Keystore unable to load during startup

Keystore unable to load during startup

book

Article ID: KB0080590

calendar_today

Updated On:

Products Versions
TIBCO Data Virtualization 7.0.7

Description

Passwords for all keystores and truststores for TDV and Studio are updated from Keystore Explorer tool. TDV server does not startup after this change. It fails with the below exception.

Exception:
========
ERROR [main] 2018-09-26 15:39:13.765 +0200 BasicServicesModule - 
com.compositesw.common.security.CompositeSecurityException: The keystore could not loaded. [security-1900704] 
at com.compositesw.common.security.KeyStoreUtil.loadKeyStore(KeyStoreUtil.java:278) 
at com.compositesw.common.security.KeyStoreUtil.loadKeyStore(KeyStoreUtil.java:287) 
at com.compositesw.server.security.KeyStoreUtil.loadKeyStore(KeyStoreUtil.java:707) 
at com.compositesw.server.security.KeyStoreUtil.loadDataSourceTrustStore(KeyStoreUtil.java:519) 
at com.compositesw.server.security.KeyStoreUtil.loadDataSourceTrustStore(KeyStoreUtil.java:483) 
at com.compositesw.server.module.BasicServicesModule.initializeSSLProtocol(BasicServicesModule.java:563) 
at com.compositesw.server.module.BasicServicesModule.upToInitTwo(BasicServicesModule.java:254) 
at com.compositesw.server.module.BasicServicesModule.moveUpToLevel(BasicServicesModule.java:140) 
at com.compositesw.server.module.CompositeServerModuleManager.moveAllToLevel(CompositeServerModuleManager.java:549) 
at com.compositesw.server.module.CompositeServerModuleManager.moveToLevel(CompositeServerModuleManager.java:331) 
at com.compositesw.server.module.CompositeServerModuleManager.serverStartup(CompositeServerModuleManager.java:252) 
at com.compositesw.server.services.CompositeServer.startServer(CompositeServer.java:1246) 
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) 
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
at java.lang.reflect.Method.invoke(Method.java:498) 
at com.compositesw.base.boot.ServerBoot.main(ServerBoot.java:86) 
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect 
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:780) 
at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56) 
at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224) 
at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70) 
at java.security.KeyStore.load(KeyStore.java:1445) 
at com.compositesw.common.security.KeyStoreUtil.loadKeyStore(KeyStoreUtil.java:276) 
... 16 more 
Caused by: java.security.UnrecoverableKeyException: Password verification failed 
at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:778) 
... 21 more

Issue/Introduction

Passwords for all keystores and truststores for TDV and Studio are updated from Keystore Explorer tool. TDV server does not startup after this change.

Resolution

The loading error of the keystore is gone at the moment the password of the keystore (cis_datasource_keystore_strong.jks) is changed back to changeit. 

Resolution for this use case is to update the password for the Keystore files using the below steps.
1. There is a java utility that is shipped out of the box called "Keytool". It can be invoked to update the password for the truststore file. Below is an example to perform the same:
keytool -storepasswd -keystore cis_datasource_Keystore_strong.jks
   a) Keytool is located in the <install>/jre/bin directory.
   b) cis_datasource_keystore_strong.jks is located in the <TDV_Install>/conf/server/security directory.

The second option is - you can make the change from Studio->Administration->Configuration->Datasources->Communications.
1. Identify the truststore file you want to change the password for.
2. There are parameters called: Strong Keystore Password (Current) and Strong Truststore Password (Current). You can make the change there for the appropriate JKS file.