8:09 a.m.
[
https://issues.jboss.org/browse/ELY-1621?page=com.atlassian.jira.plugin.s...
]
Rich Lucente commented on ELY-1621:
-----------------------------------
I hope I'm tracking the discussion here ... I guess this makes sense to me if I have a
canonically issued certificate where on the server side the keystore contains the server
certificate and key; the server truststore contains the intermediate CA (optionally, that
signed the server certificate and any client potential certificates) and the root CA
certificate (optionally, that signed either the server/client certificates or the
intermediate CA). On the client side, the truststore would contain the root CA and the
keystore would include the client certificate and key.
I know our docs discuss self-signed certificates in all the examples, but none of my
customers actually do that. So truststores only containing intermediate or root CA
certificates makes sense to me.
BC FIPS with CLI: the trustAnchors parameter must be non-empty
--------------------------------------------------------------
Key: ELY-1621
URL: https://issues.jboss.org/browse/ELY-1621
Project: WildFly Elytron
Issue Type: Bug
Components: SSL
Affects Versions: 1.5.1.Final
Reporter: Martin Choma
Priority: Blocker
Attachments: cli-test-wildfly-config.xml, jboss-cli.log, keystore.bcfks
I am trying to connect from jboss-cli.sh to EAP server. To reproduce the problem it is
enough BC FIPS is used only on client side.
{code:java|titlejboss-cli.log}
08:13:18,469 ERROR [org.jboss.as.cli.impl.CliLauncher] Error processing CLI:
java.lang.ExceptionInInitializerError
at
org.wildfly.security.auth.client.AuthenticationContext.lambda$static$0(AuthenticationContext.java:54)
at
org.wildfly.common.context.ContextManager.getPrivileged(ContextManager.java:286)
at
org.wildfly.security.auth.client.AuthenticationContext.captureCurrent(AuthenticationContext.java:86)
at
org.jboss.as.cli.impl.CLIModelControllerClient.<init>(CLIModelControllerClient.java:146)
at
org.jboss.as.cli.impl.ModelControllerClientFactory$2.getClient(ModelControllerClientFactory.java:85)
at
org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1222)
at
org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1203)
at
org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1198)
at org.jboss.as.cli.impl.CliLauncher.initCommandContext(CliLauncher.java:328)
at org.jboss.as.cli.impl.CliLauncher.main(CliLauncher.java:291)
at org.jboss.as.cli.CommandLineMain.main(CommandLineMain.java:45)
at org.jboss.modules.Module.run(Module.java:352)
at org.jboss.modules.Module.run(Module.java:320)
at org.jboss.modules.Main.main(Main.java:593)
Caused by: org.wildfly.security.auth.client.InvalidAuthenticationConfigurationException:
org.wildfly.client.config.ConfigXMLParseException: java.security.KeyStoreException:
initialization failed
at
org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.lambda$static$0(DefaultAuthenticationContextProvider.java:40)
at java.security.AccessController.doPrivileged(Native Method)
at
org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.<clinit>(DefaultAuthenticationContextProvider.java:36)
... 14 more
Caused by: org.wildfly.client.config.ConfigXMLParseException:
java.security.KeyStoreException: initialization failed
at
org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextType$10(ElytronXmlParser.java:525)
at
org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextRuleType$11(ElytronXmlParser.java:711)
at
org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseRulesType$13(ElytronXmlParser.java:749)
at
org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientType(ElytronXmlParser.java:356)
at
org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:231)
at
org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:192)
at
org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.lambda$static$0(DefaultAuthenticationContextProvider.java:38)
... 16 more
Caused by: java.security.KeyStoreException: initialization failed
at
org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.engineInit(ProvTrustManagerFactorySpi.java:150)
at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:250)
at
org.wildfly.security.auth.client.ElytronXmlParser$TrustManagerBuilder.build(ElytronXmlParser.java:590)
at
org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextType$10(ElytronXmlParser.java:523)
... 22 more
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter
must be non-empty
at java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
at java.security.cert.PKIXParameters.<init>(PKIXParameters.java:120)
at
java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:104)
at
org.bouncycastle.jsse.provider.ProvX509TrustManagerImpl.<init>(ProvX509TrustManagerImpl.java:53)
at
org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.engineInit(ProvTrustManagerFactorySpi.java:146)
... 25 more
{code}
When I use non-FIPS java with CLI I can make it work. It does occure also when connecting
to default unsecured port 9990.
I have double check truststore is there. Correct password is used. Server has permission
to open the truststure. And truststore contains certificate
When I use BCFKS truststore on server side, e.g. in 2-way http communication it works.
So it looks to me something on client side is missing? Any hint?
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
2918
days inactive
2918
days old
0 comments
1 participants
participants (1)
-
Rich Lucente (JIRA)