2 way SSL using ephemeral keystores in java

Question

I have a self written java server that may have multiple keys (1 key used for connection and another key for rollover in case the first one expired) in its keystore so I tried reading the keystore and then constructing an ephemeral keystore with only one key to pass to the SSLContext when I need to start the server. However, it doesn't seem to work:

On the client side I get:

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
sun.security.ssl.SSLSocketImpl.handleException(Unknown Source)
sun.security.ssl.AppOutputStream.write(Unknown Source)
java.io.BufferedOutputStream.flushBuffer(Unknown Source)
java.io.BufferedOutputStream.flush(Unknown Source)
com.netrust.protocol.ProtocolClient.initialize(ProtocolClient.java:41)
com.netrust.clientregistrar.gui.Client.connect(Client.java:501)
com.netrust.clientregistrar.gui.Client.sendGetDirectoryChangeLog(Client.java:108)
com.netrust.clientregistrar.gui.ServerTreeModel.refresh(ServerTreeModel.java:195)
com.netrust.clientregistrar.gui.ServerTreeModel.refresh(ServerTreeModel.java:333)
com.netrust.clientregistrar.gui.ServerTreePanel.refresh(ServerTreePanel.java:189)
com.netrust.clientregistrar.gui.ClientRegistrarPanel.<init>(ClientRegistrarPanel.java:195)
com.netrust.clientregistrar.gui.Main.runApplication(Main.java:150)
com.netrust.clientregistrar.gui.Main.access$300(Main.java:26)
com.netrust.clientregistrar.gui.Main$1.run(Main.java:64)
java.awt.event.InvocationEvent.dispatch(Unknown Source)
java.awt.EventQueue.dispatchEventImpl(Unknown Source)
java.awt.EventQueue.access$000(Unknown Source)
java.awt.EventQueue$3.run(Unknown Source)
java.awt.EventQueue$3.run(Unknown Source)
java.security.AccessController.doPrivileged(Native Method)
java.security.ProtectionDomain$1.doIntersectionPrivilege(Unknown Source)
java.awt.EventQueue.dispatchEvent(Unknown Source)
java.awt.EventDispatchThread.pumpOneEventForFilters(Unknown Source)
java.awt.EventDispatchThread.pumpEventsForFilter(Unknown Source)
java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown Source)
java.awt.EventDispatchThread.pumpEvents(Unknown Source)
java.awt.EventDispatchThread.pumpEvents(Unknown Source)
java.awt.EventDispatchThread.run(Unknown Source)

On the server side I get:

javax.net.ssl.SSLException: Received fatal alert: internal_error
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.Alerts.getSSLException(Unknown Source)
sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
com.netrust.server.ManagementSecureConnectionHandler.run(ManagementSecureConnectionHandler.java:96)
com.netrust.util.DynamicThreadPool$WorkerThread.run(DynamicThreadPool.java:295)

Relevant Code:

// marhalAsJKS()
Enumeration< String > aliases = keyStore.aliases();
String alias = null;
java.security.KeyStore jks = java.security.KeyStore.getInstance( java.security.KeyStore.getDefaultType() );
jks.load( null, oldPassword );
while ( aliases.hasMoreElements() )
{
    alias = aliases.nextElement();
    if ( keyStore.isKeyEntry( alias ) )
    {
        jks.setKeyEntry( alias,
                 keyStore.getKey( alias, oldPassword ),
                 oldPassword,
                 keyStore.getCertificateChain( alias ) );
    }
    else if ( keyStore.isCertificateEntry( alias ) )
    {
        jks.setCertificateEntry( alias, keyStore.getCertificate( alias ) );
    }
}
// Constructing ephemeral keystore and truststore
ephemeralKeyStore = managementKeyStore.marshalAsJKS();
ephemeralKeyStore.deleteEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS );
ephemeralTrustStore = managementKeyStore.marshalAsJKS();
ephemeralTrustStore.deleteEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS );
if ( generalConfiguration.isRootServerType() && managementKeyStore.isKeyEntry( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS ) )
    ephemeralTrustStore.setCertificateEntry( PathRegistry.ROOT_CERTIFICATE_ROLLOVER_ENTRY_ALIAS,
                                     managementKeyStore.getCertificate( PathRegistry.SERVER_KEY_ROLLOVER_ENTRY_ALIAS ) );

// Initializing SSL
sslContext = SSLContext.getInstance( "TLS" );
keyManagerFactory.init( getKeyStore(), getKeyStorePassword() );
trustManagerFactory.init( getTrustStore() );
sslContext.init( keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null );
serverSocket = ( SSLServerSocket ) sslContext.getServerSocketFactory().createServerSocket( getPort() );

Similar Question but with 1 way SSL: How can I have multiple SSL certificates for a Java server

You're doing this the wrong way. You should install a custom KeyManager instead of all this ephemeral keystore malarkey. But writing code to solve a deployment problem is a strange approach in the first place. — user207421, Aug 08 '12 at 23:08

score 2 · Accepted Answer · answered Aug 08 '12 at 14:31

javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

This almost certainly comes from a trust manager in your client code that you've initialised with an empty trust store.

2 way SSL using ephemeral keystores in java

1 Answers1