Bug #224455 “open jdk 6 truststore points to privileged access a...” : Bugs : openjdk-6 package : Ubuntu

Revision history for this message

In Iced Tea Bugzilla #133, Sylvain Beucler (beuc) wrote on 2008-04-02:

#7

Download full text (4.5 KiB)

Under Debian Etch, I compiled IcedTea6 (17 march), and installed tomcat5.5.

I configured it to run with SSL:
/usr/lib/jvm/java-6-openjdk/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /usr/share/tomcat5.5/.keystore
# passwd: changeit
sudo chown tomcat55: /usr/share/tomcat5.5/.keystore
sudo chmod 600 /usr/share/tomcat5.5/.keystore
# Simulate Fedora path for now:
sudo mkdir -p /etc/pki/tls/certs/
sudo ln -s /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt
# Modify /etc/tomcat5.5/server.xml and uncomment "Define a SSL HTTP/1.1 Connector on port 8443"

Relevant config:
    <Connector port="8443" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />

On startup I get:

...
INFO: Initialisation de Coyote HTTP/1.1 sur http-8180
2 avr. 2008 16:55:26 org.apache.coyote.http11.Http11BaseProtocol init
GRAVE: Erreur à l'initialisation du point de contact
java.io.IOException: Invalid keystore format
        at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:650)
        at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
        at java.security.KeyStore.load(KeyStore.java:1201)
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:282)
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getTrustStore(JSSESocketFactory.java:256)
        at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getTrustManagers(JSSE14SocketFactory.java:174)
        at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(JSSE14SocketFactory.java:111)
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:88)
        at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(PoolTcpEndpoint.java:292)
        at org.apache.coyote.http11.Http11BaseProtocol.init(Http11BaseProtocol.java:138)
        at org.apache.catalina.connector.Connector.initialize(Connector.java:1016)
        at org.apache.catalina.core.StandardService.initialize(StandardService.java:580)
        at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:791)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:503)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:523)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:266)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:431)
2 avr. 2008 16:55:26 org.apache.catalina.startup.Catalina load
GRAVE: Catalina.start
LifecycleException: L'initialisation du gestionnaire de protocole a échoué: java.io.IOException: Invalid keystore format
        at org.apache.catalina.connector.Connector.initi...

Under Debian Etch, I compiled IcedTea6 (17 march), and installed tomcat5.5.

I configured it to run with SSL:
/usr/lib/jvm/java-6-openjdk/bin/keytool -genkey -alias tomcat -keyalg RSA -keystore /usr/share/tomcat5.5/.keystore
# passwd: changeit
sudo chown tomcat55: /usr/share/tomcat5.5/.keystore
sudo chmod 600 /usr/share/tomcat5.5/.keystore
# Simulate Fedora path for now:
sudo mkdir -p /etc/pki/tls/certs/
sudo ln -s /etc/ssl/certs/ca-certificates.crt /etc/pki/tls/certs/ca-bundle.crt
# Modify /etc/tomcat5.5/server.xml and uncomment "Define a SSL HTTP/1.1 Connector on port 8443"

Relevant config:
    <Connector port="8443" maxHttpHeaderSize="8192"
               maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" />

On startup I get:

...
INFO: Initialisation de Coyote HTTP/1.1 sur http-8180
2 avr. 2008 16:55:26 org.apache.coyote.http11.Http11BaseProtocol init
GRAVE: Erreur à l'initialisation du point de contact
java.io.IOException: Invalid keystore format
        at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:650)
        at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
        at java.security.KeyStore.load(KeyStore.java:1201)
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getStore(JSSESocketFactory.java:282)
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.getTrustStore(JSSESocketFactory.java:256)
        at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.getTrustManagers(JSSE14SocketFactory.java:174)
        at org.apache.tomcat.util.net.jsse.JSSE14SocketFactory.init(JSSE14SocketFactory.java:111)
        at org.apache.tomcat.util.net.jsse.JSSESocketFactory.createSocket(JSSESocketFactory.java:88)
        at org.apache.tomcat.util.net.PoolTcpEndpoint.initEndpoint(PoolTcpEndpoint.java:292)
        at org.apache.coyote.http11.Http11BaseProtocol.init(Http11BaseProtocol.java:138)
        at org.apache.catalina.connector.Connector.initialize(Connector.java:1016)
        at org.apache.catalina.core.StandardService.initialize(StandardService.java:580)
        at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:791)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:503)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:523)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:266)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:431)
2 avr. 2008 16:55:26 org.apache.catalina.startup.Catalina load
GRAVE: Catalina.start
LifecycleException:  L'initialisation du gestionnaire de protocole a échoué: java.io.IOException: Invalid keystore format
        at org.apache.catalina.connector.Connector.initialize(Connector.java:1018)
        at org.apache.catalina.core.StandardService.initialize(StandardService.java:580)
        at org.apache.catalina.core.StandardServer.initialize(StandardServer.java:791)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:503)
        at org.apache.catalina.startup.Catalina.load(Catalina.java:523)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:616)
        at org.apache.catalina.startup.Bootstrap.load(Bootstrap.java:266)
        at org.apache.catalina.startup.Bootstrap.main(Bootstrap.java:431)
2 avr. 2008 16:55:26 org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 1987 ms
2 avr. 2008 16:55:27 org.apache.catalina.core.StandardService start
INFO: Démarrage du service Catalina
...

