86

When you google for this exception: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty, multiple results appear. However there is no definitive solution, only guesses.

The problem arises (in my case at least) when I try to use open a connection over SSL. It works fine on my windows machine, but when I deploy it to the linux machine (with sun's jre installed) it fails with the above exception.

The problem is that the default truststore of the JRE is empty for some reason (size of only 32 bytes, whereas it is 80kb on windows).

When I copied my jre/lib/security/cacerts file from windows to linux, it worked fine.

The question is - why is the linux jre having an empty trust store?

Note that this happens on an Amazon EC2 instance, with the AMI linux, so it might be due to some amazon policies (I think java was pre-installed, but I'm not sure)

Bozho
  • 588,226
  • 146
  • 1,060
  • 1,140
  • For those users who run `bazel` and come across this error message, just remember to set your $JAVA_HOME to the correct location. – Rock Apr 05 '19 at 00:14

13 Answers13

107

I got this error in Ubuntu. I saw that /usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/cacerts was a broken link to /etc/ssl/certs/java/cacerts. That lead me to this bug: https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/983302 The README for ca-certificates-java eventually showed the actual fix:

run

update-ca-certificates -f

apt-get install ca-certificates-java didn't work for me. It just marked it as manually installed.

user988346
  • 1,799
  • 3
  • 16
  • 15
28

The standard Sun JDK for linux has an absolutely ok cacerts and overall all files in the specified directory. The problem is the installation you use.

bestsss
  • 11,796
  • 3
  • 53
  • 63
  • good to confirm. Perhaps it was the JRE bundled with the amazon instance – Bozho Jan 23 '11 at 15:00
  • yeah, you have to ask the provider – bestsss Jan 23 '11 at 15:03
  • 3
    I am currently having the same problem here. I used openjdk 7, which by default creates a symlink to `/etc/ssl/certs/java/cacerts`, which is empty on ubuntu AMIs on Amazon EC2. Currently trying with sun jdk. – Cookie Dec 13 '11 at 12:48
  • 1
    Btw, I tried fixing above by copying my windows cacerts into said location, but that didn't help me. – Cookie Dec 13 '11 at 12:49
  • 1
    And I confirm that it works with sun's jdk. On Ubuntu, use `sudo update-alternatives --config java` to switch after installing sun jdk. – Cookie Dec 13 '11 at 12:52
15

I have avoided this error (Java 1.6.0 on OSX 10.5.8) by putting a dummy cert in the keystore, such as

keytool -genkey -alias foo -keystore cacerts -dname cn=test -storepass changeit -keypass changeit

Surely the question should be "Why can't java handle an empty trustStore?"

Andrew
  • 167
  • 1
  • 2
  • I fully agree on your last statement. Especially since Java 6 reports "java.lang.RuntimeException: Unexpected error: [..] the trustAnchors parameter must be non-empty". An empty truststore should not be something that one might expect, i.e. trust no one. – wh81752 Aug 08 '12 at 12:38
  • Thanks - this also happened when I cleared the keystore for internal testing and started getting this error. The resolution was indeed to add a dummy key. – Tor Aug 18 '14 at 17:05
  • OSX - dummy key didn't help. – sophros Apr 23 '20 at 06:52
12

I can generate this error by setting system property trustStore to a missing jks file. For example

    System.setProperty("javax.net.ssl.keyStore", "C:/keystoreFile.jks");
    System.setProperty("javax.net.ssl.keyStorePassword", "mypassword");
    System.setProperty("javax.net.ssl.trustStore", "C:/missing-keystore.jks");
    System.setProperty("javax.net.ssl.trustStorePassword", "mypassword");

This code does not generate a FileNotFound exception for some reason, but exactly the InvalidAlgorithmParameter exception listed above.

Kind of a dumb answer, but I can reproduce.

The Camster
  • 1,850
  • 1
  • 20
  • 27
  • That helped us to fix the problem. We were struggling with "trustAnchors parameter must be non-empty" when it was just a simple "file not found". – Luciano Oct 26 '17 at 13:26
  • In my case, the paths were ok-ish ,,, but forgot to add .jks extension to the file name ... cheers – cristi _b Mar 13 '19 at 11:54
  • Thanks for posting this! Forgot to define the password... – mmo Feb 09 '21 at 19:47
11

Had the same issue on Ubuntu 14.10 with java-8-oracle installed.

