certificates from windows cert store with autoenrollment from AD CS

[von Wittich, Christoph]

I would like to use certificates from windows cert store with autoenrollment 
from AD CS to automate certifcate deployment.





Tomcat 11

JRE 25

Windows Server 2025



Snippet from server.xml    {CN} is the server hostname which matches the CN of 
the certificate



   <SSLHostConfig>

            <Certificate certificateKeystoreFile=""

                         certificateKeystorePassword=""

                                                                       
certificateKeystoreType="Windows-MY-LOCALMACHINE"

                                                                       
certificateKeyAlias="{CN}"

                                                                       
protocols="TLSv1.2,TLSv1.3"

                                                                       />

         </SSLHostConfig>





I gave "Local Service" read access to the certifcate in the windows cert store.

I do not want to set the displayname of the certifcate as I cannot set it with 
autoenrollment from the template.



In most cases this configuation works fine - at least as long as there is just 
one certificate with the CN. But as I have another cert for "Remote Desktop 
Authentication" on the machines, sometimes I tried to load the wrong one which 
fails because the user does not have permission to read the key and the key 
usage does not match.



Why does it try to load the wrong cert? It should check for the correct key 
usage (Server Auth) instead of just trying to get the first cert with the 
correct alias (here CN).

I am not sure if this has to be fixed in tomcat or in jdk...

Christoph