IBM Support

IBM Security Guardium - GUI not Loading

Troubleshooting


Problem

The Guardium appliance not loading the GUI.

Regular troubleshooting steps do not resolve. For example:

  • support clean servlets jsp
  • Restart network
  • Restart gui
  • Verified minimal processes running.
  • Appliance is reachable (pingable).
  • No space issues

Symptom

When you run following cli command you won't see tomcat in the alias list:

  • show certificate keystore alias

xxxx.xxx.com>show certificate keystore alias

Select an alias from the list below to view the corresponding certificate.

Warning:

The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /opt/IBM/Guardium/tomcat/.keystore -destkeystore /opt/IBM/Guardium/tomcat/.keystore -deststoretype pkcs12".

Alias List:

[2] digicertglobalrootca

[3] root-ca

[4] amazonrootca4

[5] amazonrootca3

[6] gimca

[7] amazonrootca2

[8] xxxxxx

[9] amazonrootca1

[10] baltimorecybertrustroot

[11] cas

[12] xxxxxx_intermediate

[13] d-trust_root_class_3_ca_2_2009

[14] gim

[15] sfsrootcag2

[16] digicertglobalrootg2

[17] xxxxxx_intermediate4

[18] venafi-trust-bundle

[19] xxxxxxxxx

[20] microsofteccrootcertificateauthority

[21] solr

[22] signkey

[23] microsoftrsarootcertificateauthority

[24] entrust_g3

[25] entrust_g2

[26] entrust_ec1
 

Also when you run following command you will get error :

show certificate gui

Certificate keystore file .keystore
keytool error: java.lang.Exception: Alias
ok

 

Cause

Guardium Tomcat certificate was not in the alias list 

Environment

Any

Diagnosing The Problem

Get the app_issues must_gather while reproducing the issue and you should find the below error and exceptions in logs.

08-Apr-2026 19:29:49.113 SEVERE [main] org.apache.catalina.util.LifecycleBase.handleSubClassException Failed to initialize component [Connector["https-jsse-nio-8443"]]
org.apache.catalina.LifecycleException: Protocol handler initialization failed
at org.apache.catalina.connector.Connector.initInternal(Connector.java:1011)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:127)
at org.apache.catalina.core.StandardService.initInternal(StandardService.java:554)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:127)
at org.apache.catalina.core.StandardServer.initInternal(StandardServer.java:1039)
at org.apache.catalina.util.LifecycleBase.init(LifecycleBase.java:127)
at org.apache.catalina.startup.Catalina.load(Catalina.java:724)
at org.apache.catalina.startup.Catalina.load(Catalina.java:746)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:90)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:55)
at java.lang.reflect.Method.invoke(Method.java:508)
at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:307)
at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:477)
Caused by: java.lang.IllegalArgumentException: Alias name [tomcat] does not identify a key entry
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:107)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:71)
at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:236)
at org.apache.tomcat.util.net.AbstractEndpoint.bindWithCleanup(AbstractEndpoint.java:1332)
at org.apache.tomcat.util.net.AbstractEndpoint.init(AbstractEndpoint.java:1345)
at org.apache.coyote.AbstractProtocol.init(AbstractProtocol.java:654)
at org.apache.coyote.http11.AbstractHttp11Protocol.init(AbstractHttp11Protocol.java:75)
at org.apache.catalina.connector.Connector.initInternal(Connector.java:1009)
... 13 more
Caused by: java.io.IOException: Alias name [tomcat] does not identify a key entry
at org.apache.tomcat.util.net.SSLUtilBase.getKeyManagers(SSLUtilBase.java:376)
at org.apache.tomcat.util.net.SSLUtilBase.createSSLContext(SSLUtilBase.java:268)
at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:105)
... 20 more:

Resolving The Problem

If Customer is using Guardium default tomcat certificate then running following cli command one by one will restore the tomcat certificate and customer can access the GUI:

  • restore certificate keystore alias default tomcat
  • restart gui

If Customer is using their custom tomcat certificate or not using Guardium default tomcat certificate open a support case for troubleshooting the issue.

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB76","label":"Data Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSDKGA","label":"IBM Guardium Data Protection"},"ARM Category":[{"code":"a8m0z000000Gp0JAAS","label":"APPLIANCE"},{"code":"a8m0z0000000AqcAAE","label":"GUI"}],"ARM Case Number":"TS021898961","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"and future releases;11.5.0;12.0.0;12.1.0;12.2.0"}]

Document Information

Modified date:
14 April 2026

UID

ibm17269403

Page Feedback