Solved installing ca-certificates-java package: 

sudo apt-get install ca-certificates-java
Justinas Jakavonis
  • 8,220
  • 10
  • 69
  • 114
Daniele Dellafiore
  • 1,867
  • 1
  • 15
  • 19
9

Not the answer to the original question but when trying to resolve a similar issue, I found that the Mac OS X update to Maverics screwed up the java install (the cacert actually). Remove sudo rm -rf /Library/Java/JavaVirtualMachines/*.jdk and reinstall from http://www.oracle.com/technetwork/java/javase/downloads/index.html

Manuel Darveau
  • 4,585
  • 5
  • 26
  • 36
  • 1
    yes, same here. I think that was because of the upgrade – ambodi Feb 21 '14 at 15:29
  • 1
    After the Mavericks upgrade I got "java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty" when Java code attempted to make an SSL connection. Reinstalling Java 6 fixed it for me. – Dan Collins Apr 10 '14 at 08:01
8

My solution on Windows was to either run console window as Administrator or change the environment variable MAVEN_OPTS to use a hardcoded path to trust.jks (e.g. 'C:\Users\oddros') instead of '%USERPROFILE%'. My MAVEN_OPTS now looks like this:

-Djavax.net.ssl.trustStore=C:\Users\oddros\trust.jks -Djavax.net.ssl.trustStorePassword=changeit
Aaron Digulla
  • 321,842
  • 108
  • 597
  • 820
superodde
  • 131
  • 1
  • 3
  • this was an invaluable hint. This worked for me, as well. However, it is fairly odd that the file works with absolute reference and not with relative reference, even though it was abviously found with a relative reference. I even doubled-checked the relative path was valid by renaming the file an error would occure saying the file could not be found. – omilke Jul 15 '13 at 11:48
  • This worked for me as well. I was modifying the run configurations in IntelliJ Idea. Thanks. – maheeka Nov 07 '16 at 18:43
  • Noob question. Where do you get `.jks` from? – Ganesh Satpute Jun 13 '20 at 15:10
  • The .jks is generated using the keytool-command in openssl. See the section 'Creating a KeyStore in JKS Format' here: https://docs.oracle.com/cd/E19509-01/820-3503/6nf1il6er/index.html – superodde Jul 07 '20 at 08:39
  • Thanks, that helped me solve my problem. In "[...]/apache-tomcat/bin/setenv.sh", I set the two options like you suggested: JAVA_OPTS="${JAVA_OPTS} -Djavax.net.ssl.trustStore=[...]/jdk/lib/security/cacerts -Djavax.net.ssl.trustStorePassword=" – Léa Massiot Mar 16 '22 at 14:10
7

My cacerts file was totally empty. I solved this by copying the cacerts file off my windows machine (that's using Oracle Java 7) and scp'd it to my Linux box (OpenJDK). 

cd %JAVA_HOME%/jre/lib/security/
scp cacerts mylinuxmachin:/tmp

and then on the linux machine

cp /tmp/cacerts /etc/ssl/certs/java/cacerts

It's worked great so far.

Ryan Shillington
  • 23,006
  • 14
  • 93
  • 108
  • FWIW this worked for me for OpenJDK 8 on Ubuntu 15.04. I pulled the cacerts file from my Windows 7 laptop in path "C:\Program Files (x86)\Java\jre1.8.0_31\lib\security" as suggested. – John T May 24 '15 at 09:54
2

If this happens to you with an OpenJDK install on Mac OS X (as opposed to Linux), and you do have the official Mac OS X Java (i.e. latest Java 6) installed through Software Update, you can just do this:

cd $OPENJDK_HOME/Contents/Home/jre/lib/security
ln -s /System/Library/Java/Support/CoreDeploy.bundle/Contents/Home/lib/security/cacerts
ln -s /System/Library/Java/Support/Deploy.bundle/Contents/Home/lib/security/blacklist 
ln -s /System/Library/Java/Support/Deploy.bundle/Contents/Home/lib/security/trusted.libraries

where $OPENJDK_HOME is the root directory of your OpenJDK install, typically OPENJDK_HOME=/Library/Java/JavaVirtualMachines/1.7.0u.jdk. This is identical to how official Java installs on Mac OS X acquire these files - they also just symlink them from those system bundles. Works for Lion, not sure for earlier versions of the OS.

Attila Szegedi
  • 4,405
  • 26
  • 24
2

Make sure that you have valid cacerts in the JRE/security, otherwise you will not bypass the invalid empty trustAnchors error.

