4

I'm trying to deploy an Oracle ORDS 19.1 war file in Glassfish 5.1.0.

I got a deployment error, and I think I've found a solution.

But, when I try to run the fix, I get another error, that doesn't make any sense to me. Under Glassfish 5.1.0:

[oracle@secure-web-server-dvl glassfish]$ bin/asadmin set configs.config.server-config.cdi-service.enable-implicit-cdi=false
NCLS-ADMIN-00010
javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateExpiredException: NotAfter: Tue Apr 03 18:09:20 EDT 2018
Command set failed.

This is an SSL certificate expired error. But, my certs are not expired.

I used keytool to check validity of all certificates in cacerts.jks and keystore.jks.

Everything is valid. Can someone explain the real problem here?

Help!

4
  • 1
    Bump.....it's been 4 days with a 100 point bounty.....no takers? Any Glassfish experts out there? May 16, 2019 at 15:09
  • 1
    I'm not an expert and can only make a guess. What is your JDK version? Glassfish 5.1 needs at least 1.8.0_191 to work properly. There were changes in the Java versions : 1.8.0_160 has broken the SSL functionality in Glassfish 5.0. For now, i was able to configure Glassfish 5.1 to work with JDK 1.8.0_202 with Websockets and Letsencrypt with no problems - previously the project ran on GF 5.0 and Java 1.8.0_152. I'm not familiar with Oracle ORDS, should the problem be there.
    – Helmwag
    May 16, 2019 at 16:47
  • stackoverflow.com/questions/18248020/… might be of help. May 17, 2019 at 13:18
  • Some other possibilities: 1. A step in the SSL implementation is omitted - helpdesk.ssls.com/hc/en-us/articles/… 2. A possible bug. The admin GUI in GF 5.1 can undeploy an app, but cannot deploy one on remote server and gives an error. For now i'm deploying by dropping the war file into the autodeploy folder
    – Helmwag
    May 18, 2019 at 7:57

1 Answer 1

0
  • Update:

How did you run keytool? The default listing (without -v for verbose) gives you the date from which the certificate is valid, not until!), try adding -v or use an alternative tool like: https://keystore-explorer.org/

  • Original post:

Without access to your environment or any steps to reproduce this I cannot give you a simple fix - sorry. It's a shame this particular exception does not show a stacktrace that tells us more of which code is causing it, or debug logging that tells us which url/connection attempt caused this.

Looking for this specific certificate expiration date only shows the exact same question elsewhere (cross-postings):

I therefore expect your problem to be something specific to your local environment, like:

  • (transparent proxy server/loadbalancer/frontend webserver) with expired certificate, or redirecting the request to a different IP-address than expected
  • authentication handled by ldap server over ssl/tls with expired certificate
  • custom keystore config pointing to a different keystore file than you expect (most likely with the extension: jks, pkcs12/p12/pfx, cer, or depending on your java security provider and related configuration ( for Oracle Java it might even be in the Windows keystore etc., see: https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html )

It might be useful to try to:

  • Run the involved Java (client) Applications with the system property: javax.net.debug=all, e.g. using java -Djavax.net.debug=all ... some.jar/someclass
  • If you want to check with a different tool try using:
    • openssl s_client -connect host:port -servername host -showcerts
    • save any certificates you see in the above output to a file like cert.txt and inspect them using:
    • openssl x509 -in cert.txt -noout -text
  • if you are desperate, at your own risk, change your system date/time temporarily to before the expiration date/time, make a system snapshot/backup first - just in case :-)

if all else fails:

  • intercept systemcalls related to networking (e.g. with strace on unix or procmon on Windows)
  • intercept traffic (e.g. with tcpdump, wireshark, etc.) and analyse it with wireshark
  • hookup a Java debugger and put a breakpoint on that java.security.cert.CertificateExpiredException

Good luck!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.