[jboss-jira] [JBoss JIRA] (ELY-1621) BC FIPS with CLI: the trustAnchors parameter must be non-empty

[Martin Choma (JIRA)]

    [ https://issues.jboss.org/browse/ELY-1621?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13613695#comment-13613695 ] 

Martin Choma edited comment on ELY-1621 at 8/2/18 6:02 AM:
-----------------------------------------------------------

It turn out BC provider behave differently compared to another providers. For testing pusrposes I have under one alias private key and certificate. 

Seems BC does not handle this situation properly. After I have created truststore with only certificate entry it works now. 
{code}
        @Override
        public boolean engineIsCertificateEntry(String alias)
        {
            ObjectData ent = entries.get(alias);
            if (ent != null)
            {
                return ent.getType().equals(CERTIFICATE);
            }
            return false;
        }
{code}

But there seems to be another problem with this scenario. I will report once I will investigate.

[~rlucente-se-jboss] FYI


was (Author: mchoma):
It turn out BC provider behave differently compared to another providers. For testing pusrposes I had only under one alias private key and certificate. 

Seems BC does not handle this situation properly. After I have created truststore with only certificate entry it works now. 
{code}
        @Override
        public boolean engineIsCertificateEntry(String alias)
        {
            ObjectData ent = entries.get(alias);
            if (ent != null)
            {
                return ent.getType().equals(CERTIFICATE);
            }
            return false;
        }
{code}

[~rlucente-se-jboss] FYI

> BC FIPS with CLI: the trustAnchors parameter must be non-empty
> --------------------------------------------------------------
>
>                 Key: ELY-1621
>                 URL: https://issues.jboss.org/browse/ELY-1621
>             Project: WildFly Elytron
>          Issue Type: Bug
>          Components: SSL
>    Affects Versions: 1.5.1.Final
>            Reporter: Martin Choma
>            Priority: Blocker
>         Attachments: cli-test-wildfly-config.xml, jboss-cli.log, keystore.bcfks
>
>
> I am trying to connect from jboss-cli.sh to EAP server. To reproduce the problem it is enough BC FIPS is used only on client side.
> {code:java|titlejboss-cli.log}
> 08:13:18,469 ERROR [org.jboss.as.cli.impl.CliLauncher] Error processing CLI: java.lang.ExceptionInInitializerError
>         at org.wildfly.security.auth.client.AuthenticationContext.lambda$static$0(AuthenticationContext.java:54)
>         at org.wildfly.common.context.ContextManager.getPrivileged(ContextManager.java:286)
>         at org.wildfly.security.auth.client.AuthenticationContext.captureCurrent(AuthenticationContext.java:86)
>         at org.jboss.as.cli.impl.CLIModelControllerClient.<init>(CLIModelControllerClient.java:146)
>         at org.jboss.as.cli.impl.ModelControllerClientFactory$2.getClient(ModelControllerClientFactory.java:85)
>         at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1222)
>         at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1203)
>         at org.jboss.as.cli.impl.CommandContextImpl.connectController(CommandContextImpl.java:1198)
>         at org.jboss.as.cli.impl.CliLauncher.initCommandContext(CliLauncher.java:328)
>         at org.jboss.as.cli.impl.CliLauncher.main(CliLauncher.java:291)
>         at org.jboss.as.cli.CommandLineMain.main(CommandLineMain.java:45)
>         at org.jboss.modules.Module.run(Module.java:352)
>         at org.jboss.modules.Module.run(Module.java:320)
>         at org.jboss.modules.Main.main(Main.java:593)
> Caused by: org.wildfly.security.auth.client.InvalidAuthenticationConfigurationException: org.wildfly.client.config.ConfigXMLParseException: java.security.KeyStoreException: initialization failed
>         at org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.lambda$static$0(DefaultAuthenticationContextProvider.java:40)
>         at java.security.AccessController.doPrivileged(Native Method)
>         at org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.<clinit>(DefaultAuthenticationContextProvider.java:36)
>         ... 14 more
> Caused by: org.wildfly.client.config.ConfigXMLParseException: java.security.KeyStoreException: initialization failed
>         at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextType$10(ElytronXmlParser.java:525)
>         at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextRuleType$11(ElytronXmlParser.java:711)
>         at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseRulesType$13(ElytronXmlParser.java:749)
>         at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientType(ElytronXmlParser.java:356)
>         at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:231)
>         at org.wildfly.security.auth.client.ElytronXmlParser.parseAuthenticationClientConfiguration(ElytronXmlParser.java:192)
>         at org.wildfly.security.auth.client.DefaultAuthenticationContextProvider.lambda$static$0(DefaultAuthenticationContextProvider.java:38)
>         ... 16 more
> Caused by: java.security.KeyStoreException: initialization failed
>         at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.engineInit(ProvTrustManagerFactorySpi.java:150)
>         at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:250)
>         at org.wildfly.security.auth.client.ElytronXmlParser$TrustManagerBuilder.build(ElytronXmlParser.java:590)
>         at org.wildfly.security.auth.client.ElytronXmlParser.lambda$parseSslContextType$10(ElytronXmlParser.java:523)
>         ... 22 more
> Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
>         at java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
>         at java.security.cert.PKIXParameters.<init>(PKIXParameters.java:120)
>         at java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:104)
>         at org.bouncycastle.jsse.provider.ProvX509TrustManagerImpl.<init>(ProvX509TrustManagerImpl.java:53)
>         at org.bouncycastle.jsse.provider.ProvTrustManagerFactorySpi.engineInit(ProvTrustManagerFactorySpi.java:146)
>         ... 25 more
> {code}
> When I use non-FIPS java with CLI I can make it work. It does occure also when connecting to default unsecured port 9990.
> I have double check truststore is there. Correct password is used. Server has permission to open the truststure. And truststore contains certificate
> When I use BCFKS truststore on server side, e.g. in 2-way http communication it works.
> So it looks to me something on client side is missing? Any hint?



--
This message was sent by Atlassian JIRA
(v7.5.0#75005)