Fix Tomcat SSL connector config for Tomcat 10.1+ (EL10)

[Odilhao]

Summary

Tomcat 10.1 (shipped on EL10 — CentOS Stream 10 / AlmaLinux 10) dropped support for configuring SSL directly as attributes on <Connector> (keystoreFile, keystorePass, keystoreType, truststoreFile, truststorePass, sslProtocol, sslEnabledProtocols, ciphers, clientAuth). Those must now live in a nested <SSLHostConfig>/<Certificate> element.

Without this change, every one of those attributes silently fails to set (SetPropertiesRule digester warnings), no SSLHostConfig gets created, and the connector fails to initialize:

IllegalArgumentException: No SSLHostConfig element was found with the hostName [_default_]
to match the defaultSSLHostConfigName for the connector [https-jsse-nio-127.0.0.1-8443]

...so candlepin never listens on its HTTPS port. This broke the candlepin-5.0-rpm-pipeline Jenkins job for both almalinux10 and centos10-stream (see spec/acceptance/basic_candlepin_spec.rb failures: port 8443 not listening, curl returning 000, and the nmap TLS checks failing since nothing was listening).

Fix

• templates/tomcat/server.xml.epp: move the SSL config into a nested <SSLHostConfig> (with <Certificate> for the keystore), translating clientAuth="want" to the modern certificateVerification="optional" equivalent, and fixing truststorePass → truststorePassword (the old name is not a valid SSLHostConfig attribute — using it left the truststore password unset, which silently produced zero usable CA certs and failed with the trustAnchors parameter must be non-empty even after the SSLHostConfig was correctly recognized).
• spec/classes/candlepin_spec.rb: updated the two assertions that checked for the old flat keystorePass/sslProtocol attributes to match the new nested structure.

<SSLHostConfig> has been supported since Tomcat 8.5, so this isn't an EL10-only syntax — it works on EL9's Tomcat 9.x too.

Test plan

Reproduced and fixed locally using forklift's real acceptance pipeline (pipelines/candlepin.yml), pointed at this branch:

• pipeline_version=5.0 pipeline_os=centos10-stream (Tomcat 10.1, the originally failing case) — full bundle exec rake beaker run passes, failed=0.
• pipeline_version=4.8 pipeline_os=centos9-stream (Tomcat 9.x, what's actually used in the current 4.8 pipeline) — confirmed no regression, failed=0.

🤖 Generated with Claude Code

[ekohl]

Isn't #286 a better approach? Or wouldn't that work for EL10?

[Odilhao]

Isn't #286 a better approach? Or wouldn't that work for EL10?

Looks like it is, I'm testing it right now locally.

[Odilhao]

Closing since #286 fix the same issue with a more elegant fix 😄 , the only part that is wrong is the branch name.