title: SSL certification exception- error:0909006C:PEM routines:get_name:no start line
body: <p>I am using LDAP authentication in Tomcat. But I'm getting the exception</p>
  
  <pre><code> SEVERE: Failed to initialize end point associated with ProtocolHandler 
   ["http-apr-4001"]
   java.lang.Exception: Unable to load certificate key 
   C:/Usersuser/Documents/SSLcertificate/mycertfilepem.pem 
   (error:0909006C:PEM routines:get_name:no start line)
  
   SEVERE: Failed to initialize connector [Connector[HTTP/1.1-4001]]
   org.apache.catalina.LifecycleException: Failed to initialize component 
   [Connector[HTTP/1.1-4001]] 
   Caused by: org.apache.catalina.LifecycleException: Protocol handler 
   initialization failed
   Caused by: java.lang.Exception: Unable to load certificate key 
   C:/Users/user/Documents/SSLcertificate/mycertfilepem.pem 
   (error:0909006C:PEM routines:get_name:no start line)
  </code></pre>
  
  <p>I have no clue what this means despite searching about it. I referred
  <a href="https://stackoverflow.com/questions/20837161/openssl-pem-routinespem-read-biono-start-linepem-lib-c703expecting-truste">OpenSSL: PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE</a> but the error is a bit different from the one I'm facing. I used the command</p>
  
  <pre><code> openssl s_client -showcerts -connect server-domain.com:3269 &gt;C:\Users\user\Documents\SSLcertificate\mycertfile.pem
  </code></pre>
  
  <p>to import ssl certificate from ldap server to my local. When i use this ssl certificate for ldap authentication through Java program it works. But when I use it for ldap authentication through Tomcat I'm getting the exception
          <strong>error:0909006C:PEM routines:get_name:no start line</strong>.</p>
  
  <p>The ssl certificate looks something like this</p>
  
  <pre><code>CONNECTED(000002B8)
      ---
      Certificate chain
       0 s:/CN=domain1.corp.regn.net
         i:/DC=net/DC=regn/DC=corp/CN=domain1
      -----BEGIN CERTIFICATE-----
      MIIGfjCCBWagAwIBAgITYgAAIET2TOp0vhL5/wAAAAAgRDANBgkqhkiG9w0BAQsF
      ADBaMRMwEQYKCZImiZPyLGQBGRYDbmV0MRQwEgYKCZImiZPyLGQBGRYEcmVnbjEV
      ...
      YrArO/SbuQwdEFSFGUKT3/QB400arvKDyFPOerw9FgN4wc+ZUu9/CyyJg4z5gQur
      wz249UBs7lh6voouY94vdPOrH2qPWS+WhM7w8dDH6qQjrnQdH9AttWqeLCUnIx1b
      giuBuJLObfjy9pOvY/nmeosgDS3/o7E2C0/oWUNAMt79/A==
      -----END CERTIFICATE-----
       1 s:/DC=net/DC=regn/DC=corp/CN=domain1
         i:/DC=net/DC=regn/CN=domain2
      -----BEGIN CERTIFICATE-----
      MIIHcjCCBVqgAwIBAgITNwAAAAlMh9zQLi9kJwAAAAAACTANBgkqhkiG9w0BAQsF
      ADBDMRMwEQYKCZImiZPyLGQBGRYDbmV0MRQwEgYKCZImiZPyLGQBGRYEcmVnbjEW
      MBQGA1UEAxMNTkFQREEyUEtJUDAzNjAeFw0xOTAxMjMyMDU2NTJaFw0yNDAxMjMy
      ......
  
      hnTXXvt0puYpZcVbnO6+WwGCQ5qzXmJUXVLUUOeZUvoY4D/l+qXqQpTZSP2MpF21
      9x9VaB6kiBRfNMW5fWCz2t9pdWzbUPMKa8s5K+yXpZCQbDmfUf4=
      -----END CERTIFICATE-----
      ---
      Server certificate
      subject=/CN=doamin.corp.regn.net
      issuer=/DC=net/DC=regn/DC=legal/CN=domain
      ---
      Acceptable client certificate CA names
      /CN=domain1.corp.regn.net
      /CN=Azure ATP Sensor
      ..
      /DC=com/DC=microsoft/CN=Certificate Authority
      /CN=NT AUTHORITY
      Client Certificate Types: RSA sign, DSA sign, ECDSA sign
      Server Temp Key: ECDH, P-256, 256 bits
      ---
      SSL handshake has read 6467 bytes and written 454 bytes
      ---
      New, TLSv1/SSLv3, Cipher is d23r2r2r
      Server public key is 2048 bit
      Secure Renegotiation IS supported
      Compression: NONE
      Expansion: NONE
      No ALPN negotiated
      SSL-Session:
          Protocol  : TLSv1
          Cipher    : #####
          Session-ID: d23e232f
          Session-ID-ctx: 
          Master-Key: ####
          Key-Arg   : None
          PSK identity: None
          PSK identity hint: None
          SRP username: None
          Start Time: 1565104395
          Timeout   : 300 (sec)
          Verify return code: 20 (unable to get local issuer certificate)
      ---
  </code></pre>
  
  <p>Connector in server.xml file of tomcat is </p>
  
  <pre><code>   &lt;Connector port="4001" protocol="HTTP/1.1"
             connectionTimeout="20000"
             redirectPort="8443" URIEncoding="UTF-8"
             clientAuth="true"
             SSLEnabled="true"
             secure="true"
             SSLCertificateFile="C:/Users/user/Documents/SSLcertificate/mycertfilepem.pem"
             keystoreFile="C:/Program Files/Java/jdk1.8.0_212/jre/lib/security/cacerts"
             keystorePass="changeit"
             /&gt;
  </code></pre>