I am using command:
keytool -importkeystore -srckeystore "X\cert.pfx" -srcstorepass password -srcstoretype pkcs12 -destkeystore "X\keystore3.jks" -destkeypass password -deststoretype JKS -alias alias
and get java.io.IOException: keystore password was incorrect
However if I double click on cert.pfx and during installation process enter passphrase which is password I successfully install it.
Another strange thing is that I am asked for a new keystore passphrase even thought I have supplied it with -destkeypass password
Update:
Strange thing happened out of nowhere: I was unable to use keytool anymore - I got This app can’t run on your PC. After calling where keytool I went to that directory and saw that keytool.exe is of size 0KB. All I was doing this time was jus trying different versions of keytool and openssl commands so I've got no idea why this had happened. Since I could not use that instance of keytool anymore I tried using different one as I have installed multiple JDK instances on my machine and I it worked: I mean I do not get keystore password was incorrect error anymore. I get another error now but it is a different story.
Related
So I am working on a FIPS compliant java base image with JDK11. The requirement was to convert the default keystore from JKS to BCFKS.
This is my java.security setting:
security.provider.1=org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider
security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider fips:BCFIPS
security.provider.3=SUN
security.provider.4=SunRsaSign
security.provider.5=SunEC
security.provider.6=SunJSSE BCFIPS
security.provider.7=SunJCE
security.provider.8=SunJGSS
security.provider.9=SunSASL
security.provider.10=XMLDSig
security.provider.11=SunPCSC
security.provider.12=JdkLDAP
security.provider.13=JdkSASL
security.provider.14=Apple
security.provider.15=SunPKCS11
#
# Default keystore type.
#
keystore.type=BCFKS
So when I try to convert the default keystore from JKS to BCFKS with the following command:
keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts.orig -srcstoretype JKS \
-srcstorepass changeit -destkeystore /etc/ssl/certs/java/cacerts -deststorepass changeit \
-deststoretype BCFKS -providerClass org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider \
--providerpath /usr/lib/jvm/java-11-openjdk-amd64/jar/bc-fips-1.0.2.3.jar
I get the following error:
Exception in thread "main" java.lang.StackOverflowError
at java.base/java.util.Dictionary.<init>(Dictionary.java:55)
at java.base/java.util.Hashtable.<init>(Hashtable.java:239)
at java.base/java.util.Properties.<init>(Properties.java:206)
at java.base/java.util.Properties.<init>(Properties.java:174)
at java.base/java.security.Provider.<init>(Provider.java:262)
at java.base/sun.security.ssl.SunJSSE.<init>(SunJSSE.java:138)
at java.base/sun.security.ssl.SunJSSE.<init>(SunJSSE.java:126)
at java.base/com.sun.net.ssl.internal.ssl.Provider.<init>(Provider.java:52)
at java.base/sun.security.jca.ProviderConfig.getProvider(ProviderConfig.java:183)
at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:266)
at java.base/sun.security.jca.ProviderList.getIndex(ProviderList.java:296)
at java.base/sun.security.jca.ProviderList.getProviderConfig(ProviderList.java:280)
at java.base/sun.security.jca.ProviderList.getProvider(ProviderList.java:286)
...
When I remove "BCFIPS" in provider.6, the error is gone, but I do need it to be there for the SSL to load BCFIPS as provider.
The same settings worked fine by my colleagues, but a notable difference is they use JDK8. Not sure if that's the reason.
Also I saw this https://github.com/bcgit/bc-java/issues/1000 who has exactly the same issue with me, unfortunately the workaround didn't work for me and there was no follow-up.
I've been stuck with this for days...HELP appreciated! Thank you!s
I tried the settings mentioned above, tried the keytool command, was expecting the keystore type converted correctly from JKS to BCFKS, but StackOverFlowError happened.
I have been attempting to help one of our sites with an error message they are getting while using an application that uses Glassfish. When signing into the application, the following errors are thrown:
CommunicationException: An error occurred while making the HTTP request to . This could be due to the fact that the server certificate is notconfigured properly with HTTP.SYS in the HTTPS case. This could also be caused by a mismatch of the security binding between the client and the server.
