Java: Invalid Keystore format Error - java

Does anyone know how to solve this java error?
java.io.IOException: Invalid keystore format
I get it when I try and access the certificate store from the Java option in control panels. It's stopping me from loading applets that require elevated privileges.
Error Image

I was able to reproduce the error by mangling the trusted.certs file at directory
C:\Documents and Settings\CDay\Application Data\Sun\Java\Deployment\security.
Deleting the file fixed the problem.

Do not include special characters in organization name and unit

Seems to be a missing certificate or an invalid format.
Did you already generate a certificate with keytool?

for me it meant that my key file I was trying to import was invalid (it was actually a 404 page not a valid key)

For you guys who can't find the 'Documents and Settings' (whatever reason there may be) here is another path where the trusted.certs can be found:
C:\Users\<username>\AppData\LocalLow\Sun\Java\Deployment\security
Hope this helps!

Related

Cacert issue with multiple aliases / certificates - javax.net.ssl.SSLHandshakeException

I am looking for ways to remove all aliases and certificates, and have a fresh start.
I tried searching for the keystore file but I am not able to find it.
I have no idea about the result of deleting 'cacerts' file in my java home.
Currently I am getting this exception:
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
I am using Java 8.
I will appreciate your help. Thanks !

How do I codesign a JavaFX application through the NetBeans API?

I found this in the netbeans IDE:
I was pretty excited because up until this point I've been code signing my JavaFX projects like this:
<fx:signjar keystore = "${comodo.key.store}"
alias = "${comodo.key.alias}"
storetype = "PKCS12"
keypass = "${comodo.key.pass}"
storepass = "${comodo.key.storepass}"
jar = "${JFX.build.dir}/${JFXProject.name}.jar"
destdir = "${JFX.sign.dir}"/>
Which is fine. I mean, it works great and all and there's nothing wrong with it but I would really love to be able to use the Netbeans API code signer interface directly rather than drop the XML into the build file. I filled in the information in the way that seemed correct by taking the values I had in place in the XML and putting them into the interface but it didn't work and I got an error:
Going to create default keystore in "/*Not saying but it was the file name*/"
Generating Key for 3d637e48-f0d8-11e3-825a-20cf305e6ed4
keytool error: java.io.IOException: Invalid keystore format
This shouldn't even need to happen should it? I mean, I've been using this certificate for a while directly in the ant script for a while with no problem, so why is it happening now?
A bit more information: this is a Comodo certificate (if that helps).
What am I doing wrong here?

