You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@tomcat.apache.org by Ivano Luberti <lu...@archicoop.it.INVALID> on 2023/06/08 10:10:23 UTC
problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Hi, all I have the following problem.
My web application executes an SSL connection but fails with the
following exception
> AxisFault: java.security.NoSuchAlgorithmException: Error constructing
> implementation (algorithm: Default, provider: SunJSSE, class:
> sun.security.ssl.SSLContextImpl$DefaultSSLContext)
> org.apache.axis2.AxisFault,makeFault,430
> org.apache.axis2.transport.http.HTTPSender,sendViaPost,197
> org.apache.axis2.transport.http.HTTPSender,send,75
> org.apache.axis2.transport.http.CommonsHTTPTransportSender,writeMessageWithCommons,404
> org.apache.axis2.transport.http.CommonsHTTPTransportSender,invoke,231
> org.apache.axis2.engine.AxisEngine,send,443
> org.apache.axis2.description.OutInAxisOperationClient,send,406
> org.apache.axis2.description.OutInAxisOperationClient,executeImpl,229
> org.apache.axis2.client.OperationClient,execute,165
> it.sella.ecomm.WSCryptDecryptStub,encrypt,197
> it.archicoop.met.sistemapagamento.bancasella.wscryptdecryptclient.WSClient,encrypt,61
> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,75
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaConCartaDiCredito,328
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,paga,112
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaHiddenIframe,452
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,doGet,585
> javax.servlet.http.HttpServlet,service,670
> javax.servlet.http.HttpServlet,service,779
> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,227
> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> org.apache.tomcat.websocket.server.WsFilter,doFilter,53
> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,189
> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> org.apache.catalina.core.StandardWrapperValve,invoke,197
> org.apache.catalina.core.StandardContextValve,invoke,97
> org.apache.catalina.authenticator.AuthenticatorBase,invoke,541
> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> org.apache.catalina.core.StandardHostValve,invoke,135
> org.apache.catalina.valves.ErrorReportValve,invoke,92
> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> org.apache.catalina.core.StandardEngineValve,invoke,78
> org.apache.catalina.connector.CoyoteAdapter,service,360
> org.apache.coyote.http11.Http11Processor,service,399
> org.apache.coyote.AbstractProcessorLight,process,65
> org.apache.coyote.AbstractProtocol$ConnectionHandler,process,893
> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor,doRun,1789
> org.apache.tomcat.util.net.SocketProcessorBase,run,49
> org.apache.tomcat.util.threads.ThreadPoolExecutor,runWorker,1191
> org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker,run,659
> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable,run,61
> java.lang.Thread,run,750
> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,109
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaConCartaDiCredito,328
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,paga,112
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaHiddenIframe,452
> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,doGet,585
> javax.servlet.http.HttpServlet,service,670
> javax.servlet.http.HttpServlet,service,779
> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,227
> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> org.apache.tomcat.websocket.server.WsFilter,doFilter,53
> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,189
> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> org.apache.catalina.core.StandardWrapperValve,invoke,197
> org.apache.catalina.core.StandardContextValve,invoke,97
> org.apache.catalina.authenticator.AuthenticatorBase,invoke,541
> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> org.apache.catalina.core.StandardHostValve,invoke,135
> org.apache.catalina.valves.ErrorReportValve,invoke,92
> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> org.apache.catalina.core.StandardEngineValve,invoke,78
> org.apache.catalina.connector.CoyoteAdapter,service,360
> org.apache.coyote.http11.Http11Processor,service,399
> org.apache.coyote.AbstractProcessorLight,process,65
> org.apache.coyote.AbstractProtocol$ConnectionHandler,process,893
> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor,doRun,1789
> org.apache.tomcat.util.net.SocketProcessorBase,run,49
> org.apache.tomcat.util.threads.ThreadPoolExecutor,runWorker,1191
> org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker,run,659
> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable,run,61
> java.lang.Thread,run,750
I have built a standalone client that makes the same connection and it
succeeds on the same server calling the same JVM
/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.352.b08-2.el8_6.x86_64/jre/bin/java
I tried to extend ssl logging in tomcat adding -Djavax.net.debug=ssl to
see any root cause but to no avail
Here is how the tomcat service is configured
> [Service]
> Type=forking
>
> User=tomcat
> Group=tomcat
>
> Environment="JAVA_HOME=/usr/lib/jvm/jre"
> Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom
> -Djavax.net.debug=ssl"
> Environment="CATALINA_BASE=/opt/tomcat"
> Environment="CATALINA_HOME=/opt/tomcat"
> Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"
> Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"
>
> ExecStart=/opt/tomcat/bin/startup.sh
> ExecStop=/opt/tomcat/bin/shutdown.sh
>
> [Install]
> WantedBy=multi-user.target
Someone out there can give me any help?
