5

I have done lots of Google on this exception and found so many hints but didn't find any solution or reason on this (may be I missed anyone of those), so finally with tired eyes posting question to seek help.

I have a website URL i.e https://oesinternational.mkcl.org/, SSL certificate is installed on LB and web server is behind LB. Web server is having tomcat 7 with JAVA 8 on port 80. So LB is taking request on 443 port and forwarding it to web server on 80 port and web server sends the response to LB and LB to end user.

On browser everything works as expected but when I try to connect to this URL using JAVA then it throws exception

java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)

Code:

url = new URL("https://oesinternational.mkcl.org/");
HttpURLConnection connection = (HttpURLConnection)url.openConnection();
connection.setRequestMethod("GET");
connection.connect(); //this method throwing the exception

Full stacktrace is as follow:

java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
    at javax.net.ssl.DefaultSSLSocketFactory.throwException(SSLSocketFactory.java:248)
    at javax.net.ssl.DefaultSSLSocketFactory.createSocket(SSLSocketFactory.java:255)
    at sun.net.www.protocol.https.HttpsClient.createSocket(HttpsClient.java:405)
    at sun.net.NetworkClient.doConnect(NetworkClient.java:162)
    at sun.net.www.http.HttpClient.openServer(HttpClient.java:463)
    at sun.net.www.http.HttpClient.openServer(HttpClient.java:558)
    at sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:264)
    at sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:367)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:191)
    at sun.net.www.protocol.http.HttpURLConnection.plainConnect0(HttpURLConnection.java:1156)
    at sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:1050)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:177)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:162)
    at mkcl.oesclient.sync.controllers.ServerConnectionCheckHelper.isSSLCertficateInstalled(ServerConnectionCheckHelper.java:73)
    at mkcl.oesclient.sync.controllers.ServerConnectionCheckHelper.checkConnectionToESB(ServerConnectionCheckHelper.java:35)
    at mkcl.oesclient.sync.controllers.SynchronizeDataController.SyncMasterData(SynchronizeDataController.java:118)
    at mkcl.oesclient.sync.controllers.SynchronizeDataController.syncMasterAjax(SynchronizeDataController.java:90)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:209)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:870)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:776)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:991)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:978)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:870)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:621)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:855)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:728)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:305)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    at org.sitemesh.webapp.contentfilter.ContentBufferingFilter.bufferAndPostProcess(ContentBufferingFilter.java:169)
    at org.sitemesh.webapp.contentfilter.ContentBufferingFilter.doFilter(ContentBufferingFilter.java:126)
    at org.sitemesh.config.ConfigurableSiteMeshFilter.doFilter(ConfigurableSiteMeshFilter.java:163)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:243)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:210)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:222)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:123)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:472)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:171)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:99)
    at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:953)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:118)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:408)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1008)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:589)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1686)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
    at java.security.Provider$Service.newInstance(Provider.java:1617)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
    at javax.net.ssl.SSLContext.getInstance(SSLContext.java:156)
    at javax.net.ssl.SSLContext.getDefault(SSLContext.java:96)
    at javax.net.ssl.SSLSocketFactory.getDefault(SSLSocketFactory.java:122)
    at javax.net.ssl.HttpsURLConnection.getDefaultSSLSocketFactory(HttpsURLConnection.java:332)
    at javax.net.ssl.HttpsURLConnection.<init>(HttpsURLConnection.java:289)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.<init>(HttpsURLConnectionImpl.java:94)
    at sun.net.www.protocol.https.Handler.openConnection(Handler.java:62)
    at sun.net.www.protocol.https.Handler.openConnection(Handler.java:57)
    at java.net.URL.openConnection(URL.java:979)
    at mkcl.oesclient.sync.controllers.ServerConnectionCheckHelper.isSSLCertficateInstalled(ServerConnectionCheckHelper.java:71)
    ... 45 more
Caused by: java.security.UnrecoverableKeyException: Password must not be null
    at sun.security.provider.JavaKeyStore.engineGetKey(JavaKeyStore.java:132)
    at sun.security.provider.JavaKeyStore$JKS.engineGetKey(JavaKeyStore.java:56)
    at sun.security.provider.KeyStoreDelegator.engineGetKey(KeyStoreDelegator.java:96)
    at sun.security.provider.JavaKeyStore$DualFormatJKS.engineGetKey(JavaKeyStore.java:70)
    at java.security.KeyStore.getKey(KeyStore.java:1023)
    at sun.security.ssl.SunX509KeyManagerImpl.<init>(SunX509KeyManagerImpl.java:133)
    at sun.security.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:70)
    at javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:256)
    at sun.security.ssl.SSLContextImpl$DefaultManagersHolder.getKeyManagers(SSLContextImpl.java:979)
    at sun.security.ssl.SSLContextImpl$DefaultManagersHolder.<clinit>(SSLContextImpl.java:864)
    at sun.security.ssl.SSLContextImpl$DefaultSSLContext.<init>(SSLContextImpl.java:1019)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at java.security.Provider$Service.newInstance(Provider.java:1595)
    ... 57 more

While searching on google I come to know that the "SunJSSE" provider does not support SHA256RSA signature algorithm (ref JAVADOC) and the certificate on website uses signature algorithm SHA256RSA (check below image).

enter image description here

I wanted to know that:

  1. Is unsupported implementation of SHA256RSA signature algorithm in JAVA 8 causing the problem?
  2. If yes, then what will be the best solution? If no, then what I am doing wrong?

2 Answers 2

1
  1. Is unsupported implementation of SHA256RSA signature algorithm in JAVA 8 causing the problem?

NO. SunJSSE does not implement this algorithm, but SunRsaSign does on all systems. (So do SunMSCA only for the Windows natvie store, and OracleUcrypto only on Solaris SPARC.)

  1. ... If no, then what I am doing wrong?

The (innermost) cause in your stacktrace is

Caused by: java.security.UnrecoverableKeyException: Password must not be null

while attempting to open the (default) keystore.

You must provide the correct password for the keystore. You are using the default factory and context, and don't appear to have overridden anything, so the keystore password must be in the system property javax.net.ssl.keyStorePassword.

Or don't provide the keystore at all since it appears this server (really the LB doing the SSL/TLS termination) doesn't require client auth.

Sign up to request clarification or add additional context in comments.

3 Comments

"really the LB doing the SSL/TLS termination".. I will confirm this with IT infra but as per my knowledge it is behind the LB because in server.xml only 80 port connector is mentioned
But if we consider that keystore password is not correct then how website is working in browsers? Are they doing something different than JAVA does?
As I said, the server isn't requesting client auth. Browsers are interactive and only load a local cert&key if/when the server requests it -- and in that case browser uses a keystore different from the any used by Java, and this may or may not use a password. Java client by default is configured in advance; if the server is going to request it, you load the keystore before starting the connection (handshake), and if the keystore is JKS it always uses a password, but if the server isn't going to request it you don't need to load it.
0

You can try un-disabling of MD2 by re-enabling it by editing JDK_HOME/jre/lib/security/java.security. Simply comment the following line: From jdk.certpath.disabledAlgorithms=MD2 to #jdk.certpath.disabledAlgorithms=MD2

Comments

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.