SoapUI "failed to load url" error when loading WSDL

I keep having some weird problems. The main one is that I keep getting the following error when trying to add a WSDL to a new project:
Error loading [https://.../token?wsdl]: java.lang.Exception: Failed to load url; https://.../token?wsdl, 0 -
Here's the message recorded in the error.log file:
java.lang.Exception: Failed to load url; https://.../token?wsdl, 0 -
at com.eviware.soapui.impl.wsdl.support.wsdl.UrlWsdlLoader.load(UrlWsdlLoader.java:184)
at com.eviware.soapui.impl.wsdl.support.wsdl.WsdlLoader.loadXmlObject(WsdlLoader.java:121)
at com.eviware.soapui.impl.wsdl.support.xsd.SchemaUtils.getDefinitionParts(SchemaUtils.java:535)
at com.eviware.soapui.impl.wsdl.support.xsd.SchemaUtils.getDefinitionParts(SchemaUtils.java:524)
at com.eviware.soapui.impl.support.definition.support.AbstractDefinitionCache.update(AbstractDefinitionCache.java:97)
at com.eviware.soapui.impl.support.definition.support.AbstractDefinitionContext$Loader.construct(AbstractDefinitionContext.java:226)
at com.eviware.soapui.support.swing.SwingWorkerDelegator.construct(SwingWorkerDelegator.java:46)
at com.eviware.soapui.support.swing.SwingWorker$2.run(SwingWorker.java:149)
at java.lang.Thread.run(Unknown Source)
I verified that the application at that URL is up and running, and I can get to the WSDL from a web browser, but I keep getting this error message no matter what. I am using SoapUI 4.5.0 (32-bit) on a Windows 7 box. I've also tried the 64-bit version with the same results. It happens whether I am on VPN or not.
Do you know why I might be getting this error?
I have had the same problem. I resolved it by disabling the proxy in the SoapUI preferences.
(source : http://www.eviware.com/forum/viewtopic.php?f=13&t=12460)
In my case the server were the service was installed was configured only for TLS. SSL was not allowed. So you have to update SoapUI vmoptions file by adding the server TLS version
-Dsoapui.https.protocols=TLSv1.2
You can find vmoptions file under SoapUI installation folder:
C:\Program Files (x86)\SmartBear\SoapUI-5.0.0\bin\soapUI-5.0.0.vmoptions
I have had similar problems and worked around them by saving the WSDL locally. Don't forget to save any XSD files as well. You may need to edit the WSDL to specify an appropriate location for XSDs.
I got this error when trying to load a WebService implemented in MS Dynamics AX. Because I was connecting via VPN to my network, something went wrong with IPv6 settings. After Googling, I found the solution here: http://support.microsoft.com/kb/929852
In my case the
Error loading [https://.../token?wsdl]: java.lang.Exception: Failed to load url; https://.../token?wsdl, 0
was caused by fake certificate.
If you get the following in browser
"There is a problem with this website’s security certificate."
this is the case.
The resolution was to import a certificate to
C:\Program Files (x86)\SmartBear\SoapUI-5.0.0\jre\lib\security\cacerts
Which is default java used by SOAPUI
This could be a problem with IPV6 address SOAP UI picking. Adding the following JVM option fixed it for me:
-Djava.net.preferIPv4Stack=true
I added it here:
C:\Program Files\SmartBear\soapUI-4.5.2\bin\soapUI-4.5.2.vmoptions
Inside the wsdl file look for the import element, which looks like this :
`<import namespace="nameSpaceValue" location="Users/myname/.../targetxsdName.xsd"/>`
Change the location attribute in the above element to the location of your xsd files stored locally, and it should work.
The following solution helped me:
-Djsse.enableSNIExtension=false
In SoapUI-5.3.0.vmoptions.
This error is due to an erroneous schemaLocation in the WSDL file.
Indicate the correct location (either path on the disk or xsd url) of the xsd file in the wsdl file
exp
<xsd:import namespace="http://xyz:8080/" schemaLocation="http://172.17.16.53:9080/auth/authorizationBS?xsd=1"></xsd:import>
I had this issue when trying to use a SOCKS proxy. It appears that SoapUI does not support SOCKS proxys. I am using the Boomerang Chrome app instead.
I had this error and in my case, the problem was that I was using "localhost" in the URL.
I resolved that changing the localhost word for the respective IP, (Windows + R -> cmd -> ipconfig) then read the IP and write it to the URL replacing the "localhost" word
Close and reopen soapui. Probably is a bug of the application
Update SoapUI version to SoapUI 5.5.0. This error causes when I tried to load wsdl, because of old SoapUI version
If you are running your Web Application with the default port of 8080, please try to change the port to some other value and run your application again and trigger again your SOAPUI request. As you might have history projects in your SOAP UI workspace with port number 8080, might create issues.
My solution was to modify the java.security file:
\SoapUI-5.3.0\jre\lib\security\java.security
Comment code syntax:
#jdk.certpath.disabledAlgorithms=MD2, DSA, RSA keySize < 2048
#jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024
For java version above 1.8,
Use below command to setup soapUI jar
java -jar --add-modules java.xml.bind --add-modules java.xml.ws <path for jar file+jar file name.jar>

RMI Registry Issue: rmiregistry may cause unintended exceptions when binding with codebase using the "file:" URL scheme

