NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory not available];

Question

I am using elastic search 5.6.15 with SSL configured. I got the cluster up and running and from my client server i am able to check the elastic cluster health with curl.

Elastic search documentation https://www.elastic.co/guide/en/x-pack/5.6/java-clients.html

code tried

Settings settings = Settings.builder()
    .put("cluster.name", clusterName)
    .put("xpack.security.user", userNamePassword) // Adding Username and Password in XPack Settings for ES.
    .put("xpack.security.transport.ssl.enabled", "true")
    .put("xpack.ssl.key", configFolderPath + "/ssl/client.key")
    .put("xpack.ssl.certificate", configFolderPath + "/ssl/mycrtfile.crt")
    .put("xpack.security.transport.ssl.certificate_authorities", configFolderPath + "/sam/ssl/mychainbundle.crt")

However, when i try to call the elastic search cluster with the above code it gives me the following exception:

ElasticsearchException[Failed to load plugin class [org.elasticsearch.xpack.XPackPlugin]]; nested: InvocationTargetException; 
nested: ElasticsearchException[failed to initialize a KeyManagerFactory]; nested: 
PEMException[unable to convert key pair: 1.2.840.113549.1.1.1 KeyFactory not available]; nested: 
NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory not available];
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:384)
    at org.elasticsearch.plugins.PluginsService.<init>(PluginsService.java:104)
    at org.elasticsearch.client.transport.TransportClient.newPluginService(TransportClient.java:94)
    at org.elasticsearch.client.transport.TransportClient.buildTemplate(TransportClient.java:119)
    at org.elasticsearch.client.transport.TransportClient.<init>(TransportClient.java:247)
    at org.elasticsearch.transport.client.PreBuiltTransportClient.<init>(PreBuiltTransportClient.java:125)
    at org.elasticsearch.xpack.client.PreBuiltXPackTransportClient.<init>(PreBuiltXPackTransportClient.java:55)
    at org.elasticsearch.xpack.client.PreBuiltXPackTransportClient.<init>(PreBuiltXPackTransportClient.java:50)
    at org.elasticsearch.xpack.client.PreBuiltXPackTransportClient.<init>(PreBuiltXPackTransportClient.java:46)
    at gov.aocs.elastic.search.api.services.SearchController.getNativeElasticSearchConnection(SearchController.java:231)
    at gov.aocs.elastic.search.api.services.SearchController.commonSearch(SearchController.java:422)
    at gov.aocs.elastic.search.api.services.SearchController.searchConfigurable(SearchController.java:615)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:205)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:133)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:97)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:827)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:738)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:967)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:901)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:970)
    at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:872)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:846)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:790)
    at io.undertow.servlet.handlers.ServletHandler.handleRequest(ServletHandler.java:74)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:129)
    at gov.aocs.elastic.search.api.services.EntitiesCORSFilter.doFilter(EntitiesCORSFilter.java:19)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:108)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:81)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:197)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:115)
    at org.springframework.boot.web.support.ErrorPageFilter.access$000(ErrorPageFilter.java:59)
    at org.springframework.boot.web.support.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:90)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.boot.web.support.ErrorPageFilter.doFilter(ErrorPageFilter.java:108)
    at io.undertow.servlet.core.ManagedFilter.doFilter(ManagedFilter.java:61)
    at io.undertow.servlet.handlers.FilterHandler$FilterChainImpl.doFilter(FilterHandler.java:131)
    at io.undertow.servlet.handlers.FilterHandler.handleRequest(FilterHandler.java:84)
    at io.undertow.servlet.handlers.security.ServletSecurityRoleHandler.handleRequest(ServletSecurityRoleHandler.java:62)
    at io.undertow.servlet.handlers.ServletChain$1.handleRequest(ServletChain.java:65)
    at io.undertow.servlet.handlers.ServletDispatchingHandler.handleRequest(ServletDispatchingHandler.java:36)
    at org.wildfly.extension.undertow.security.SecurityContextAssociationHandler.handleRequest(SecurityContextAssociationHandler.java:78)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.servlet.handlers.security.SSLInformationAssociationHandler.handleRequest(SSLInformationAssociationHandler.java:131)
    at io.undertow.servlet.handlers.security.ServletAuthenticationCallHandler.handleRequest(ServletAuthenticationCallHandler.java:57)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.security.handlers.AbstractConfidentialityHandler.handleRequest(AbstractConfidentialityHandler.java:46)
    at io.undertow.servlet.handlers.security.ServletConfidentialityConstraintHandler.handleRequest(ServletConfidentialityConstraintHandler.java:64)
    at io.undertow.security.handlers.AuthenticationMechanismsHandler.handleRequest(AuthenticationMechanismsHandler.java:60)
    at io.undertow.servlet.handlers.security.CachedAuthenticatedSessionHandler.handleRequest(CachedAuthenticatedSessionHandler.java:77)
    at io.undertow.security.handlers.NotificationReceiverHandler.handleRequest(NotificationReceiverHandler.java:50)
    at io.undertow.security.handlers.AbstractSecurityContextAssociationHandler.handleRequest(AbstractSecurityContextAssociationHandler.java:43)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at org.wildfly.extension.undertow.security.jacc.JACCContextIdHandler.handleRequest(JACCContextIdHandler.java:61)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at org.wildfly.extension.undertow.deployment.GlobalRequestControllerHandler.handleRequest(GlobalRequestControllerHandler.java:68)
    at io.undertow.server.handlers.PredicateHandler.handleRequest(PredicateHandler.java:43)
    at io.undertow.servlet.handlers.ServletInitialHandler.handleFirstRequest(ServletInitialHandler.java:292)
    at io.undertow.servlet.handlers.ServletInitialHandler.access$100(ServletInitialHandler.java:81)
    at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:138)
    at io.undertow.servlet.handlers.ServletInitialHandler$2.call(ServletInitialHandler.java:135)
    at io.undertow.servlet.core.ServletRequestContextThreadSetupAction$1.call(ServletRequestContextThreadSetupAction.java:48)
    at io.undertow.servlet.core.ContextClassLoaderSetupAction$1.call(ContextClassLoaderSetupAction.java:43)
    at org.wildfly.extension.undertow.security.SecurityContextThreadSetupAction.lambda$create$0(SecurityContextThreadSetupAction.java:105)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at org.wildfly.extension.undertow.deployment.UndertowDeploymentInfoService$UndertowThreadSetupAction.lambda$create$0(UndertowDeploymentInfoService.java:1501)
    at io.undertow.servlet.handlers.ServletInitialHandler.dispatchRequest(ServletInitialHandler.java:272)
    at io.undertow.servlet.handlers.ServletInitialHandler.access$000(ServletInitialHandler.java:81)
    at io.undertow.servlet.handlers.ServletInitialHandler$1.handleRequest(ServletInitialHandler.java:104)
    at io.undertow.server.Connectors.executeRootHandler(Connectors.java:330)
    at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:812)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at org.elasticsearch.plugins.PluginsService.loadPlugin(PluginsService.java:373)
    ... 95 more
Caused by: ElasticsearchException[failed to initialize a KeyManagerFactory]; nested: PEMException[unable to convert key pair: 1.2.840.113549.1.1.1 KeyFactory not available]; nested: NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory not available];
    at org.elasticsearch.xpack.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:69)
    at org.elasticsearch.xpack.ssl.SSLService.createSslContext(SSLService.java:379)
    at org.elasticsearch.xpack.ssl.SSLService.loadSSLConfigurations(SSLService.java:400)
    at org.elasticsearch.xpack.ssl.SSLService.<init>(SSLService.java:78)
    at org.elasticsearch.xpack.XPackPlugin.<init>(XPackPlugin.java:190)
    ... 100 more
Caused by: org.bouncycastle.openssl.PEMException: unable to convert key pair: 1.2.840.113549.1.1.1 KeyFactory not available
    at org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter.getPrivateKey(Unknown Source)
    at org.elasticsearch.xpack.ssl.CertUtils.readPrivateKey(CertUtils.java:272)
    at org.elasticsearch.xpack.ssl.PEMKeyConfig.readPrivateKey(PEMKeyConfig.java:80)
    at org.elasticsearch.xpack.ssl.PEMKeyConfig.createKeyManager(PEMKeyConfig.java:64)
    ... 104 more
Caused by: java.security.NoSuchAlgorithmException: 1.2.840.113549.1.1.1 KeyFactory not available
    at java.security.KeyFactory.<init>(KeyFactory.java:138)
    at java.security.KeyFactory.getInstance(KeyFactory.java:172)
    at org.bouncycastle.jcajce.DefaultJcaJceHelper.createKeyFactory(Unknown Source)
    ... 108 more

