Spring Cloud Services mirror job fails with an Exception containing "Keystore was tampered with, or password was incorrect"

Products

• VMware Tanzu Application Service for VMs

Issue/Introduction

It is possible that the keystore expires in the Spring Cloud Services (SCS), causing the mirror service to stop working. The mirror-service.stdout.log file will show the following error.

2022-06-15 12:32:22.296 ERROR 5 --- [           main] o.s.c.c.ClientHttpConnectorFactory       : Error configuring HTTP connections

java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
  at java.security.Provider$Service.newInstance(Provider.java:1617) ~[na:1.8.0_322]
  ...
  at org.springframework.boot.loader.JarLauncher.main(JarLauncher.java:88) ~[mirror-service.jar:]
Caused by: java.security.KeyStoreException: problem accessing trust store
  at sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:73) ~[na:1.8.0_322]
  ...
  at java.security.Provider$Service.newInstance(Provider.java:1595) ~[na:1.8.0_322]
  ... 74 common frames omitted
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
  at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:792) ~[na:1.8.0_322]
  ...
  at sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:49) ~[na:1.8.0_322]
  ... 83 common frames omitted
Caused by: java.security.UnrecoverableKeyException: Password verification failed
  at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:790) ~[na:1.8.0_322]
  ... 91 common frames omitted
  

 

Environment

Product Version: 2.12

Resolution

The solution for this issue would be to recreate the SCS deployment VM. This will recreate the truststore and should get the mirror-service back and running.

To prevent this particular keystore expiration issue from occurring, please follow the backup instructions outlined here. As of Spring Cloud Service release 3.1.32, refreshing this keystore file is included as part of the regular backup procedure.