--
Archimede Informatica tratta i dati personali in conformità a quanto
stabilito dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno
2003 n. 196
per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
Informativa completa
<http://www.archicoop.it/fileadmin/pdf/InformativaTrattamentoDatiPersonali.pdf>
dott. Ivano Mario Luberti
Archimede Informatica società cooperativa a r. l.
Via Gereschi 36, 56127 Pisa
tel.: +39 050/580959 | fax: +39 050/8932061
web: www.archicoop.it
linkedin: www.linkedin.com/in/ivanoluberti
facebook: www.facebook.com/archimedeinformaticapisa/
Re: AW: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by Ivano Luberti <lu...@archicoop.it.INVALID>.
Hi Thomas thank for the advice.
I agree is not Tomcat by itself responsible for the issue
But, since I'm able to make the same connection to the same server,
using a standalone client that implements the same request using the
same library (Axis2) and the same code (the connection is made by a
client written by me that the web application uses as a library) I
cannot understand where is the difference in using SSL by the two
clients (the one inside Tomcat and other running standalone).
Since I'm not expert in SSL matters I don't know how to search for
differences between the two java execution.
I understand is not a matter of Tomcat configuration using SSL (BTW this
instance is not configured for SSL since is secure connection is
implemented by a reverse proxy)
In the tomcat case Java is NOT able to use the algorithm while
launching a Java main class that implements the same behaviour it succeeds.
And that happens using the same JVM. Here is the command line for the
stand alone
/usr/lib/jvm/jre/bin/java -Djava.security.egd=file:///dev/urandom
-Djavax.net.debug=ssl"
here is the configuration of tomcat (BTW is tomcat9)
> [Service]
> Type=forking
>
> User=tomcat
> Group=tomcat
>
> Environment="JAVA_HOME=/usr/lib/jvm/jre"
> Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom
> -Djavax.net.debug=ssl"
> Environment="CATALINA_BASE=/opt/tomcat"
> Environment="CATALINA_HOME=/opt/tomcat"
> Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"
> Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"
>
> ExecStart=/opt/tomcat/bin/startup.sh
> ExecStop=/opt/tomcat/bin/shutdown.sh
>
> [Install]
> WantedBy=multi-user.target
I cannot spot a significative difference.
Could startup.sh contain some option that could create a difference with
respect to this matter?
Il 08/06/2023 16:39, Thomas Hoffmann (Speed4Trade GmbH) ha scritto:
> Hello Ivano,
>
>> -----Ursprüngliche Nachricht-----
>> Von: Ivano Luberti<lu...@archicoop.it.INVALID>
>> Gesendet: Donnerstag, 8. Juni 2023 12:10
>> An:users@tomcat.apache.org
>> Betreff: problem with SSL connection
>> java.security.NoSuchAlgorithmException: Error constructing implementation
>>
>> Hi, all I have the following problem.
>>
>> My web application executes an SSL connection but fails with the following
>> exception
>>
>>> AxisFault: java.security.NoSuchAlgorithmException: Error constructing
>>> implementation (algorithm: Default, provider: SunJSSE, class:
>>> sun.security.ssl.SSLContextImpl$DefaultSSLContext)
>>> org.apache.axis2.AxisFault,makeFault,430
>>> org.apache.axis2.transport.http.HTTPSender,sendViaPost,197
>>> org.apache.axis2.transport.http.HTTPSender,send,75
>>>
>> org.apache.axis2.transport.http.CommonsHTTPTransportSender,writeMessa
>> g
>>> eWithCommons,404
>>>
>
> Here it is visible, that the Axis Client can't connect to the server.
