I'm trying to configure my e-mail on Jenkins/Hudson and I constantly receive the error

java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be
    non-empty

I've seen a good amount of information online about the error, but have not gotten any to work. I'm using Sun's JDK on fedora linux (not openJDK).

Here are a few things I've tried. I tried following the advice from this post but it copying the cacerts from windows over to my Fedora box hosting Jenkins didn't work. I tried following this guide as I'm trying to configure gmail as my SMTP server but it didn't work either. I also tried to download and move those cacert files manually and move them over to my java folder using a variation of the commands on this guide.

I open to any suggestions as I'm currently stuck right now. I have gotten it to work from a Windows Hudson server but I am struggling on Linux.

share|improve this question

28 Answers 28

up vote 330 down vote accepted

This bizarre message means that the truststore you specified was not found, or couldn't be opened due to access permissions for example.

See also @AdamPlumb's answer below.

share|improve this answer
1  
Thanks EJP, I saw your post here but I wasn't sure how to verify the truststore is there. Also I brought up my server.xml file but I wasn't sure how to verify the truststore is in place. Do I just check the keystoreFile="conf/.keystore" pref (keystoreFile wasn't present in that file)? – David Gill Jul 22 '11 at 16:58
1  
I follow what your saying and I don't know how I missed that distinction between keystore and truststore. With that in mind, I tried to generate a truststore with the command keytool -import -file CA.cer -keystore truststore . I dont know exactly where that generated the truststore so I ran locate and checked. I then added this truststore to my Tomcat in catalina.sh under JAVA_OPTS with the command -Djavax.net.ssl.trustStore=/opt/downloads/jdk1.6.0_21/sample‌​/jmx/jmx-scandir/tru‌​ststore . I restarted my servers and I still get the truststore error. Am i missing something? – David Gill Jul 30 '11 at 4:11
1  
The answer was with how I was importing it. I seemed to have missed a crucial step. See [Java Error InvalidAlgorithmParameterException][1] [1]: jyotirbhandari.blogspot.com/2011/09/… – David Gill Sep 25 '11 at 17:15
2  
Confirmed this answer is correct. I was getting the error under Tomcat. I had my truststore in ${CATALINA_HOME}\conf but CATALINA_HOME was not getting set so Tomcat was looking under \conf for the truststore. – SingleShot Feb 21 '12 at 21:03
3  
@BubblewareTechnology No, the error was in the filename, not in how you imported the certificate into the file. Your blog isn't correct. You also shouldn't be recommending modifying the JRE$/ cacerts file. It will change next Java upgrade. You need a process that copies it, adds your own certificate to the copy, and uses the copy as the truststore. Repeat every Java upgrade. And you don't need to tell Java about its own truststore at all, only about your own, if it's different. – EJP Apr 21 '14 at 1:01

This fixed the problem for me on Ubuntu:

sudo /var/lib/dpkg/info/ca-certificates-java.postinst configure

(found here: https://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/1396760)

ca-certificates-java is not a dependency in the Oracle JDK/JRE so this must be explicitly installed.

share|improve this answer
2  
Thanks, this fixed the issue for me when I ran into it on Ubuntu 15.04. – AgentME Jun 22 '15 at 0:14
2  
also worked on 15.10 – bph Jan 28 '16 at 14:49
1  
This worked for me on Debian 8 with OpenJDK 8 – Jacob Gillespie Apr 22 '16 at 14:19
    
Worked on Raspbian on Raspberry Pi – Defozo May 9 '16 at 1:25
1  
Ran into this issue with Debian jesse stable backports with OpenJDK8 and this fixed the issue. Was using this while building Docker images. :) – Tuxdude Jun 13 '16 at 6:00

I ran into this solution from http://architecturalatrocities.com/post/19073788679/fixing-the-trustanchors-problem-when-running-openjdk-7:

Fixing the trustAnchors problem when running OpenJDK 7 on OS X. If you're running OpenJDK 7 on OS X and have seen this exception:

Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors
    parameter must be non-empty

There's a simple fix, just link in the same cacerts file that Apple’s JDK 1.6 uses:

cd $(/usr/libexec/java_home -v 1.7)/jre/lib/security   
ln -fsh /System/Library/Java/Support/CoreDeploy.bundle/Contents/Home/lib/security/cacerts

You need to do this for every OpenJDK version you have installed, just change -v 1.7 to the version you want to fix. Run /usr/libexec/java_home -V to see all the JREs and JDKs you have installed.

