How to speedup Tomcat SSL init

Question

I am doing development of a Tomcat webapp and need to be able to restart Tomcat to load code changes. However, sometimes Tomcat takes a long time to startup as the main thread is stalled in the following place:

java.lang.Thread.State: RUNNABLE
    at org.apache.tomcat.jni.SSL.initialize(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.core.AprLifecycleListener.initializeSSL(AprLifecycleListener.java:214)
- locked <119e583> (a java.lang.Class)
at org.apache.catalina.core.AprLifecycleListener.lifecycleEvent(AprLifecycleListener.java:83)
at org.apache.catalina.util.LifecycleSupport.fireLifecycleEvent(LifecycleSupport.java:117)
at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:770)
at org.apache.catalina.startup.Catalina.load(Catalina.java:530)
at org.apache.catalina.startup.Catalina.load(Catalina.java:550)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:260)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:412)

This stall is caused by the available entropy (as shown by running cat /proc/sys/kernel/random/entropy_avail) is too low.

When I am developing code I don't care if the SSL engine is initialised with a good random number.

Is there any way for me to dump some fake entropy into /dev/rnd or force Tomcat to use some fake entropy?

I can push up the entropy more quickly by running "find /" but this takes a while to produce enough entropy.

Answer 1

You could use /dev/urandom in a development environment, as it is faster (and obviously less secure) than /dev/random.

Note - This does not work in Windows, and I would expect that it is not required on Windows as the problem only manifests with usage of /dev/random. Windows uses Microsoft Crypto API (CAPI) when the /dev/random string is used to state the required PRNG source (i.e. the securerandom.source property in the JRE_HOME/lib/security/java.security file).

EDIT

Based on the other answer which requires setting the RANDFILE environment variable, the solution described here is applicable when the non-native (i.e. JSSE) implementation is used for SSL in Tomcat.

Answer 2

Setting the environment variable RANDFILE to "/dev/urandom" makes Tomcat use this source for SSL init.