Settings settings = Settings.builder() .put("cluster.name", clusterName) .put("xpack.security.user", userNamePassword)// Adding Username and Password in XPack Settings for ES. .put("xpack.security.transport.ssl.enabled", "true") .put("xpack.ssl.key", configFolderPath+"/ssl/client.key") .put("xpack.ssl.certificate", configFolderPath+"/ssl/mycrtfile.crt") .put("xpack.security.transport.ssl.certificate_authorities", configFolderPath+"/sam/ssl/mychainbundle.crt") — Aravind, Oct 08 '19 at 17:29
i have tried to post the exception but it says its too long. i didnt find the option how to attach the .txt file with exception. — Aravind, Oct 08 '19 at 17:36
@xtratic - I tried.. in question as well..its says it too long.. — Aravind, Oct 08 '19 at 18:14
I have edited your question to include the exception text, now paste the code into the question. — xtratic, Oct 08 '19 at 18:51
Also, please remember to format the code and errors you include in your question; They are much easier to read this way and you are more likely to get an answer. I've formatted them this time, you can do it next times with the editing tools or by indenting by 4 spaces. — xtratic, Oct 09 '19 at 12:21

xtratic · Answer 1 · 2019-10-09T19:00:45.380

0

The root of your issue seems to be that BouncyCastle can't read the Private Key from your PEM certificate because it doesn't have a Key Factory that can handle this format (it doesn't even know it's name other than '1.2.840.113549.1.1.1').

