Java truststore debugging/troubleshooting tips.
Writing this down in case it's helpful for other folks (or perhaps just to remind myself later in the future :-) )
I had an interesting issue come up the other day that involved some somewhat obscure errors in a java client application trying to access a resource over HTTPS:
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated at com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:345) at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128) at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:390) at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148) at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149) at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121) at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:561) at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:415) at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820) at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754) at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:732)
This error indicated that there was SOMETHING off with the HTTPS connection attempt but didn't elaborate. For more detail, we needed to enable a helpful Java VM parameter: -Djavax.net.debug=ssl:handshake
After doing THAT, we saw a lot more helpful details in logging but came across another seemingly obscure error:
java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
The verbiage is a little complex but essentially means that the trustStore (cacerts) resource that java is trying to use either isn't found or can't be accessed.
This led to the last bit of helpful debugging -- explicitly stating the trustStore file as a JVM parameter:
java -Djavax.net.ssl.trustStore=/home/example/mycacerts
Helpful online resources:
https://stackoverflow.com/questions/6784463/error-trustanchors-parameter-must-be-non-empty
https://stackoverflow.com/questions/6276435/why-am-i-getting-an-exception-javax-net-ssl-sslpeerunverifiedexception-peer-not
https://stackoverflow.com/questions/2642046/is-there-a-way-to-load-a-different-cacerts-than-the-one-specified-in-the-java-ho














