我在 Tomcat 中使用 LDAP 身份验证。但我遇到了异常
SEVERE: Failed to initialize end point associated with ProtocolHandler
["http-apr-4001"]
java.lang.Exception: Unable to load certificate key
C:/Usersuser/Documents/SSLcertificate/mycertfilepem.pem
(error:0909006C:PEM routines:get_name:no start line)
SEVERE: Failed to initialize connector [Connector[HTTP/1.1-4001]]
org.apache.catalina.LifecycleException: Failed to initialize component
[Connector[HTTP/1.1-4001]]
Caused by: org.apache.catalina.LifecycleException: Protocol handler
initialization failed
Caused by: java.lang.Exception: Unable to load certificate key
C:/Users/user/Documents/SSLcertificate/mycertfilepem.pem
(error:0909006C:PEM routines:get_name:no start line)
尽管我搜索过，但还是不知道这是什么意思。我提到 https://stackoverflow.com/questions/20837161/openssl-pem-routinespem-read-biono-start-linepem-lib-c703expecting-truste但错误与我遇到的错误有点不同。我使用了命令
“openssl s_client -showcerts -connect server-domain.com:3269 > C:\Users\user\Documents\SSLcertificate\mycertfile.pem“
将 SSL 证书从 ldap 服务器导入到本地。当我通过 Java 程序使用此 SSL 证书进行 ldap 身份验证时，它可以正常工作。但是当我通过 Tomcat 使用它进行 ldap 身份验证时，我得到了异常 错误：0909006C：PEM 例程：get_name：没有起始行。
SSL 证书看起来像这样
CONNECTED(000002B8)
---
Certificate chain
0 s:/CN=domain1.corp.regn.net
i:/DC=net/DC=regn/DC=corp/CN=domain1
-----BEGIN CERTIFICATE-----
MIIGfjCCBWagAwIBAgITYgAAIET2TOp0vhL5/wAAAAAgRDANBgkqhkiG9w0BAQsF
ADBaMRMwEQYKCZImiZPyLGQBGRYDbmV0MRQwEgYKCZImiZPyLGQBGRYEcmVnbjEV
...
YrArO/SbuQwdEFSFGUKT3/QB400arvKDyFPOerw9FgN4wc+ZUu9/CyyJg4z5gQur
wz249UBs7lh6voouY94vdPOrH2qPWS+WhM7w8dDH6qQjrnQdH9AttWqeLCUnIx1b
giuBuJLObfjy9pOvY/nmeosgDS3/o7E2C0/oWUNAMt79/A==
-----END CERTIFICATE-----
1 s:/DC=net/DC=regn/DC=corp/CN=domain1
i:/DC=net/DC=regn/CN=domain2
-----BEGIN CERTIFICATE-----
MIIHcjCCBVqgAwIBAgITNwAAAAlMh9zQLi9kJwAAAAAACTANBgkqhkiG9w0BAQsF
ADBDMRMwEQYKCZImiZPyLGQBGRYDbmV0MRQwEgYKCZImiZPyLGQBGRYEcmVnbjEW
MBQGA1UEAxMNTkFQREEyUEtJUDAzNjAeFw0xOTAxMjMyMDU2NTJaFw0yNDAxMjMy
......
hnTXXvt0puYpZcVbnO6+WwGCQ5qzXmJUXVLUUOeZUvoY4D/l+qXqQpTZSP2MpF21
9x9VaB6kiBRfNMW5fWCz2t9pdWzbUPMKa8s5K+yXpZCQbDmfUf4=
-----END CERTIFICATE-----
---
Server certificate
subject=/CN=doamin.corp.regn.net
issuer=/DC=net/DC=regn/DC=legal/CN=domain
---
Acceptable client certificate CA names
/CN=domain1.corp.regn.net
/CN=Azure ATP Sensor
..
/DC=com/DC=microsoft/CN=Certificate Authority
/CN=NT AUTHORITY
Client Certificate Types: RSA sign, DSA sign, ECDSA sign
Server Temp Key: ECDH, P-256, 256 bits
---
SSL handshake has read 6467 bytes and written 454 bytes
---
New, TLSv1/SSLv3, Cipher is d23r2r2r
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
Protocol : TLSv1
Cipher : #####
Session-ID: d23e232f
Session-ID-ctx:
Master-Key: ####
Key-Arg : None
PSK identity: None
PSK identity hint: None
SRP username: None
Start Time: 1565104395
Timeout : 300 (sec)
Verify return code: 20 (unable to get local issuer certificate)
---
tomcat 的 server.xml 文件中的连接器是
<Connector port="4001" protocol="HTTP/1.1"
connectionTimeout="20000"
redirectPort="8443" URIEncoding="UTF-8"
clientAuth="true"
SSLEnabled="true"
secure="true"
SSLCertificateFile="C:/Users/user/Documents/SSLcertificate/mycertfilepem.pem"
keystoreFile="C:/Program Files/Java/jdk1.8.0_212/jre/lib/security/cacerts"
keystorePass="changeit"
/>