Please see the passage "RMI Registry Issue" of this article for the background on Java Update 1.6.0_29 first.
If I understand correctly (I'm german), the update introduces a bug in the rmiregistry which fails to work with the file: pattern in the codebase.
I.E. the following won't work any more with 1.6.0_29:
-Djava.rmi.server.codebase="file:myproject/bin/ ..."
We are currently using the feature of having a codebase with file: syntax. Does anyone know a workaround for making this work?
Note: No, we do not want to start a local webserver or ftp server.
Update:
On Naming.bind this exception is thrown:
java.rmi.ServerException: RemoteException occurred in server thread; nested exception is:
java.rmi.UnmarshalException: error unmarshalling arguments; nested exception is:
java.lang.ClassNotFoundException: access to class loader denied
at sun.rmi.server.UnicastServerRef.oldDispatch(UnicastServerRef.java:400)
at sun.rmi.server.UnicastServerRef.dispatch(UnicastServerRef.java:248)
at sun.rmi.transport.Transport$1.run(Transport.java:159)
at java.security.AccessController.doPrivileged(Native Method)
I had the same problem, and can confirm that downgrading JDK to earlier version solves the problem. I know, it's not a solution you're looking for, but at least it makes it to work.
Take running in windows as an example:
Step 1. In C:\Users\Jimmy.java.policy (create it if not exist), append below content:
grant { permission java.security.AllPermission; };
Of course "C:\Users\Jimmy\" is the user home, please change to your home accordingly.
Adding AllPermission is just for quick resolving your issue. you'd better config a more accurate FilePermission here.
Step 2. Start rmiregistry:
C:\JDK\bin>rmiregistry -J-Djava.rmi.server.codebase=file://C:/workspaces/MyLab/target/classes/
(Please note codebase must ended with "/")
Step 3. Run your server and client program.
References:
http://docs.oracle.com/javase/7/docs/technotes/guides/rmi/codebase.html
http://docs.oracle.com/javase/7/docs/technotes/guides/security/spec/security-spec.doc3.html
http://docs.oracle.com/javase/7/docs/technotes/guides/rmi/enhancements-7.html
It looks like there is no workaround because it is a bug, so wait for the fix
See details at
https://bugzilla.redhat.com/show_bug.cgi?id=751203
Code fix
http://icedtea.classpath.org/hg/icedtea6/rev/67df573b0734
If you do not need dynamic code downloading (in which case you can use ftp codebase) the solution is simply to set CLASSPATH environment variable to the path to your jar file:
Windows:
set CLASSPATH="path_to_jarfile"
Linux (batch):
CLASSPATH="path_to_jarfile"
export CLASSPATH
Best place to do it is in some script that invokes the RMI server.
Setting class path in the command line (-cp option) when starting RMI server does not help because it does not affect rmiregistry classpath!
If you start the rmiregistry in the working directory of your project, it works.
So essentially working directory of your project and current directory for rmiregistry should be same.
I recently encountered this issue as well. I can confirm that when using the file: protocol the rmiregistry must either:
be started in the root of the directory containing the shared classes; or
set the classpath to point to the shared classes or shared class jar; or
use a protocol other than file:// (I set up ngnix and served the jar from that).
Maybe not what you want, but you could resolve this with classpath rather than codebase. The client JVM will work fine if you add the required classes to its classpath. If you are using the file: URL scheme, then the classes must already be available on the localhost.
I had the same problem but I couldn't change the JDK version. Turns out you can solve it by running/starting the rmiregistry from the same directory as your code base, which in my case was target/classes. So cd project/target/classes and then run rmiregistry &

How to test the code signing of a JAR file on a client machine?

We have signed a JAR file using a certificate generated by MS Active Directory Certificate Services. However, when accessing it via Java Web Start we are getting the prompt that the digital signature cannot be verified even though we've installed the root CA into the certificate store on the client machine.
Now trying to look at the root CA on the client machine, using "keytool -list", I'm seeing an exception (invalid URI:file://\my_msadcs_server\path\to\CRL.crl). So now I'm not sure exactly what is going wrong.
Anyone have a suggestion or sample Java code on how I can test the downloaded JAR file's signature on the client machine in an attempt to figure out exactly why JWS is complaining? It could be that the root CA certificate has a problem (and I will chase down that avenue when my AD admin gets in) but I'd like to rule out other possibilities first. Currently the only thing I have to go on is the exception from "keytool -list", but keytool had no issues importing the root CA certificate in the first place.
Thanks in advance!,
mG.
I use jarsigner with the -verify, -verbose and -certs options. You may have to specify your -keystore, too.
I think the invalid URI message is a clue. Java file URI takes the following form: file://host/path

Categories

Resources