Java SSL/TLS with KeyStore and ServerSockets

Question

I am coding a SocketServer Lib with an TLS/SSL Function, but i have a Problem in my Code.

If I load the Keystore File, it throws an IOException, but the Cert gets fully displayed in the Browser.

My Code:

SSLServerSocketFactory factoryIO;
FileManager certificateIO = new FileManager(CacheHandler.fileIO.getPath("database") + "letsencrypt.jks");
char[] passphraseIO = "12345678".toCharArray();

if (certificateIO.exits()) {
    //this.socketIO = SSLServerSocketFactory.getDefault().createServerSocket(this.networkIO.getPort(), 10, this.networkIO.getAddress());
    //this.socketIO = this.getContext().getServerSocketFactory().createServerSocket(this.networkIO.getPort(), 10, this.networkIO.getAddress());

    // Load Key Store.
    KeyStore storeIO = KeyStore.getInstance("JKS");
    storeIO.load(certificateIO.stream(), passphraseIO);

    // Initialize Key Manger.
    KeyManagerFactory managerIO = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    managerIO.init(storeIO, passphraseIO);

    // Initialize Trust Manger.
    // TrustManagerFactory trustIO = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    //trustIO.init(storeIO);

    // Initialize SSL Context with Trust and Key Manager.
    SSLContext contextIO = SSLContext.getInstance(this.protocolIO);
    contextIO.init(managerIO.getKeyManagers(), null /*trustIO.getTrustManagers()*/, null);


    factoryIO = contextIO.getServerSocketFactory();
    // ((SSLServerSocket) this.socketIO).setWantClientAuth(true);
    //((SSLServerSocket) this.socketIO).setEnabledCipherSuites(new String[]{"TLS_DHE_DSS_WITH_AES_256_CBC_SHA256"});
    //((SSLServerSocket) this.socketIO).setEnabledProtocols(new String[]{"TLSv1.2"});

I tried many things but i can't get it to run without this error, it worked i while a go but i don't know what i made, to produce this error.

Which throws the following Exception:

java.io.IOException: Invalid keystore format
    at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:658)
    at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56)
    at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224)
    at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70)
    at java.security.KeyStore.load(KeyStore.java:1445)
    at sun.security.util.AnchorCertificates$1.run(AnchorCertificates.java:61)
    at sun.security.util.AnchorCertificates$1.run(AnchorCertificates.java:52)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.security.util.AnchorCertificates.<clinit>(AnchorCertificates.java:52)
    at sun.security.provider.certpath.AlgorithmChecker.checkFingerprint(AlgorithmChecker.java:214)
    at sun.security.provider.certpath.AlgorithmChecker.<init>(AlgorithmChecker.java:164)
    at sun.security.provider.certpath.AlgorithmChecker.<init>(AlgorithmChecker.java:118)
    at sun.security.validator.SimpleValidator.engineValidate(SimpleValidator.java:157)
    at sun.security.validator.Validator.validate(Validator.java:262)
    at sun.security.validator.Validator.validate(Validator.java:238)
    at sun.security.validator.Validator.validate(Validator.java:207)
    at javax.crypto.JarVerifier.isTrusted(JarVerifier.java:610)
    at javax.crypto.JarVerifier.verifySingleJar(JarVerifier.java:530)
    at javax.crypto.JarVerifier.verifyJars(JarVerifier.java:363)
    at javax.crypto.JarVerifier.verify(JarVerifier.java:289)
    at javax.crypto.JceSecurity.verifyProviderJar(JceSecurity.java:164)
    at javax.crypto.JceSecurity.getVerificationResult(JceSecurity.java:190)
    at javax.crypto.JceSecurity.canUseProvider(JceSecurity.java:204)
    at javax.crypto.KeyAgreement.getInstance(KeyAgreement.java:179)
    at sun.security.ssl.JsseJce.getKeyAgreement(JsseJce.java:269)
    at sun.security.ssl.JsseJce$EcAvailability.<clinit>(JsseJce.java:418)
    at sun.security.ssl.JsseJce.isEcAvailable(JsseJce.java:194)
    at sun.security.ssl.CipherSuite$KeyExchange.isAvailable(CipherSuite.java:371)
    at sun.security.ssl.CipherSuite.isAvailable(CipherSuite.java:185)
    at sun.security.ssl.SSLContextImpl.getApplicableCipherSuiteList(SSLContextImpl.java:304)
    at sun.security.ssl.SSLContextImpl.access$100(SSLContextImpl.java:42)
    at sun.security.ssl.SSLContextImpl$AbstractTLSContext.<clinit>(SSLContextImpl.java:432)
    at java.lang.Class.forName0(Native Method)
    at java.lang.Class.forName(Class.java:264)
    at java.security.Provider$Service.getImplClass(Provider.java:1634)
    at java.security.Provider$Service.newInstance(Provider.java:1592)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:236)
    at sun.security.jca.GetInstance.getInstance(GetInstance.java:164)
    at javax.net.ssl.SSLContext.getInstance(SSLContext.java:156)
    at de.bytestore.mytriox.network.server.ServerSocket.startIO(ServerSocket.java:203)
    at de.bytestore.mytriox.network.server.ServerSocket.start(ServerSocket.java:172)
    at de.bytestore.mytriox.web.WebServer.start(WebServer.java:44)
    at de.bytestore.mytriox.web.WebService.start(WebService.java:54)
    at de.bytestore.mytriox.service.ServiceHandler.start(ServiceHandler.java:63)
    at de.bytestore.mytriox.service.ServiceHandler.start(ServiceHandler.java:48)
    at de.bytestore.mytriox.guardian.GuardianHandler.init(GuardianHandler.java:121)
    at de.bytestore.mytriox.guardian.GuardianHandler.load(GuardianHandler.java:82)
    at de.bytestore.mytriox.Controller.main(Controller.java:11)