> It has nothing to do with Tomcat in my opinion.
> The crypt algorithms are provided by the JDK (or separate libraries).
>
> Your program acts as a client, connecting to a server. Therefore Tomcat is not involved in this case.
>
> If the endpoint of the service is public available, you can do a scan with e.g.https://www.ssllabs.com/ssltest/ to inspect the offered ciphers.
> Also check, if the certificates are available and that the server is configured with the intermediates.
>
>> org.apache.axis2.transport.http.CommonsHTTPTransportSender,invoke,231
>>> org.apache.axis2.engine.AxisEngine,send,443
>>> org.apache.axis2.description.OutInAxisOperationClient,send,406
>>> org.apache.axis2.description.OutInAxisOperationClient,executeImpl,229
>>> org.apache.axis2.client.OperationClient,execute,165
>>> it.sella.ecomm.WSCryptDecryptStub,encrypt,197
>>> it.archicoop.met.sistemapagamento.bancasella.wscryptdecryptclient.WSCl
>>> ient,encrypt,61
>>> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,75
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaConCartaDiCre
>>> dito,328
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,paga,112
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaHiddenIframe,
>>> 452
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,doGet,585
>>> javax.servlet.http.HttpServlet,service,670
>>> javax.servlet.http.HttpServlet,service,779
>>> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,227
>>> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
>>> org.apache.tomcat.websocket.server.WsFilter,doFilter,53
>>> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,189
>>> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
>>> org.apache.catalina.core.StandardWrapperValve,invoke,197
>>> org.apache.catalina.core.StandardContextValve,invoke,97
>>> org.apache.catalina.authenticator.AuthenticatorBase,invoke,541
>>> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
>>> org.apache.catalina.core.StandardHostValve,invoke,135
>>> org.apache.catalina.valves.ErrorReportValve,invoke,92
>>> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
>>> org.apache.catalina.core.StandardEngineValve,invoke,78
>>> org.apache.catalina.connector.CoyoteAdapter,service,360
>>> org.apache.coyote.http11.Http11Processor,service,399
>>> org.apache.coyote.AbstractProcessorLight,process,65
>>> org.apache.coyote.AbstractProtocol$ConnectionHandler,process,893
>>> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor,doRun,1789
>>> org.apache.tomcat.util.net.SocketProcessorBase,run,49
>>> org.apache.tomcat.util.threads.ThreadPoolExecutor,runWorker,1191
>>> org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker,run,659
>>> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable,run,61
>>> java.lang.Thread,run,750
>>> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,109
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaConCartaDiCre
>>> dito,328
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,paga,112
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaHiddenIframe,
>>> 452
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,doGet,585
>>> javax.servlet.http.HttpServlet,service,670
>>> javax.servlet.http.HttpServlet,service,779
>>> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,227
>>> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
>>> org.apache.tomcat.websocket.server.WsFilter,doFilter,53
>>> org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,189
>>> org.apache.catalina.core.ApplicationFilterChain,doFilter,162
>>> org.apache.catalina.core.StandardWrapperValve,invoke,197
>>> org.apache.catalina.core.StandardContextValve,invoke,97
>>> org.apache.catalina.authenticator.AuthenticatorBase,invoke,541
>>> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
>>> org.apache.catalina.core.StandardHostValve,invoke,135
>>> org.apache.catalina.valves.ErrorReportValve,invoke,92
>>> org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
>>> org.apache.catalina.core.StandardEngineValve,invoke,78
>>> org.apache.catalina.connector.CoyoteAdapter,service,360