The OID 1.2.840.113549.1.1.1 is for RSAES-PKCS1-v1_5.

First, I would try updating BouncyCastle to see if a newer version can recognize this format.

If that doesn't work then perhaps try converting your key to a different format which BouncyCastle can recognize.

~~You may be able to convert to PKCS12 with this command openssl pkcs12 -export -nocerts -inkey your.private.key.pem -out your.private.key.p12 found in this answer~~

Please let us know if updating BouncyCastle or changing your key format solves your issue.

edited Oct 09 '19 at 19:00

answered Oct 09 '19 at 14:07

xtratic

4,600
2
14
32

Could you please tell me out the three files for which file it is complaining about? Below files are from my jboss server .put("xpack.ssl.key", configFolderPath+"/ssl/client.key") .put("xpack.ssl.certificate", configFolderPath+"/ssl/mycrtfile.crt") .put("xpack.security.transport.ssl.certificate_authorities", configFolderPath+"/sam/ssl/mychainbundle.crt") i am calling the elastic search nodes/servers from my jboss which has below files mychainbundle.crt entrust_l1k.cer .csr .jks .p12 .pem mycrtfile.sam.gov.crt – Aravind Oct 09 '19 at 15:01
I used the below command before to generate .pem file where i used pkcs12 only openssl pkcs12 -in .p12 -nodes -nocerts -out .pem the client certificate i generated with below commands openssl pkcs12 -in .p12 -nocerts -nodes > .key So are you saying something wrong with the elastic server above certificate files? if so which file? just .pem? – Aravind Oct 09 '19 at 15:03
Have you tried updating BouncyCastle? I'm not sure exactly which file it's having issues with except that it's trying to read a private key from a PEM file `org.bouncycastle.openssl.PEMException: unable to convert key pair: KeyFactory not available ... at org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter.getPrivateKey ... at org.elasticsearch.xpack.ssl.CertUtils.readPrivateKey` – xtratic Oct 09 '19 at 15:08
If you have the sources for BouncyCastle you could put a breakpoint where `JcaPEMKeyConverter.getPrivateKey()` throws the exception and maybe see which key it was going after when the exception occurred. – xtratic Oct 09 '19 at 15:15
1

the only key it's likely to be converting is the one OP told it (in the config) to read, namely client.key. This does appear to be a bug in Bouncy 1.48 and 1.49; 1.50 up have an intervening helper method `getKeyFactory` that uses a local Map to find the correct name, and does the invocation of the helper here DefaultJcaJceHelper. I doubt however that a class named PEMKeyConfig will handle a PKCS12 which is not PEM, much less a key-only PKCS12 which is highly unconventional. – dave_thompson_085 Oct 09 '19 at 16:54
@dave_thompson_085 Good call, that makes sense that it's having difficulty with "/ssl/client.key", I just wasn't completely sure. If that's the one then you're right that converting to P12 wouldn't make much sense. For the `PEMKeyConfig` I figured the creation of the SSLContext would delegate to a different KeyConfig to create a different KeyManager based on what type of key it was given. – xtratic Oct 09 '19 at 19:23
Hi All, Sorry for late response. – Aravind Oct 15 '19 at 02:22
Hi All, I was able to resolve this issue after i upgraded the bouncy castle jars from 1.49 to 1.63. i added the dependencies in my transport client project pom for 1.63 and manually excluded 1.49 jars in pom. The spring boot 5.1.7 dependency seems to be adding the 1.49 jar automatically. – Aravind Oct 15 '19 at 02:37
Also in my transport client code, I had to add only the last 3 lines for ssl. .put("cluster.name", clusterName) .put("xpack.security.user", userNamePassword)// Adding Username and Password in XPack Settings for ES. .put("xpack.security.transport.ssl.enabled", "true") .put("xpack.ssl.key", configFolderPath+"/ssl/my.pem") .put("xpack.ssl.certificate", configFolderPath+"/ssl/mycertificate.project.domain.crt") – Aravind Oct 15 '19 at 02:37
Additional info my.pem ===> this file is .pem file that i generated in my elasticsearch co ordinate node. mycertificate.project.domain.crt ==> this file is my certificate of the elasticsearch co ordinate node. these file i copied to my jboss transport client project folder referred as above. Thankyou all for helping me. – Aravind Oct 15 '19 at 02:38
please mark this solution as correct and if some one can wrap that above solution response instead of comments that would be great.Thankyou all. – Aravind Oct 15 '19 at 02:39

NoSuchAlgorithmException[1.2.840.113549.1.1.1 KeyFactory not available];

1 Answers1