Perhaps the OpenJDK guys could add this to their install scripts.

share|improve this answer
1  
My "ln" command (on OSX 10.6.8) doesn't have an "h" option; what is it meant to do? – Andrew Swan Jun 20 '12 at 2:09
1  
Ah, I had two "ln" commands, one in /usr/bin (the default) and one in /bin; the latter had an "h" option and worked. – Andrew Swan Jun 20 '12 at 2:20
    
I fixed my broken 1.6 installation linking to cacerts from the system 1.8 installation with this ln technique. Thanks! – A21z Feb 19 '15 at 23:54
1  
For future readers: it seems that you also need the other 3 files that are in the security folder (blacklisted.certs, local_policy.jar, and US_export_policy.jar) for Java to be happy. – awksp Jun 18 '15 at 16:08

EJP basically answered the question (and I realize this has an accepted answer) but I just dealt with this edge-case gotcha and wanted to immortalize my solution. I had the InvalidAlgorithmParameterException error on a hosted jira server that I had previously set up for SSL-only access. The issue was that I had set up my keystore in the PKCS#12 format, but my truststore was in the JKS format. In my case, I had edited my server.xml file to specify the keystoreType to PKCS, but did not specify the truststoreType, so it defaults to whatever the keystoreType is. Specifying the truststoreType explicitly as JKS solved it for me.

share|improve this answer
    
well, I help you immortalizing solution to your edge-case gotcha. that's where it gets interesting. – n611x007 Sep 25 '15 at 16:59
    
This was exactly my problem. I was using Spring Boot 1.4.2.RELEASE, and had a hardware keystore and software truststore. I specified the provider and type for the keystore, but not the truststore. As a result, the wrong provider and type were used by the truststore. Specifying those (SUN and JKS) solved the issue. – Kenco Dec 6 '16 at 9:38

I ran into this exact problem on OSX, using JDK 1.7, after upgrading to Maverick. The fix that worked for me was to simply re-install the Apple version of Java, available here: http://support.apple.com/kb/DL1572

share|improve this answer
    
I encountered this with Java 6 used by Grails on OSX. I also had Java 7 from Oracle installed and also upgraded to Mavericks. Re-installing Java 6 from Apple website also fixed the issue for me. – paul_sns Sep 9 '14 at 11:05
    
Ran into this when installing open jdk 6 onto an ubuntu cloud box. Nice to see a familiar face, BTW – Ben Hutchison Jun 17 '15 at 5:58

In Ubuntu >= 12.10, the certificates are held in the ca-certificates-java package. Using -Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts will pick them up regardless of what JDK you're using.

share|improve this answer
42  
I found I needed to run update-ca-certificates -f manually, to populate the cacerts file – Portablejim Feb 5 '15 at 6:54
4  
@Portablejim Thanks. Your comment solved the first issue I hit building Apache Spark on Ubuntu 15.04beta. – Paul Mar 31 '15 at 9:21
1  
Thanks you @Portablejim, your comment worked for me on Ubuntu 15.04. – David Berg Oct 5 '15 at 14:30
    
Unfortunately this does not work for me. – Magick Aug 15 '16 at 9:18
    
Thanks. This is fixed my problem with PhpStrom + patched JDK. I wrote this key into "phpstorm64.vmoptions" file. – Vijit Nov 4 '16 at 7:43

Ran

sudo update-ca-certificates -f 

to create cert file then

sudo /var/lib/dpkg/info/ca-certificates-java.postinst configure 

and I was back in business thanks guys, a pity it's not included in the installation but got there in the end.

share|improve this answer
    
When I run sudo /var/lib/dpkg/info/ca-certificates-java.postinst configure** I get sudo: /var/lib/dpkg/info/ca-certificates-java.postinst: command not found – Magick Aug 15 '16 at 9:20
    