In Server.log, the following is displayed:
0400|SEVERE|glassfish3.1|com.sun.grizzly.config.GrizzlyServiceListener|_ThreadID=287;_ThreadName=Thread-1;|Failed to load keystore type JKS with path C:\glassfishv3\glassfish\domains\domain1/config/keystore.jks due to Keystore was tampered with, or password was incorrect
java.io.IOException: Keystore was tampered with, or password was incorrect
The site is only experiencing this problem when they change the glassfish master password. When the master password is left as its default setting, everything works correctly. The default master password is "changeit".
Additionally, the site generates and imports a certificate for use with glassfish. The following are the steps that are performed, in order, for generating a certificate and changing the password:
Stopped Glassfish service.
Opened MMC.MSC: Action --> All Tasks --> Request New Certificate
From the Certificate Enrollment wizard, chose a Computer type certificate. Click Properties Button and configure certificate. It gets a friendly name of "s1as" and an exportable private key of key size 2048. Private key is exported as a pfx file and certificate is exported as a cer file. The files are saved in the glassfish config folder. Details about this process available if needed.
DOS prompt opened and this command is run inside the glassfish config folder:
keytool -delete -alias s1as -keystore keystore.jks -storepass changeit
Following command is run:
keytool -import -v -trustcacerts -alias -file root.cer -keystore cacerts.jks -storepass changeit
Answered "Y" to trust the certificate.
Ran the following command to replace the original self-signed certificate with the pfx one.
keytool -importkeystore -srckeystore .pfx -srcstoretype pkcs12 -destkeystore keystore.jks -deststoretype JKS
Entered password, and a success message appears afterwards that 1 entry was succesfully imported.
Ran this command:
keytool -list -keystore keystore.jks -rfc
A lot of output is produced, including a long Alias name. Thsi long alias is used in the next command.
Ran the following command:
keytool -changealias -alias "" -destalias "s1as" -keypass changeit -keystore keystore.jks -storepass changeit
Ran the following command in asadmin:
change-master-password --savemasterpassword=true
Entered Current password of "changeit"
Entered new password of 123456
Re-entered 123456.
Success message that master password changed succesfully.
Started glassfish service
In my local testing, this procedure has worked and I am able to use the application with no errors. But on the site I am aiding, when they follow the same process, they receive the errors I listed at the top of this message.
My specific questions:
Could the site's certificate be causing this problem? If so, is there a way I could test that the certificate is the issue?
What other things might potentially be generating the errors? Could the "change-master-password" command not be properly changing the password, or could there be something else that needs to have the password changed as well?
I have found the solution to this, and I am posting it here should someone in the future encounter the same issue that I have. Hopefully this will save someone much frustration some day.
In domain.xml, the following 2 lines needed to be added in the jvm-options area.
<jvm-options>-Djavax.net.ssl.keyStorePassword=[password]</jvm-options>
<jvm-options>-Djavax.net.ssl.trustStorePassword=[password]</jvm-options>
While I'm trying to register with my phone, I'm getting this error:
Authentication Failed
UPDATE 3.18.14;
Okay , i compiled .apk file correctly with correct .bks file .Still i'm getting same error ! Should i change hosts file in my phone(samsung NOTE 3) ?
NOTES:
In application conf, server address: 192.168.1.100
I can connect on mobile browser with https://192.168.1.100:9443
Just execute this command.
keytool -importkeystore -srckeystore CA.p12 -srcstoretype PKCS12
-destkeystore wso2mobilemdm.jks
CA needs to be the one you have used to sign your SSL certificate.
try creating all certificate in one folder.before creating ,just copy wso2carbon.jsk and client-truststore.jks in that folder.
try only single password wherever ask. but in last step use wso2_mobile when it ask.
copy wso2carbon.jsk, client-truststore.jks and wso2mobilemdm.jks from that folder to repository/resources/security folder to overwrite.
then in that folder copy bcprov-jdk15on-149.jar and run following command in that folder.
keytool -importcert -trustcacerts -keystore emm_truststore.bks -storetype bks -storepass wso2carbon -file ca_cert.pem -provider org.bouncycastle.jce.provider.BouncyCastleProvider -providerpath ./bcprov-jdk15on-149.jar
thats it you will see emm_truststore.bks in that folder.
I'm having trouble getting ColdFusion to connect to a secure FTP server that uses a self-signed certificate. The connection just times out. I've tested the setup in an FTP client and it works, but you must accept an 'unknown certificate.'
