RE: Isolating the Root Cause of "Connection Refused"

2024-06-25 Thread Eric Robinson
> What is impact on memory utilization if we increase the acceptCount value? > There are 100 tomcat instances on the server. And would maxThreads have to > be increased to accommodate the extra connections? After reading more, I guess that's a dumb question. I'm trying to prevent connections from

Many CLOSE_WAIT connections causing the app not available

2024-06-25 Thread Stephen Stevie
We are using Apache Tomcat 8.5.49 and sometimes in a day, we see the application is going unresponsive though the service is up and running and giving 503 (service unavailable error). When netstat for the port is run, we see many CLOSE_WAIT connections. Once we restart the service, the application

RE: Isolating the Root Cause of "Connection Refused"

2024-06-25 Thread Eric Robinson
> > No - Tomcat passes the acceptCount value to the TCP/IP stack of the OS as > part of listener socket initialization. I thought of that after I sent my previous message. > the OS won't log this, since it's considered to be an application error. Assuming the problem is the acceptCount value, th

Re: How to configure Tomcat with a Managed Service Account when using LocalMachine certificates for TLS

2024-06-25 Thread Mark Thomas
On 25/06/2024 14:27, Gavioto 🕵 wrote: - how are are starting Tomcat?   Tomcat is starting as a service with "Domain\account1$" (Managed Service Account) - is Tomcat installed as a Windows service?   Yes - which account is Tomcat running under?   "Domain\account1$" (Managed Service

Re: Isolating the Root Cause of "Connection Refused"

2024-06-25 Thread Chuck Caldarale
> On Jun 25, 2024, at 13:12, Eric Robinson wrote: > > I'm obviously not getting something. If I understand correctly, the purpose > of the acceptCount param is to allow tomcat to reject connections even after > the TCP stack has passed them to the java process. At that point, the request > ha

RE: Isolating the Root Cause of "Connection Refused"

2024-06-25 Thread Eric Robinson
> -Original Message- > From: Chuck Caldarale > Sent: Tuesday, June 25, 2024 11:01 AM > To: Tomcat Users List > Subject: Re: Isolating the Root Cause of "Connection Refused" > > > > On Jun 25, 2024, at 12:55, Eric Robinson > wrote: > > > >> You might still be running into the acceptCount

Re: Isolating the Root Cause of "Connection Refused"

2024-06-25 Thread Chuck Caldarale
> On Jun 25, 2024, at 12:55, Eric Robinson wrote: > >> You might still be running into the acceptCount limit on the . The >> default value is 100, so if more connection requests arrive in between the >> TCP/IP stack passing them on to the listening process, some could still be >> getting rejecte

RE: Isolating the Root Cause of "Connection Refused"

2024-06-25 Thread Eric Robinson
> -Original Message- > From: Chuck Caldarale > Sent: Monday, June 24, 2024 2:51 PM > To: Tomcat Users List > Subject: Re: Isolating the Root Cause of "Connection Refused" > > > > On Jun 24, 2024, at 16:40, Eric Robinson > wrote: > > > > I wrote a script that checks the FD counts for ev

RE: How to configure Tomcat with a Managed Service Account when using LocalMachine certificates for TLS

2024-06-25 Thread Gavioto 🕵
Finally I got Tomcat working with Machine Certificate Storage. Finally, I got a configuration that works with Certificate Storage. It is very specific, and I couldn't find any other until date. It works, but in our environment there is a required manual step yet. I think it should be configured

Re: How to configure Tomcat with a Managed Service Account when using LocalMachine certificates for TLS

2024-06-25 Thread Bill Stewart
On Tue, Jun 25, 2024 at 9:14 AM david w wrote: I've had the same experience, but with a regular AD service account, not an > MSA. > The account needs to have local administrator rights for the certificate > to be found and used; setting ACL on the keystores is not enough. > 1) The standard on thi

Re: How to configure Tomcat with a Managed Service Account when using LocalMachine certificates for TLS

2024-06-25 Thread david w
I've had the same experience, but with a regular AD service account, not an MSA. The account needs to have local administrator rights for the certificate to be found and used; setting ACL on the keystores is not enough. David From: Gavioto 🕵 Sent: Tuesday, June

Re: PKCS#8 encryption algorithm unrecognized

2024-06-25 Thread Timothy Resh
In the SSLPassword="${KSENC(6qkaMErQ==; C:\Certificate\Keystore\Vessel.p12)}" we defined a Class to convert the Encrypted password and set the following properties: public class MyPropertySource implements org.apache.tomcat.util.IntrospectionUtils.PropertySource ... public String getProperty(St

RE: How to configure Tomcat with a Managed Service Account when using LocalMachine certificates for TLS

2024-06-25 Thread Gavioto 🕵
- how are are starting Tomcat?   Tomcat is starting as a service with "Domain\account1$" (Managed Service Account) - is Tomcat installed as a Windows service?   Yes - which account is Tomcat running under?   "Domain\account1$" (Managed Service Account) It is not a normal domain acco

Re: How to configure Tomcat with a Managed Service Account when using LocalMachine certificates for TLS

2024-06-25 Thread Mark Thomas
A few questions: - how are are starting Tomcat? - is Tomcat installed as a Windows service? - which account is Tomcat running under? There are a few references to "user" in your question. It is not clear if this is: - the user administering a Tomcat service - a user that is starting Tomcat f

How to configure Tomcat with a Managed Service Account when using LocalMachine certificates for TLS

2024-06-25 Thread Alberto Corral
Hello! After some research, docs, and test, I didn't found an answer to my issue. I'm writing to the list because I have to configure a probably not very common Tomcat configuration and didn't found correct configuration of if it is posible to do it. Also I didn't find previous information or