>>> org.apache.coyote.http11.Http11Processor,service,399
>>> org.apache.coyote.AbstractProcessorLight,process,65
>>> org.apache.coyote.AbstractProtocol$ConnectionHandler,process,893
>>> org.apache.tomcat.util.net.NioEndpoint$SocketProcessor,doRun,1789
>>> org.apache.tomcat.util.net.SocketProcessorBase,run,49
>>> org.apache.tomcat.util.threads.ThreadPoolExecutor,runWorker,1191
>>> org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker,run,659
>>> org.apache.tomcat.util.threads.TaskThread$WrappingRunnable,run,61
>>> java.lang.Thread,run,750
>> I have built a standalone client that makes the same connection and it
>> succeeds on the same server calling the same JVM
>>
>> /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.352.b08-2.el8_6.x86_64/jre/bin/java
>>
>> I tried to extend ssl logging in tomcat adding -Djavax.net.debug=ssl to see
>> any root cause but to no avail
>>
>> Here is how the tomcat service is configured
>>
>>> [Service]
>>> Type=forking
>>>
>>> User=tomcat
>>> Group=tomcat
>>>
>>> Environment="JAVA_HOME=/usr/lib/jvm/jre"
>>> Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom
>>> -Djavax.net.debug=ssl"
>>> Environment="CATALINA_BASE=/opt/tomcat"
>>> Environment="CATALINA_HOME=/opt/tomcat"
>>> Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"
>>> Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -
>> XX:+UseParallelGC"
>>> ExecStart=/opt/tomcat/bin/startup.sh
>>> ExecStop=/opt/tomcat/bin/shutdown.sh
>>>
>>> [Install]
>>> WantedBy=multi-user.target
>> Someone out there can give me any help?
>>
>> --
>>
>> Archimede Informatica tratta i dati personali in conformità a quanto stabilito
>> dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno
>> 2003 n. 196
>> per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
>> Informativa completa
>> <http://www.archicoop.it/fileadmin/pdf/InformativaTrattamentoDatiPerson
>> ali.pdf>
>>
>> dott. Ivano Mario Luberti
>>
>> Archimede Informatica società cooperativa a r. l.
>> Via Gereschi 36, 56127 Pisa
>>
>> tel.: +39 050/580959 | fax: +39 050/8932061
>>
>> web:www.archicoop.it
>> linkedin:www.linkedin.com/in/ivanoluberti
>> facebook:www.facebook.com/archimedeinformaticapisa/
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail:users-help@tomcat.apache.org
>
--
Archimede Informatica tratta i dati personali in conformità a quanto
stabilito dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno
2003 n. 196
per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
Informativa completa
<http://www.archicoop.it/fileadmin/pdf/InformativaTrattamentoDatiPersonali.pdf>
dott. Ivano Mario Luberti
Archimede Informatica società cooperativa a r. l.
Via Gereschi 36, 56127 Pisa
tel.: +39 050/580959 | fax: +39 050/8932061
web: www.archicoop.it
linkedin: www.linkedin.com/in/ivanoluberti
facebook: www.facebook.com/archimedeinformaticapisa/
AW: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by "Thomas Hoffmann (Speed4Trade GmbH)" <Th...@speed4trade.com.INVALID>.
Hello Ivano,
> -----Ursprüngliche Nachricht-----
> Von: Ivano Luberti <lu...@archicoop.it.INVALID>
> Gesendet: Donnerstag, 8. Juni 2023 12:10
> An: users@tomcat.apache.org
> Betreff: problem with SSL connection
> java.security.NoSuchAlgorithmException: Error constructing implementation
>
> Hi, all I have the following problem.
>
> My web application executes an SSL connection but fails with the following
> exception
>
> > AxisFault: java.security.NoSuchAlgorithmException: Error constructing
> > implementation (algorithm: Default, provider: SunJSSE, class:
> > sun.security.ssl.SSLContextImpl$DefaultSSLContext)
> > org.apache.axis2.AxisFault,makeFault,430
> > org.apache.axis2.transport.http.HTTPSender,sendViaPost,197
> > org.apache.axis2.transport.http.HTTPSender,send,75
> >
> org.apache.axis2.transport.http.CommonsHTTPTransportSender,writeMessa
> g
> > eWithCommons,404
> >
Here it is visible, that the Axis Client can't connect to the server.
It has nothing to do with Tomcat in my opinion.
The crypt algorithms are provided by the JDK (or separate libraries).