Just sudo update-ca-certificates -f is enough on Debian jessie with openjdk-8-jre-headless from jessie-backports, as long as ca-certificates-java is installed. I think order of installation matters (JRE after ca-certificates-java may cause this, as the latter doesn’t have any triggers for the backported Java 8). – mirabilos Feb 6 '17 at 22:14
1  
sudo /var/lib/dpkg/info/ca-certificates-java.postinst configure without stars ** – Yu Jiaao Sep 6 '17 at 10:27

I've had lot of security issues after upgrading to OSX Mavericks

  • SSL problem with Amazon AWS
  • peer not authenticated with Maven and Eclipse
  • trustAnchors parameter must be non-empty

I applied this JAVA update and it fixed all my issues: http://support.apple.com/kb/DL1572?viewlocale=en_US

share|improve this answer
4  
Ugh. Java 6 is many years past its end of public support, and is surely riddled with security holes. Apple makes it available for download so that older software that cannot be run with Java 7/8 can continue to execute, but it should not be used for making SSL connections to services on the public internet, such as 1. AWS, 2. Maven Central, 3. anything else. – Zac Thompson Mar 6 '15 at 6:46

I expected things like this, being that I use an alternate jvm in my Talend Open Studio. (support at the moment exists only until jdk1.7) i use 8 for security purposes... anyway

  • update your cert store

    sudo update-ca-certificates -f

then

  • add a new value in your initialization parameters

    sudo gedit $(path to your architecture specific ini i.e. TOS_DI...ini)

-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts

-Djavax.net.ssl.trustAnchors=/etc/ssl/certs/java/cacerts

for me, the second entry worked. I think, depending on the version of TOS/TEnt + jvm, it has a different parameter name, but looks for the same keystore file

share|improve this answer
4  
Where did you get the property javax.net.ssl.trustAnchors from? It isn't mentioned in the JSSE documentation. – EJP Sep 3 '15 at 21:51

For me it was caused by the lack of a trustedCertEntry in the truststore

To test use keytool -list -keystore keystore.jks

Gives me

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

cert-alias, 31-Jul-2017, PrivateKeyEntry

Even though my PrivateKeyEntry contains a CA it needed to be imported separately

keytool -import -alias root-ca1 -file rootca.crt -keystore keystore.jks

imports the certificate, and then re-running keytool -list -keystore keystore.jks now gives

Your keystore contains 2 entries

cert-alias, 31-Jul-2017, PrivateKeyEntry, 
Certificate fingerprint (SHA1): 
<fingerprint>
root-ca1, 04-Aug-2017, trustedCertEntry, 
Certificate fingerprint (SHA1): 
<fingerprint>

Now it has a trustedCertEntry tomcat will start successfully.

share|improve this answer

Also encountered this on OS X after updating Mavericks, when the old Java 6 was being used and tried to access an https URL. Fix was the inverse of Peter Kriens, I needed to copy the cacerts from the 1.7 space to the location linked by the 1.6 version:

(as root)
umask 022
mkdir -p /System/Library/Java/Support/CoreDeploy.bundle/Contents/Home/lib/security
cp $(/usr/libexec/java_home -v 1.7)/jre/lib/security/cacerts \
    /System/Library/Java/Support/CoreDeploy.bundle/Contents/Home/lib/security
share|improve this answer
1  
The command here tries to copy a directory to a file; makes no sense at all. – praseodym Dec 5 '13 at 12:54
    
I concur with the assessment of using a reverse solution. I found that jdk1.6 had a broken softlink /Library/Java/JavaVirtualMachines/1.6.0_33-b03-424.jdk/Conte‌​nts/Home/lib/securit‌​y/cacerts -> /System/Library/Java/Support/CoreDeploy.bundle/Contents/Home‌​/lib/security/cacert‌​s. So I rm'ed the broken soft link, then copied over the cacerts from the jdk1.7 installation. – James A Wilson Jan 13 '14 at 20:27
    
NOTE: when you are done you should be able to cat the cacerts file that you copied to validate the permissions. – Gray Aug 31 '15 at 18:56
    
Also, fixed the cp to go the right direction and added the umask for mkdir and cp. – Gray Aug 31 '15 at 19:03

If you experience this on Ubuntu with JDK9 and Maven, you can add this JVM option - first check if the path exists:

-Djavax.net.ssl.trustStore=/etc/ssl/certs/java/cacerts

If the file is missing, try to install the ca-certificates-java as someone noted:

sudo apt install ca-certificates-java
share|improve this answer

I had this error message on Java 9.0.1 on Linux. It was due to a known bug of the JDK, where the cacerts file is empty in the .tar.gz binary package (downloaded from http://jdk.java.net/9/).