When using Sun's JRE 1.5 instead, it works fine (without modifying the keystore).

I see this also reported at:
http://www.mail-archive.com/users@tomcat.apache.org/msg40851.html
where the user installed JRE 1.6 instead of IcedTea to make things work.

I don't see this bug reported in bugzilla (search "keystore" returned zarro bugs), so I'm reporting it.

Revision history for this message

Nitya Doraisamy (nitya-doraisamy) wrote on 2008-05-04:

#1

This is adversely affecting GlassFish distribution. For a detailed account of what this affects, see: https://glassfish.dev.java.net/issues/show_bug.cgi?id=4986

Revision history for this message

Matthias Klose (doko) wrote on 2008-05-15:

#2

fixed in 6b09dfsg-1ubuntu2

Changed in openjdk-6:
status:	New → Fix Released

Revision history for this message

Craig (candrews-integralblue) wrote on 2008-05-16:

#3

How does one get 6b09dfsg-1ubuntu2? Is there a PPA? Will be in Hardy or a backports repository? Thanks

Bug Watch Updater (bug-watch-updater) on 2008-05-16

Changed in icedtea:
status:	Unknown → Confirmed

Revision history for this message

Matthias Klose (doko) wrote on 2008-05-17:

#4

the PPA to look at is https://launchpad.net/~openjdk/+archive

Revision history for this message

exactt (giesbert) wrote on 2008-05-17:

#5

i just came here from https://bugs.launchpad.net/ubuntu/+source/icedtea-java7/+bug/157721 . but with the ppa version i can't even run http://www.java.com/en/download/help/testvm.xml . on the console i get:

TestVM 4.18 sc
Copyright (c) 2008 Sun Microsystems, Inc.
All Rights Reserved.
Current JRE version set in file: 605
GCJ PLUGIN: thread 0x622910: plugin_in_pipe_callback
GCJ PLUGIN: thread 0x622910: plugin_in_pipe_callback: setting status Ausnahme: java.lang.NumberFormatException: For input string: " "
PIPE: plugin read: status Ausnahme: java.lang.NumberFormatException: For input string: " "
GCJ PLUGIN: thread 0x622910: plugin_in_pipe_callback return
PIPE: appletviewer wrote: status Ausnahme: java.lang.NumberFormatException: For input string: " "
java.lang.NumberFormatException: For input string: " "
at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65)
at java.lang.Integer.parseInt(Integer.java:470)
at java.lang.Integer.<init>(Integer.java:636)
at testvmDynamicJavaCom.init(testvmDynamicJavaCom.java:195)
at sun.applet.AppletPanel.run(AppletPanel.java:436)
at java.lang.Thread.run(Thread.java:636)

Revision history for this message

exactt (giesbert) wrote on 2008-05-22:

#6

i just filed https://bugs.launchpad.net/ubuntu/+source/openjdk-6/+bug/234025 which seems to be a duplicate of https://bugs.launchpad.net/ubuntu/+source/openjdk-6/+bug/220690 . But the problem still isn't fixed for me even with the packages from https://launchpad.net/~openjdk/+archive . Hence either the bug isn't fixed or https://bugs.launchpad.net/ubuntu/+source/openjdk-6/+bug/220690 is not a duplicate. right?

Revision history for this message

In Iced Tea Bugzilla #133, Andrew John Hughes (ahughes) wrote on 2008-07-20:

#8

There were some certificate-related patches being applied back then that have now changed. May be worth retrying with current IcedTea.

Bug Watch Updater (bug-watch-updater) on 2008-11-05

Changed in icedtea:
status:	Confirmed → Invalid

Revision history for this message

In Iced Tea Bugzilla #133, Sylvain Beucler (beuc) wrote on 2008-11-05:

#9

I confirm that it works now.

Bug Watch Updater (bug-watch-updater) on 2011-02-04

Changed in icedtea:
importance:	Unknown → Medium

	Status	Importance	Assigned to
GlassFish	Unknown	Unknown	auto-glassfish.dev.java.net #4986
Iced Tea	Invalid	Medium	icedtea-bugzilla #133
openjdk-6 (Ubuntu)	Fix Released	Undecided	Unassigned

Ubuntu
openjdk-6 package

open jdk 6 truststore points to privileged access area

Bug Description

Duplicates of this bug

Other bug subscribers

Remote bug watches

Ubuntuopenjdk-6 package

open jdk 6 truststore points to privileged access area

Bug Description

Duplicates of this bug

Other bug subscribers

Remote bug watches

Ubuntu
openjdk-6 package