Your program acts as a client, connecting to a server. Therefore Tomcat is not involved in this case.
If the endpoint of the service is public available, you can do a scan with e.g. https://www.ssllabs.com/ssltest/ to inspect the offered ciphers.
Also check, if the certificates are available and that the server is configured with the intermediates.
> org.apache.axis2.transport.http.CommonsHTTPTransportSender,invoke,231
> > org.apache.axis2.engine.AxisEngine,send,443
> > org.apache.axis2.description.OutInAxisOperationClient,send,406
> > org.apache.axis2.description.OutInAxisOperationClient,executeImpl,229
> > org.apache.axis2.client.OperationClient,execute,165
> > it.sella.ecomm.WSCryptDecryptStub,encrypt,197
> > it.archicoop.met.sistemapagamento.bancasella.wscryptdecryptclient.WSCl
> > ient,encrypt,61
> > it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,75
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaConCartaDiCre
> > dito,328
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,paga,112
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaHiddenIframe,
> > 452
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,doGet,585
> > javax.servlet.http.HttpServlet,service,670
> > javax.servlet.http.HttpServlet,service,779
> > org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,227
> > org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> > org.apache.tomcat.websocket.server.WsFilter,doFilter,53
> > org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,189
> > org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> > org.apache.catalina.core.StandardWrapperValve,invoke,197
> > org.apache.catalina.core.StandardContextValve,invoke,97
> > org.apache.catalina.authenticator.AuthenticatorBase,invoke,541
> > org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> > org.apache.catalina.core.StandardHostValve,invoke,135
> > org.apache.catalina.valves.ErrorReportValve,invoke,92
> > org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> > org.apache.catalina.core.StandardEngineValve,invoke,78
> > org.apache.catalina.connector.CoyoteAdapter,service,360
> > org.apache.coyote.http11.Http11Processor,service,399
> > org.apache.coyote.AbstractProcessorLight,process,65
> > org.apache.coyote.AbstractProtocol$ConnectionHandler,process,893
> > org.apache.tomcat.util.net.NioEndpoint$SocketProcessor,doRun,1789
> > org.apache.tomcat.util.net.SocketProcessorBase,run,49
> > org.apache.tomcat.util.threads.ThreadPoolExecutor,runWorker,1191
> > org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker,run,659
> > org.apache.tomcat.util.threads.TaskThread$WrappingRunnable,run,61
> > java.lang.Thread,run,750
> > it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,109
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaConCartaDiCre
> > dito,328
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,paga,112
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,pagaHiddenIframe,
> > 452
> > it.archimede.met.turisti.servlet.NuovoOrdineAcquista,doGet,585
> > javax.servlet.http.HttpServlet,service,670
> > javax.servlet.http.HttpServlet,service,779
> > org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,227
> > org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> > org.apache.tomcat.websocket.server.WsFilter,doFilter,53
> > org.apache.catalina.core.ApplicationFilterChain,internalDoFilter,189
> > org.apache.catalina.core.ApplicationFilterChain,doFilter,162
> > org.apache.catalina.core.StandardWrapperValve,invoke,197
> > org.apache.catalina.core.StandardContextValve,invoke,97
> > org.apache.catalina.authenticator.AuthenticatorBase,invoke,541
> > org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> > org.apache.catalina.core.StandardHostValve,invoke,135
> > org.apache.catalina.valves.ErrorReportValve,invoke,92
> > org.apache.catalina.valves.AbstractAccessLogValve,invoke,687
> > org.apache.catalina.core.StandardEngineValve,invoke,78
> > org.apache.catalina.connector.CoyoteAdapter,service,360
> > org.apache.coyote.http11.Http11Processor,service,399
> > org.apache.coyote.AbstractProcessorLight,process,65
> > org.apache.coyote.AbstractProtocol$ConnectionHandler,process,893
