OneClick fails to start with "trustAnchors parameter must be non-empty" error after upgrade

Products

• Network Observability

Issue/Introduction

After upgrading DX NetOps Spectrum, the OneClick server fails to start. When you review the catalina.out or webswing.log files, you see the following error sequences:

 

• SPC-OCA-10490: Could not connect to the external authentication server.
• java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
• javax.net.ssl.SSLException: Unexpected error during LDAPS connection attempts to ####.####.####.####

Environment

NetOps Spectrum Any

Resolution

- Imported the trusted certs from the Java/jre/lib/security/cacerts

   cd /opt/CA/Spectrum/custom/keystore

  ../../Java/bin/keytool -importkeystore -srckeystore <SPECROOT>/Java/jre/lib/security/cacerts -destkeystore cacerts -srcstorepass changeit -deststorepass changeit -noprompt

 Verified
     1 - it imported all the trustedCertificates
     2 - tomcatssl is still present AS PrivateKeyEntry

   cd <SPECROOT>/custom/keystore

    ../../Java/bin/keytool -list -keystore cacerts -storepass changeit >certs.txt

    There are now 150 certs present and tomcatssl is still showing as PrivateKeyEntry



Note: We found one other problem, the cacerts store was in PKCS12 format. This needs to be in JKS format.

Looking at the top of the certs.txt file generated above.

Keystore type: PKCS12
Keystore provider: SUN

See additional information on converting this.

Additional Information

   - Convert the PKCS12 Store to JKS (to a different name and renamed after)


   cd /opt/CA/Spectrum/custom/keystore
  
   ../../Java/bin/keytool -importkeystore -srckeystore cacerts -srcstoretype PKCS12 -srcstorepass changeit -destkeystore cacerts150.jks -deststoretype JKS - -deststorepass changeit

  - renamed the current cacerts (pkcs12) to cacerts.pkcs12
  mv cacerts cacerts.pkcs12

  - renamed the converted file  cacerts.jks to cacerts
  cp cacerts150.jks cacerts


Restart tomcat