, which makes certificate re-issuance impossible with any
overlap between the two trusted certificates.)

Would you mind enabling debug (or trace if necessary) logging and
capturing a failed authentication exercise, here? It's possible that
Tomcat should simply ignore an initial failure and continue with
additional possibilities for cert+key, only failing if *none* are
successful.

-chris


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]



Tomcat selects the certificate solely by alias and doesn't check key usage.
Since the certificates share the same CN, they collide on the same alias.
Tomcat picks the first match, so it occasionally selects the wrong
certificate.

I have added a new JSSE attribute, `certificateSelectByKeyUsage`. When
enabled, Tomcat picks a certificate valid for TLS server authentication
among those sharing the alias' Subject.

  <Certificate certificateKeystoreType="Windows-MY-LOCALMACHINE"
                  certificateKeyAlias="{CN}"
                  certificateSelectByKeyUsage="true" />

PR: https://github.com/apache/tomcat/pull/1089

I would prefer to just allow multiple CN matches and try all of them.

That way nothing new needs to be configured.
I might argue that Tomcat should be ignoring (but maybe DEBUG logging) all certificates that don't have the correct key usage, anyway. Maybe doing only that (skipping certs without matching key usage) will be enough in this particular case. 

-chris


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to