> > org.apache.tomcat.util.net.NioEndpoint$SocketProcessor,doRun,1789
> > org.apache.tomcat.util.net.SocketProcessorBase,run,49
> > org.apache.tomcat.util.threads.ThreadPoolExecutor,runWorker,1191
> > org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker,run,659
> > org.apache.tomcat.util.threads.TaskThread$WrappingRunnable,run,61
> > java.lang.Thread,run,750
>
> I have built a standalone client that makes the same connection and it
> succeeds on the same server calling the same JVM
>
> /usr/lib/jvm/java-1.8.0-openjdk-1.8.0.352.b08-2.el8_6.x86_64/jre/bin/java
>
> I tried to extend ssl logging in tomcat adding -Djavax.net.debug=ssl to see
> any root cause but to no avail
>
> Here is how the tomcat service is configured
>
> > [Service]
> > Type=forking
> >
> > User=tomcat
> > Group=tomcat
> >
> > Environment="JAVA_HOME=/usr/lib/jvm/jre"
> > Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom
> > -Djavax.net.debug=ssl"
> > Environment="CATALINA_BASE=/opt/tomcat"
> > Environment="CATALINA_HOME=/opt/tomcat"
> > Environment="CATALINA_PID=/opt/tomcat/temp/tomcat.pid"
> > Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -
> XX:+UseParallelGC"
> >
> > ExecStart=/opt/tomcat/bin/startup.sh
> > ExecStop=/opt/tomcat/bin/shutdown.sh
> >
> > [Install]
> > WantedBy=multi-user.target
>
> Someone out there can give me any help?
>
> --
>
> Archimede Informatica tratta i dati personali in conformità a quanto stabilito
> dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno
> 2003 n. 196
> per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
> Informativa completa
> <http://www.archicoop.it/fileadmin/pdf/InformativaTrattamentoDatiPerson
> ali.pdf>
>
> dott. Ivano Mario Luberti
>
> Archimede Informatica società cooperativa a r. l.
> Via Gereschi 36, 56127 Pisa
>
> tel.: +39 050/580959 | fax: +39 050/8932061
>
> web: www.archicoop.it
> linkedin: www.linkedin.com/in/ivanoluberti
> facebook: www.facebook.com/archimedeinformaticapisa/
Re: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by Ivano Luberti <lu...@archicoop.it.INVALID>.
Hi all.
Finally found out the issue.
And had nothing to do with tomcat.
There are two web applications under this particular instance of tomcat
Both of them contain an http client that issues https connections.
Application A sets explicitly the certificate store type to PKCS
Application B does not, so is expecting JKS.
The JDK instance has a JKS certificate store.
Launching application A causes an exception when it tries to connect via
HTTPS
Application B then fails because finds in SystemProperty that the
certificate store is PKCS but actually it is JKS.
I'm writing this to underline that as predictable it was not a problem
with tomcat
Thanks to everyone spent time into this, especially Chris
Il 27/06/2023 16:35, Christopher Schultz ha scritto:
> Ivano,
>
> On 6/27/23 09:15, Ivano Luberti wrote:
>> We had another Linux server that should have been identical to the
>> one where the problem was occuring. Tested the same software on that
>> without the issue.
>>
>> So we cloned the latter and replaced the former.
> >
>> Now everything works as expected.
>
> Hah.
>
>> Before the replacement we tried to find out any difference between
>> the two servers, especially with regard to JDK and Tomcat
>> installations but to no avail: they looked identical file by file,
>> not only by version. I had supposed the cacert file was corrupted but
>> it was identical to the one on the working machine.
>>
>> Having found a practical solution we have decided to give up
>> investigating.
>>
>> Thank you again to you and the other that paid attention to my issue.
>
> Of course.
>
> Someone recently posted a similar issue that has no explanation which
> magically went-away after (essentially) re-building the server. There
> was nothing specific that could be pointed-to as a likely source of
> the problem, but now it's just /gone/.
>
> It's not entirely satisfying from a "what if it happens again"
> perspective, but "you can't argue with results."
>
> -chris
>
>> Il 26/06/2023 18:50, Christopher Schultz ha scritto:
>>> Ivano,
>>>
>>> On 6/8/23 06:10, Ivano Luberti wrote:
>>>> Hi, all I have the following problem.