In my Amazon EC2 Opensuse12 installation, the problem was that the file pointed by the cacerts in the JRE security directory was invalid:

$ java -version
java version "1.7.0_09"
OpenJDK Runtime Environment (IcedTea7 2.3.4) (suse-3.20.1-x86_64)
OpenJDK 64-Bit Server VM (build 23.2-b09, mixed mode)

$ ls -l /var/lib/ca-certificates/
-rw-r--r-- 1 root    363 Feb 28 14:17 ca-bundle.pem

$ ls -l /usr/lib64/jvm/jre/lib/security/
lrwxrwxrwx 1 root    37 Mar 21 00:16 cacerts -> /var/lib/ca-certificates/java-cacerts
-rw-r--r-- 1 root  2254 Jan 18 16:50 java.policy
-rw-r--r-- 1 root 15374 Jan 18 16:50 java.security
-rw-r--r-- 1 root    88 Jan 18 17:34 nss.cfg

So I solved installing an old Opensuse 11 valid certificates. (sorry about that!!)

$ ll
total 616
-rw-r--r-- 1 root 220065 Jan 31 15:48 ca-bundle.pem
-rw-r--r-- 1 root    363 Feb 28 14:17 ca-bundle.pem.old
-rw-r--r-- 1 root 161555 Jan 31 15:48 java-cacerts

I understood that you could use the keytool to generate a new one (http://mail.openjdk.java.net/pipermail/distro-pkg-dev/2010-April/008961.html). I'll probably have to that soon.

regards lellis

Paulo Henrique Lellis Gonalves
  • 1,074
  • 8
  • 4
0

Have the same issue. Resolved it by installing ca-certificate bundle from Mozilla:

$ zypper in ca-certificates-mozilla
The following NEW package is going to be installed:
ca-certificates-mozilla 

1 new package to install.
Retrieving package ca-certificates-mozilla-1.85-8.8.1.noarch
(1/1), 143.7 KiB (239.1 KiB unpacked)
Retrieving: ca-certificates-mozilla-1.85-8.8.1.noarch.rpm.....................[done]
Installing: ca-certificates-mozilla-1.85-8.8.1 ...............................[done]
Additional rpm output:
Updating certificates in /etc/ssl/certs...
144 added, 0 removed.
creating /var/lib/ca-certificates/ca-bundle.pem ...
creating /var/lib/ca-certificates/java-cacerts ...
144 added, 0 removed.

$ ll /var/lib/ca-certificates/
total 392
drwxr-xr-x  2 root root   4096 Apr 26 07:25 ./
drwxr-xr-x 30 root root   4096 Apr 25 15:00 ../
-rw-r--r--  1 root root 220196 Apr 26 07:25 ca-bundle.pem
-rw-r--r--  1 root root 161555 Apr 26 07:25 java-cacerts

P.S.

$ cat /etc/SuSE-release
openSUSE 12.2 (x86_64)
VERSION = 12.2
CODENAME = Mantis
$ java -version
java version "1.7.0_09"
OpenJDK Runtime Environment (IcedTea7 2.3.4) (suse-3.20.1-x86_64)
OpenJDK 64-Bit Server VM (build 23.2-b09, mixed mode)
user2322889
  • 1
0

This happens because Access Privilege varies from OS to OS. Windows access hierarchy is different from Unix. However, this could be overcome by following these simple steps:

  1. Increase accessibility with AccessController.doPrivileged(java.security.PrivilegedAction subclass)
  2. Set your own java.security.Provider subclass as security property. a. Security.insertProviderAt(new , 2);
  3. Set your Algorythm with Security.setProperty("ssl.TrustManagerFactory.algorithm" , “XTrust509”);
user987339
  • 10,519
  • 8
  • 40
  • 45
Pijush
  • 417
  • 5
  • 3
0

I get this same error on my Windows 7 machine when the permissions on my cacerts file in my C:\Program Files\Java\jdk1.7.0_51\jre\lib\security folder are not set correctly.

To resolve the issue, I allow the SERVICE and INTERACTIVE users to have all modify permissions on cacerts except "change permissions" and "take ownership" (from Advanced Settings, in the Security properties). I assume that allowing these services to both read and write extended attributes may have something to do with the error going away.

Fuzzy Analysis
  • 3,168
  • 2
  • 42
  • 66