Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I posted this question before but not in the correct forum.

I have configured tomcat7 to use SSL and have made it point to a keystore. The keystore has a self signed certificate by default. There are few webapplications deployed in tomcat that are all accessible over HTTPS, as long as you disable certificate validation checks that are sure to fail owing to using self signed certificate. One of the webapplications that are deployed exposes REST APIs to manage the certificates in the keystore, which includes installing a new identity certificate or a chain of trust. I have noticed just after I install a new identity certificate, all webapplications aren't accessible anymore over HTTPS even with certificate validation check disabled. Attempts to connect over HTTPS return SSL connect error. HTTP works just fine. If I restart tomcat then error goes away and all webapplications look happy over HTTPS. Any idea why the restart is required? Did I do something wrong to require tomcat restart? Is there a way to avoid the restart?

share|improve this question

1 Answer 1

The restart is required because Tomcat cache the keystore at startup and never re-exemined it until next restart. This mean that even if you change the keystore it will not be read by Tomcat until you restart it.

As far as i know you can't avoid restarts when updating the keystore, and this is somthing you normally don't want to change "online" due to security risks. I am not sure why your applications stop working after you alter the file, maybe it will become inconsistent in some way and mess things up.

Maybe this is of interest: http://stackoverflow.com/questions/5816239/how-do-i-force-tomcat-to-reload-trusted-certificates

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.