See the "known issues" paragraph of http://www.oracle.com/technetwork/java/javase/9-0-1-relnotes-3883752.html , saying "TLS does not work by default on OpenJDK 9"

On Debian/Ubuntu (and probably other derivaties), a simple workaround is to replace the cacerts file with the one from the "ca-certificates-java" package :

sudo apt install ca-certificates-java
cp /etc/ssl/certs/java/cacerts /path/to/jdk-9.0.1/lib/security/cacerts

On RedHat/CentOS, you can do the same from the "ca-certificates" package :

sudo yum install ca-certificates
cp /etc/pki/java/cacerts /path/to/jdk-9.0.1/lib/security/cacerts
share|improve this answer

In my case the JKS file used in client application was corrupted. I created new one and import the destination server SSL certificates in it. Then I use the new JKS file in the client application as trust store like :

System.setProperty("javax.net.ssl.trustStore",path_to_your_cacerts_file);

Source: java SSL and cert keystore

I use the (KeyStore Explorer) tool to create the new JKS. You can downloaded from this link KeyStore Explorer

share|improve this answer
    
keystore-explorer did the work for me. You just have to create default keystore and examine and save the certificate file for the site/host. – Shantha Kumara Sep 22 '16 at 12:03

The error tells that the system cannot find the truststore in the path provided with the parameter javax.net.ssl.trustStore.

Under Windows I copied the cacerts file from jre/lib/security location into the eclipse install directory (same place as eclipse.ini file) and added the following settings in eclipse.ini:

-Djavax.net.ssl.trustStore=cacerts
-Djavax.net.ssl.trustStorePassword=changeit
-Djavax.net.ssl.trustStoreType=JKS

Had some troubles with the path to the cacerts (the %java_home% env variable is somehow overwritten), so I used this trivial solve.

The idea is to provide a valid path to the truststore file - ideally would be to use a relative one. You may also use an absolute path.

To make sure the store type is JKS, you would run the following command:

keytool -list -keystore cacerts

Keystore type: JKS
Keystore provider: SUN
share|improve this answer

For the record, none of the answers here worked for me. My gradle build started failing mysteriously with this error, unable to fetch HEAD from maven central for a particular pom file.

It turned out that I had JAVA_HOME set to my own personal build of OpenJDK, which I had built for debugging a javac issue. Setting it back to the jdk installed on my system fixed it.

share|improve this answer
    
... which caused the truststore not to be found, as per other answers. – EJP Mar 21 '17 at 22:46
1  
Yeah, but knowing that the truststore can't be found is entirely unhelpful if you do can't figure out why it's not being found. There are many many possible ways it can go wrong, and it's frustating when none of them happen to be the particular way that it is failing for your own system. – user3562927 Mar 22 '17 at 15:11

None of solutions that I found on the internet worked but a modified Peter Kried's seems to do the job.

First find your Java folder by running /usr/libexec/java_home. For me it was 1.6.0.jdk version. Then go to it's lib/security subfolder (for me /Library/Java/JavaVirtualMachines/1.6.0.jdk/Contents/Home/lib/security)

Then delete cacerts file if there is one already and search for one on the system with sudo find / -name "cacerts". It found multiple for me, in versions of Xcode or other apps that I had installed but also at /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/cacerts which I chose.

Use that file and make a symbolic link to it (while inside the java folder from before) sudo ln -fsh "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/cacerts" and it should work.