The code, though it's not very helpful:
<cfftp
connection="ftp"
action="open"
server="server"
username="username"
password="password"
port="23456"
passive="true"
secure="true"
/>
Here's the error I get from ColdFusion:
Verify your connection attributes: username, password, server, fingerprint, port, key, connection, proxyServer, and secure (as applicable). Error: Session.connect: java.net.SocketTimeoutException: Read timed out.
Does anyone know if it's possible to accept the certificate? Or if that's even the problem?
I am not sure about cfftp but for cfhttp requests to sites with a self-signed certificate you have to import their certificate into the Java keystore on your ColdFusion server. So you might want to give that a try.
I always export the certificate in DER format
The command to import should be something like this:
keytool -import -v -alias giveUniqueName -file filename.cer -keystore cacerts -storepass thePassword
Here is the command line to verify an imported certificate:
keytool -list -v -keystore cacerts -alias giveUniqueName -storepass thePassword
I did not include the password here but am pretty sure you can Google it. If not, send me a message and I can give it to you.
Also, you may need to supply pathing information depending on where you run the keytool commands from and where your certificate file resides.
Another note, be sure you are updating the correct cacerts file that ColdFusion is using. In case you have more than one JRE installed on that server. You can verify the JRE ColdFusion is using from the administrator under the 'System Information'. Look for the Java Home line.
Oh - and you have to restart ColdFusion after making the import.
UPDATE FOR CF10
I found a forum discussion (here) talking about installing certificates on CF10. The keytool commands appear to be slightly different in their example. In case it is a bit different than CF9, here is what they said:
keytool -importcert -alias giveUniqueName -trustcacerts -file filename.cer -keystore cacerts -storepass thePassword
Trust this certificate? [no]: y
It looks like the verification command line has not changed.
Trying to setup SSL on jetty 7.2.2 using these instructions:
http://docs.codehaus.org/display/JETTY/How+to+configure+SSL
stuck on 3b:
keytool -importkeystore -srckeystore jetty.pkcs12 -srcstoretype PKCS12 -destkeystore $JETTY_HOME/etc/keystore
jetty ships with default keystore at $JETTY_HOME/etc/keystore. I'm asked for password when running that command. I don't know default keystore password.
If I try to replace that keystore with newly created one - I'm getting IOException on jetty startup - keystore is tampered with or password incorrect.
What I'm doing wrong? Or what's default keystore jetty password?
The default password for the keystore that is shipped with jetty is storepwd. But I would highly recommend you follow the steps listed in the How to configure SSL and create your own keystore.
I think you just want to overwrite the keystore in etc/keystore with your new one. Then, update the Jetty conf as in Step 4. You will need to obfuscate your keystore password using the org.mortbay.jetty.security.Password class.
One more subtle steps that needs to be followed .
i.e Jetty has another file start.ini, un-comment jetty-ssl.xml line to make the SSL configuration active.
That was my bad. Didn't notice that there's jetty-ssl.xml also, that used default keystore. Moved addConnector to jetty-ssl.xml, put right passwords there, and everything works now like a charm.
One note, the eclipse version of jetty works a little differently http://www.eclipsezone.com/eclipse/forums/t88098.html
Today with jetty 9.4.34 and you'd like to use the default keystore password storepwd and default private key password keypwd, so that you don't have to modify the config, and you have cert/key in common PEM format...
tmpcert="/tmp/certkey$RANDOM.pkcs12" ; \
openssl pkcs12 -export -inkey "key.pem" \
-in "cert.pem" \
-passout "pass:storepwd" \
-out "$tmpcert" \
&& \
keytool -importkeystore \
-srckeystore "$tmpcert" -srcstoretype PKCS12 \
-srcstorepass storepwd \
-destkeystore "$JETTY_BASE/etc/keystore" -deststoretype JKS \
-deststorepass storepwd \
-destkeypass keypwd ; \
rm "$tmpcert"
That's all you need to import to provide SSL functionality
Because of JKS there is the
Warning: The JKS keystore uses a proprietary format. It is recommended
to migrate to PKCS12 which is an industry standard format using
...
But it is the only possibility to set a different keypass like keypwd for key and storepwd for keystore.
For pkcs12 storetype this distinction is impossible (at least with keytool, there is an error on execution).
For the rest (like config modifications for own passwords, and generating own passwords) the documentation at https://www.eclipse.org/jetty/documentation/current/configuring-ssl.html is ok.