Converted to p12 but truststore is PrivateCertEntry not CertEntry (Spring Boot)

CraigFoote · January 3, 2022, 8:52pm

My domain is: footeware.ca

I ran this command: sudo certbot certonly -a standalone -d footeware.ca

It produced this output:
Requesting a certificate for footeware.ca
Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/footeware.ca/fullchain.pem
Key is saved at: /etc/letsencrypt/live/footeware.ca/privkey.pem
This certificate expires on 2022-04-03.
These files will be updated when the certificate renews.

My web server is (include version): Embedded Tomcat in Spring Boot 2.6.1 jar not sure the version.

The operating system my web server runs on is (include version): Ubuntu 20.10

My hosting provider, if applicable, is: local 'server' computer

I can login to a root shell on my machine (yes or no, or I don't know): yes

I'm using a control panel to manage my site (no, or provide the name and version of the control panel): no

The version of my client is (e.g. output of certbot --version or certbot-auto --version if you're using Certbot): certbot 1.22.0

I converted the generated artifacts to p12 via:
openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out keystore.p12 -name tomcat -CAfile chain.pem -caname root

I moved the p12 to my development machine into my eclipse project's resources folder.
When I start the application (and its server) and debug thru it finds the truststore but states it's not an instanceof sun.security.pkcs12.PKCS12KeyStore.CertEntry but rather a sun.security.pkcs12.PKCS12KeyStore$PrivateKeyEntry and so it fails with:

java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

What have I done wrong?

CraigFoote · January 3, 2022, 8:57pm

I should have added this from keytool -list

Alias name: tomcat
Creation date: Jan. 3, 2022
Entry type: PrivateKeyEntry
Certificate chain length: 3
Certificate[1]:
Owner: CN=footeware.ca
Issuer: CN=R3, O=Let's Encrypt, C=US

rg305 · January 3, 2022, 9:42pm

Try rebuilding the p12 file without (one or both of these):

CraigFoote · January 3, 2022, 9:55pm

No luck. I tried with and without each of them and without both of them but the p12 still lists as PrivateKeyEntry.

rg305 · January 3, 2022, 10:38pm

Please show the chain.pem file used.

CraigFoote · January 3, 2022, 10:44pm

schoen · January 4, 2022, 12:57am

I really don't know much about PKCS#12 but I wonder if the -inkey privkey.pem is doing something you don't want (if the software you're using doesn't expect the private key to be included in the resulting file). It seems that this is asking openssl to read the private key corresponding to the certificate and so I imagine it would presumably want to include that private key in the output file as well.

CraigFoote · January 4, 2022, 1:08am

I'm a total noob with certs in general and I've been following blogs and posts to set this up. They all seem to agree in that exact conversion of the pems to p12 using openssl though. Unless there's something wrong with the generated pems, and I definitely doubt that, I suspect I'm doing something wrong on the Spring Boot side. Would it be poor etiquette to cross-post on Stack Overflow? They have a dedicated Spring Boot tag that seems to deliver pretty good.

schoen · January 4, 2022, 1:11am

I feel like Java and PKCS#12 stuff is one area where this forum's expertise is unfortunately fairly thin, so I don't think there would be anything at all wrong with trying a different forum where people might have more experience with that.

On this forum, when users are using Tomcat, people have often suggested not using Tomcat's HTTPS support directly, and instead creating a reverse proxy with something like Caddy (that has built-in Let's Encrypt support) that then proxies to a TCP port on localhost where Tomcat is listening. That can be a very quick and convenient solution, but I also understand if people want to get things working with a Tomcat-only approach. But it's just not something that most people on this forum have had that much experience with.

CraigFoote · January 4, 2022, 1:26am

Thanks, for those following along at home:

webprofusion · January 4, 2022, 1:47am

I think perhaps your trust store does not know about the Let's Encrypt root (ISRG Root X1) and it needs to be imported java - Client Authentication Tomcat - trustAnchors parameter must be non-empty - Stack Overflow

rg305 · January 4, 2022, 2:39am

Try removing the last cert from the files:
chain.pem
fullchain.pem
and retry the p12.

Then we shall see if:

CraigFoote · January 4, 2022, 3:00am

Didn't seem to make any difference:

InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

rg305 · January 4, 2022, 3:17am

Then it seems that:

CraigFoote · January 4, 2022, 3:39am

I did:

sudo update-ca-certificates -f
sudo /var/lib/dpkg/info/ca-certificates-java.postinst configure

...and used my original keystore.p12 (seems there was nothing wrong with it).
The solution was to change my application.properties' values to:

server.ssl.trust-store=file:/etc/ssl/certs/java/cacerts
server.ssl.trust-store-password=changeit
server.ssl.trust-store-type=JKS

I had been setting those properties to the keystore.p12 thinking they were one and the same (noob).
I deployed and started the appication jar, set my router to forward 443 to my server@8443 (instead of 80 to 8090 as it was) and I'm in with a happy https indicator!

Now I just have to fix the broken css that upgrading bootstrap seems to have caused. Pain that the cert prevents me from using localhost now as it only supports footeware.ca.
Any ideas there?

webprofusion · January 4, 2022, 4:59am

Great, so potentially your default config for the trusts store was not pointing to an updated cacerts locations.

To work on localhost but emulate connecting via the real domain you can add the fully qualified (domain) name to your hosts file for development pointing to 127.0.0.1 (or any local machine IP), then browse to your website normally using the 'real' domain that matches the cert. This works on Windows as well as linux and macos. You just need to remember and remove it later!

CraigFoote · January 4, 2022, 1:54pm

Perfect! Thanks for everything.

system · February 3, 2022, 1:55pm

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.