I generate my KeyStore file via following Command:

keytool -genkeypair -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass 12345678 -dname "CN=localhost, OU=Developers, O=Bull Bytes, L=Linz, C=AT"

You should post the complete stacktrace. Now we're even missing the exception message! — Maarten Bodewes
– Maarten Bodewes, Commented Jul 4, 2021 at 12:04
There is DualFormatJKS in there, I wonder if it first tries to load it as "JKS" or "PKCS12" key store and then finds out it needs to use the other one... Just a hunch, not an answer. Are you using an older Java, such as Java 8 maybe? — Maarten Bodewes
– Maarten Bodewes, Commented Jul 4, 2021 at 12:33
Yes, I am using Java 8, but I use the Method instance for JKS and no other Store Type. — Jan Heil
– Jan Heil, Commented Jul 4, 2021 at 12:50
What happens if you specify the key store explicitly as "JKS" in keytool? Are you sure that keytool itself is also using Java 8? If you are using e.g. Maven, please see here — Maarten Bodewes
– Maarten Bodewes, Commented Jul 4, 2021 at 13:10

Jan Heil · Accepted Answer · 2021-07-04 15:57:23Z

0

The Problem was the stream Method of my KeyStore.

I converted the URL to a URI to open a Stream, which didn't worked because the relative Path was wrong.

So I using now an FileInputStream and getting the Exception for a wrong path.

answered Jul 4, 2021 at 15:57

Jan Heil

4255 silver badges14 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Maarten Bodewes Over a year ago

Ah, yeah, that's outside of my perception, thanks for reporting back. Not so useful to others as the problem is outside KeyStore in case anybody is looking this up.

Gene Over a year ago

Fwiw, the error is thrown based on the first two words of the file. github.com/frohoff/jdk8u-jdk/blob/master/src/share/classes/sun/… So it had to be either bad data or bad i/o.

Jan Heil Over a year ago

Sorry for commenting back, but my error is not resolved fully. I thought it, but there's the same Error many lines before.

Dharman · Accepted Answer · 2021-07-07 11:03:03Z

0

Fixed my Problem by Changing the Java Version.

The Oracle one gave Problems with my Code, I switched to Java 14, and it worked...

edited Jul 7, 2021 at 11:03

Dharman♦

33.9k27 gold badges103 silver badges157 bronze badges

answered Jul 6, 2021 at 13:59

Jan Heil

4255 silver badges14 bronze badges

Collectives™ on Stack Overflow

Java SSL/TLS with KeyStore and ServerSockets

2 Answers 2

3 Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

3 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related