I was able to resolve this. I used keytool to create a new keystore/trust 
store, then imported the previous truststore that had all the CA certs in it. 
That seemed to work. So even though the previous truststore had the certs in it 
and was not empty, it must have had some kind of linking problem maybe?

Shawn Beard
Sr. Systems Engineer

-----Original Message-----
From: john.e.gr...@wellsfargo.com.INVALID <john.e.gr...@wellsfargo.com.INVALID>
Sent: Friday, June 26, 2020 1:32 PM
To: users@tomcat.apache.org
Subject: RE: SSL error [EXTERNAL]

** CAUTION: External message


-----Original Message-----
From: Beard, Shawn M. <sbe...@wrberkley.com.INVALID>
Sent: Friday, June 26, 2020 11:57 AM
To: Tomcat Users List <users@tomcat.apache.org>
Subject: RE: SSL error [EXTERNAL]

The code is calling a new webservice. It has godaddy as its ca signer. It was 
getting the error before I added those java options. Those java options were my 
attempt to resolve it. Ive also tried adding the godaddy ca certs to java's 
cacert file without those java options. Same result.

Shawn Beard
Sr. Systems Engineer

-----Original Message-----
From: calder <calder....@gmail.com>
Sent: Friday, June 26, 2020 11:45 AM
To: Tomcat Users List <users@tomcat.apache.org>
Subject: Re: SSL error [EXTERNAL]

** CAUTION: External message

In Fri, Jun 26, 2020, 10:37 Beard, Shawn M. <sbe...@wrberkley.com.invalid>

> We are running tomcat-7.0.52(old I know) and java 1.7.0_80.

yea, BOTH are very old.

When the app makes calls to an external webservice. It keeps throwing this
> error:
> javax.net.ssl.SSLException : javax.net.ssl.SSLException:
> java.lang.RuntimeException: Unexpected error:
> java.security.InvalidAlgorithmParameterException: the trustAnchors
> parameter must be non-empty

> I have this in the java options and have confirmed the proper CA certs
> for this webservice is in the truststore. Any ideas?
> -Djavax.net.ssl.trustStorePassword=########
> -Djavax.net.ssl.trustStoreType=jks

Did this runtime EVER work?

If yes, "what" changed?

CONFIDENTIALITY NOTICE: This e-mail and the transmitted documents contain 
private, privileged and confidential information belonging to the sender. The 
information therein is solely for the use of the addressee. If your receipt of 
this transmission has occurred as the result of an error, please immediately 
notify us so we can arrange for the return of the documents. In such 
circumstances, you are advised that you may not disclose, copy, distribute or 
take any other action in reliance on the information transmitted.
X  ܚX KK[XZ[  \ \  ][  X  ܚX P X ]  \X K ܙ B  ܈Y][ۘ[  [X[  
K[XZ[  \ \  Z[ X ]  \X K ܙ B

That error message comes from PKIXParameters.setTrustAnchors().  I was able to 
reproduce the problem with an empty trust store.  I also tried a trust store 
with the wrong certs but got a different error.

With -Djavax.net.debug=ssl, you should see output like this:

trustStore is: /path/to/trust.jks
trustStore type is: jks
trustStore provider is:
the last modified time is: Fri Jun 26 13:27:52 CDT 2020 Reload the trust store 
Reload trust certs Reloaded 1 trust certs adding as trusted cert:

Followed by a list of certs found in the store.

Is that what's happening in your case?


Т                                                                     ХF  V 
7V'67& &R R   â W6W'2 V 7V'67& &T F  6B 6 R  &pФf "FF F    6    G2 
R   â W6W'2ֆV  F  6B 6 R  &pР

Reply via email to