>>>
>>> [snip]
>>>
>>> My guess is that looking at the code in this general area would be
>>> helpful. If you are able to add debug logging in there to spoit-out
>>> some of the crypto configuration being used, I'm sure it would help:
>>>
>>>>> it.sella.ecomm.WSCryptDecryptStub,encrypt,197
>>>>> it.archicoop.met.sistemapagamento.bancasella.wscryptdecryptclient.WSClient,encrypt,61
>>>>>
>>>>> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,75
>>>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
>>>
>>> Sorry, I don't think anybody here will be able to help much further
>>> without a lot more information.
>>>
>>> -chris
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>>> For additional commands, e-mail: users-help@tomcat.apache.org
>>>
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
--
Archimede Informatica tratta i dati personali in conformità a quanto
stabilito dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno
2003 n. 196
per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
Informativa completa
<http://www.archicoop.it/fileadmin/pdf/InformativaTrattamentoDatiPersonali.pdf>
dott. Ivano Mario Luberti
Archimede Informatica società cooperativa a r. l.
Via Gereschi 36, 56127 Pisa
tel.: +39 050/580959 | fax: +39 050/8932061
web: www.archicoop.it
linkedin: www.linkedin.com/in/ivanoluberti
facebook: www.facebook.com/archimedeinformaticapisa/
Re: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Ivano,
On 6/27/23 09:15, Ivano Luberti wrote:
> We had another Linux server that should have been identical to the one
> where the problem was occuring. Tested the same software on that without
> the issue.
>
> So we cloned the latter and replaced the former.
>
> Now everything works as expected.
Hah.
> Before the replacement we tried to find out any difference between the
> two servers, especially with regard to JDK and Tomcat installations but
> to no avail: they looked identical file by file, not only by version. I
> had supposed the cacert file was corrupted but it was identical to the
> one on the working machine.
>
> Having found a practical solution we have decided to give up investigating.
>
> Thank you again to you and the other that paid attention to my issue.
Of course.
Someone recently posted a similar issue that has no explanation which
magically went-away after (essentially) re-building the server. There
was nothing specific that could be pointed-to as a likely source of the
problem, but now it's just /gone/.
It's not entirely satisfying from a "what if it happens again"
perspective, but "you can't argue with results."
-chris
> Il 26/06/2023 18:50, Christopher Schultz ha scritto:
>> Ivano,
>>
>> On 6/8/23 06:10, Ivano Luberti wrote:
>>> Hi, all I have the following problem.
>>
>> [snip]
>>
>> My guess is that looking at the code in this general area would be
>> helpful. If you are able to add debug logging in there to spoit-out
>> some of the crypto configuration being used, I'm sure it would help:
>>
>>>> it.sella.ecomm.WSCryptDecryptStub,encrypt,197
>>>> it.archicoop.met.sistemapagamento.bancasella.wscryptdecryptclient.WSClient,encrypt,61
>>>> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,75
>>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
>>
>> Sorry, I don't think anybody here will be able to help much further
>> without a lot more information.
>>
>> -chris
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
>> For additional commands, e-mail: users-help@tomcat.apache.org
>>
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by Ivano Luberti <lu...@archicoop.it.INVALID>.
Hi Chris, thank you for your dedication.
We had another Linux server that should have been identical to the one
where the problem was occuring. Tested the same software on that without
the issue.
So we cloned the latter and replaced the former.
Now everything works as expected.
Before the replacement we tried to find out any difference between the
two servers, especially with regard to JDK and Tomcat installations but
to no avail: they looked identical file by file, not only by version. I
had supposed the cacert file was corrupted but it was identical to the
one on the working machine.
Having found a practical solution we have decided to give up investigating.
Thank you again to you and the other that paid attention to my issue.
Il 26/06/2023 18:50, Christopher Schultz ha scritto:
> Ivano,
>
> On 6/8/23 06:10, Ivano Luberti wrote:
>> Hi, all I have the following problem.