I have both - Java from Apple's 2017-001 download (https://support.apple.com/kb/dl1572 - I assume that's where the correct certs are from) and Oracle's one installed on Mac OS X Sierra.

share|improve this answer

I have faced with the issue while importing a Gradle project in IntelliJ IDEA 14. A solution was using a local copy of Gradle instead of a wrapper from the project directory.

share|improve this answer

On RedHat Linux I got this issue resolved by importing the certs to /etc/pki/java/cacerts

share|improve this answer
System.setProperty("javax.net.ssl.trustStore", "C:\\Users\\user-id\\Desktop\\tomcat\\cacerts");
System.setProperty("javax.net.ssl.trustStorePassword", "passwd");

You have to add above two lines in your code. It is not able to find the truststore.

share|improve this answer
    
If you don't, it will use the JRE truststore, and it will certainly be able to find that. The error is caused by incorrect values in these parameters, not their absence. The file named in your code only applies to your installation, not generally. – EJP Nov 16 '17 at 23:18

The answers here are very helpful for Linux and Mac.

If you're on Windows 10, this problem can be caused by a Java update. These seem to change the directory path of the JRE (even if you have a JDK and JRE installed separately).

What worked for me was creating a symlink (Use MinGW, Cygwin, or your favorite Bash shell for Windows) in the c/Program Files/Java directory with the same name as the pre-update version like this:

ln -s jre1.8.0_101 jre1.8.0_92

That way, your old security settings can find the right path. This is admittedly a hack, but it works.

share|improve this answer

I got the same error when sending emails, but NOT always. In my case i've changed one line of code to get every time a new Session object:

MimeMessage message = new MimeMessage(Session.getDefaultInstance(props, authenticator));

to

MimeMessage message = new MimeMessage(Session.getInstance(props, authenticator));

Since then sending e-mails works every time. This may help someone.

Error i got:

javax.mail.MessagingException: Could not convert socket to TLS;
nested exception is: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:1907) at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:666) at javax.mail.Service.connect(Service.java:317) at javax.mail.Service.connect(Service.java:176) at javax.mail.Service.connect(Service.java:125) at javax.mail.Transport.send0(Transport.java:194) at javax.mail.Transport.send(Transport.java:124)

share|improve this answer

On Ubuntu:

sudo apt install ca-certificates-java

or

sudo apt-get install ca-certificates-java

sorted it for me.

share|improve this answer

Another reason for this is its actually valid error. Some nefarious wifi hotspots will mess with certificates and man in the middle attack you to do who knows what (run away!).

Some large employers will do this same trick, especially in sensitive network zones so they can monitor all the encrypted traffic (not great from end user perspective but there may be good reasons for this).

share|improve this answer
    
The error is caused by a missing truststore file. It has nothing to do with wifi hotspots. – EJP Nov 16 '17 at 23:19

I got this error when using a truststore which was exported using a IBM Websphere JDK keytool in #PKCS12 format and trying to communicate over ssl using that file on an Oracle JRE. My solution was to run on an IBM jre or convert the truststore to JKS using an IBM Websphere keytool so I was able to run it in an Oracle jre.

share|improve this answer

You may also encounter this error after upgrading to Spring Boot 1.4.1 (or newer) because it brings along Tomcat 8.5.5 as part of it's dependencies. The problem is due to the way that Tomcat deals with the trust store, if you happen to have specified your trust store location as the same as your keystore in the Spring Boot config you'll likely get the trustAnchors parameter must be non-empty message when starting the application.

server.ssl.key-store=classpath:server.jks
server.ssl.trust-store=classpath:server.jks

Simply remove the server.ssl.trust-store configuration unless you know that you need it, in which case consult the links below.

The following issue contain more details about the problem:

share|improve this answer

I faced this problem while running a particular suite of android for testing on ubuntu 14.04. Two things worked for me as suggested by shaheen

sudo update-ca-certificates -f

sudo /var/lib/dpkg/info/ca-certificates-java.postinst configure

share|improve this answer

for me it got resolved just by upgrading a jenkins plugin "Email Extension Plugin" to latest version (2.61). these 2 plugins are responsible for email config in jenkins- Email Extension Plugin Email Extension Template Plugin

share|improve this answer

protected by EJP Nov 16 '17 at 23:20

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.