This is an automated email from the ASF dual-hosted git repository. dsoumis pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 346d709a62c93bc6c62e3ab1f3c0100e62c54880 Author: Dimitris Soumis <[email protected]> AuthorDate: Thu Oct 29 23:07:52 2026 +0200 Non-exportable Windows keys require JSSE --- webapps/docs/ssl-howto.xml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/webapps/docs/ssl-howto.xml b/webapps/docs/ssl-howto.xml index 04e56a84ad..dbc3f29c39 100644 --- a/webapps/docs/ssl-howto.xml +++ b/webapps/docs/ssl-howto.xml @@ -549,6 +549,13 @@ with a configured alias, ensure that the renewed certificate is available under that alias. Reloading does not select a different alias or prefer a certificate with a later expiry date.</p> +<p>If the certificate's private key is marked non-exportable, pin the JSSE implementation by adding +<code>sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation"</code> +to the <strong>Connector</strong>. A connector otherwise selects an OpenSSL +implementation automatically when one is available, and OpenSSL cannot use a +private key it is unable to read, so initialization fails. An exportable key works +with either implementation.</p> + <p>Two points to note:</p> <ul> --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
