java.security.KeyStoreException: JKS not found in CA Access Gateway (SPS)

Products

• CA Single Sign On Secure Proxy Server (SiteMinder)
• SITEMINDER

Issue/Introduction

CA Access Gateway (SPS) is not running properly and it is intermittently causing an outage. 

This error is logged in server.log when the CA Access Gateway (SPS) starts:

[04/May/2021:11:07:23-084] [ERROR] - ERROR: SSLConfig
java.security.KeyStoreException: JKS not found
 at java.security.KeyStore.getInstance(KeyStore.java:851) ~[?:1.8.0_222]
 at com.netegrity.util.SSLConfig.<init>(Unknown Source) [proxyutils.jar:?]
 at com.netegrity.util.SmSSLConfig.<init>(Unknown Source) [proxyutils.jar:?]

Caused by: java.security.NoSuchAlgorithmException: JKS KeyStore not available
 at sun.security.jca.GetInstance.getInstance(GetInstance.java:159) ~[?:1.8.0_222]
 at java.security.Security.getImpl(Security.java:695) ~[?:1.8.0_222]
 at java.security.KeyStore.getInstance(KeyStore.java:848) ~[?:1.8.0_222]

Cause

Verified server.conf, that Tomcat default keystore actually has not been enabled.

#local.https.keyStoreFileName="tomcat.keystore"

Verified that there were no https cipher changes recently on the CA Access Gateway (SPS) configuration.

Verified that there were no SSL related changes recently on CA Access Gateway (SPS) Apache configuration.

There was a Java JDK/JRE change on the particular system, where the following file was deleted and missing:

/{home_jdk}/jre/lib/security/java.security 

The CA Access Gateway (SPS) relies on this JRE file to run properly; when checking the Java process, it will review the path.

Resolution

Restoring the missing Java file, and restarting the CA Access Gateway (SPS), then service became stable.