Troubleshooting Oracle TCPS Connection Failures in TDM Portal

Products

• CA Test Data Manager (Data Finder / Grid Tools)

Issue/Introduction

Users attempting to configure or test an Oracle TCPS connection profile in the CA Test Data Manager (TDM) Portal may encounter the following errors:

• Unable to initialize the truststore file / Unable to initialize the key store
• java.io.IOException: Keystore was tampered with, or password was incorrect
• java.security.UnrecoverableKeyException: Password verification failed
• Connection failures when using an IP Address instead of a Hostname.

Environment

• CA Test Data Manager (TDM) Portal 5.x
• Oracle Database with TCPS (SSL/TLS) enabled

Cause

Root Cause

1. Keystore/Truststore Order: Java loads the .keystore file before attempting to load the .truststore. If the .keystore configuration is invalid (e.g., incorrect password or path), the connection fails before the truststore is even accessed.
2. Password Mismatch: The password in application.properties for tdmweb.keystorePassword must match the actual password of the keystore file. If it was autogenerated or changed during an upgrade, it may no longer match the default 'marmite' password.
3. Certificate Hostname Mismatch: Oracle certificates often contain the server's Hostname in the Subject Alternative Name (SAN) or Common Name (CN). If the TDM connection profile uses an IP Address, the SSL handshake will fail due to a hostname mismatch.
4. Non-Default Truststore Path: While the Portal can be pointed to the JRE cacerts file, it is often more reliable to use the default TDM truststore location.

Resolution

Step 1: Validate Keystore Configuration

Verify the following lines in your ${CATDMWEB_HOME}/conf/application.properties file:

• Path: tdmweb.keystorePath=C:/Program Files/CA/CA Test Data Manager Portal/conf/.keystore (Verify the path is correct for your installation).
• Password: Ensure tdmweb.keystorePassword is correct. If you are not using custom signed certificates for the Portal itself, ensure it uses the default encrypted 'marmite' password.
• Encryption: Use ${CATDMWEB_HOME}/service/EncryptUtil.bat -p to generate encrypted password strings if needed.

Step 2: Import Oracle Certificates into the Default Truststore

Instead of modifying application.properties to point to the JRE cacerts, import the Oracle server certificates directly into the TDM default truststore:

1. Locate the default truststore at ${CATDMWEB_HOME}/conf/.truststore.
2. Use the Java keytool to import the Oracle CA/Server certificates.
3. Ensure the password for the .truststore is the default 'changeit' (unless previously customized).

Step 3: Use Hostname in Connection Profile

When creating the Connection Profile in TDM Portal:

1. Ensure the Server Name field uses the FQDN (Fully Qualified Domain Name) or Hostname that matches the certificate.
2. Do not use the IP Address if the certificate does not explicitly list the IP in the Subject Alternative Name (SAN) field.

Step 4: Restart Services

Restart the CA Test Data Manager Portal service to apply changes made to application.properties or the keystore/truststore files.

Additional Information

To verify or update the application.properties password, follow these concise steps:

1. Test with Plain Text: Replace the encrypted string in application.properties with the plain text password and restart the TDM Portal service.
2. Re-encrypt: Once the connection is verified, run the EncryptionUtil -p command to generate a new encrypted string.
3. Secure: Replace the plain text password in the configuration file with the new encrypted value and restart the service.