>
> [snip]
>
> My guess is that looking at the code in this general area would be
> helpful. If you are able to add debug logging in there to spoit-out
> some of the crypto configuration being used, I'm sure it would help:
>
>>> it.sella.ecomm.WSCryptDecryptStub,encrypt,197
>>> it.archicoop.met.sistemapagamento.bancasella.wscryptdecryptclient.WSClient,encrypt,61
>>>
>>> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,75
>>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
>
> Sorry, I don't think anybody here will be able to help much further
> without a lot more information.
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
--
Archimede Informatica tratta i dati personali in conformità a quanto
stabilito dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno
2003 n. 196
per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
Informativa completa
<http://www.archicoop.it/fileadmin/pdf/InformativaTrattamentoDatiPersonali.pdf>
dott. Ivano Mario Luberti
Archimede Informatica società cooperativa a r. l.
Via Gereschi 36, 56127 Pisa
tel.: +39 050/580959 | fax: +39 050/8932061
web: www.archicoop.it
linkedin: www.linkedin.com/in/ivanoluberti
facebook: www.facebook.com/archimedeinformaticapisa/
Re: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Ivano,
On 6/8/23 06:10, Ivano Luberti wrote:
> Hi, all I have the following problem.
[snip]
My guess is that looking at the code in this general area would be
helpful. If you are able to add debug logging in there to spoit-out some
of the crypto configuration being used, I'm sure it would help:
>> it.sella.ecomm.WSCryptDecryptStub,encrypt,197
>> it.archicoop.met.sistemapagamento.bancasella.wscryptdecryptclient.WSClient,encrypt,61
>> it.archimede.met.backoffice.pagamento.GestionePagamento,encrypt,75
>> it.archimede.met.turisti.servlet.NuovoOrdineAcquista,encrypt,379
Sorry, I don't think anybody here will be able to help much further
without a lot more information.
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org
Re: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by Ivano Luberti <lu...@archicoop.it.INVALID>.
Hi Chris, thanks for that.
No, don't make nay configuration regarding use of any algorithm.
I launch Java with same options in tomcat and in the stand alone client
and I get two different behaviours
Il 23/06/2023 21:51, Christopher Schultz ha scritto:
> Ivano,
>
> On 6/8/23 06:10, Ivano Luberti wrote:
>> My web application executes an SSL connection but fails with the
>> following exception
>>
>>> AxisFault: java.security.NoSuchAlgorithmException: Error
>>> constructing implementation (algorithm: Default, provider: SunJSSE,
>>> class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
>
> That "algorithm: Default" looks suspicious. Do you have the word
> "Default" in any configuration / code that maybe should be either null
> or unspecified, to get the /actual/ default?
>
> -chris
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
> For additional commands, e-mail: users-help@tomcat.apache.org
>
--
Archimede Informatica tratta i dati personali in conformità a quanto
stabilito dal Regolamento UE n. 2016/679 (GDPR) e dal D. Lgs. 30 giugno
2003 n. 196
per come modificato dal D.Lgs. 10 agosto 2018 n. 101.
Informativa completa
<http://www.archicoop.it/fileadmin/pdf/InformativaTrattamentoDatiPersonali.pdf>
dott. Ivano Mario Luberti
Archimede Informatica società cooperativa a r. l.
Via Gereschi 36, 56127 Pisa
tel.: +39 050/580959 | fax: +39 050/8932061
web: www.archicoop.it
linkedin: www.linkedin.com/in/ivanoluberti
facebook: www.facebook.com/archimedeinformaticapisa/
Re: problem with SSL connection java.security.NoSuchAlgorithmException: Error constructing implementation
Posted by Christopher Schultz <ch...@christopherschultz.net>.
Ivano,
On 6/8/23 06:10, Ivano Luberti wrote:
> My web application executes an SSL connection but fails with the
> following exception
>
>> AxisFault: java.security.NoSuchAlgorithmException: Error constructing
>> implementation (algorithm: Default, provider: SunJSSE, class:
>> sun.security.ssl.SSLContextImpl$DefaultSSLContext)
That "algorithm: Default" looks suspicious. Do you have the word
"Default" in any configuration / code that maybe should be either null
or unspecified, to get the /actual/ default?
-chris
---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@tomcat.apache.org
For additional commands, e-mail: users-help@tomcat.apache.org