SSL with Servoy

Classic Servoy
1

Hi all. I’ve problems implementing SSL for Servoy.

Steps done for SSL

1.- I have a private key my_key.key, a Certificate my_cert.crt, a CA my_ca.crt and a CA private key my_ca_key.key

  • my_cert.crt
  • my_key.key
  • my_ca.crt
  • my_ca_key.key

2.- Generate a certificate signing request for an existing private key

openssl req -out my_csr.csr -key my_key.key -new

3.- Sign the certificate signing request

openssl x509 -req -in my_csr.csr -CA my_ca.crt -CAkey my_ca_key.key -CAcreateserial -out my_cert.crt -days 365

4.- Edit server.xml adding this node

4.- In developer mode … Window->Preferences->Servoy->Services (done in servoy-admin too)

  • Start with ssl support (enabled)
  • SSL Keystore filename : …/servoy.ks
  • SSL keystore passphrase: mypass

5.- Shutdown developer/server

I edit servoy.properties setting password without encrypted

6.- servoy.ks is well pointed and well done

7.- Start servoy server without success and this logout —>

java.security.InvalidKeyException: No installed provider supports this key: (null)
at javax.crypto.Cipher.a(DashoA13*…)
at javax.crypto.Cipher.init(DashoA13*…)
at javax.crypto.Cipher.init(DashoA13*…)
at com.servoy.j2db.util.Settings.load(Settings.java:52)
at com.servoy.j2db.util.Settings.loadFromFile(Settings.java:32)
at com.servoy.j2db.server.ApplicationServer.main(ApplicationServer.java:159)
Exception in thread “main” java.io.IOException: No installed provider supports this key: (null)
at com.servoy.j2db.util.Settings.load(Settings.java:20)
at com.servoy.j2db.util.Settings.loadFromFile(Settings.java:32)
at com.servoy.j2db.server.ApplicationServer.main(ApplicationServer.java:159)

What I’m doing wrong?

Tested in win7 and Ubuntu 9.04 with 1.6.0_20 java version

Best regards. Roberto.

2

at what point did you create the servoy.ks file?

But this is a problem decrypting the servoy.property file database passwords…
the server tries to load in the keystore file specified by this property: SocketFactory.SSLKeystorePath
and then uses SocketFactory.SSLKeystorePassphrase to unlock it.
But then expects to JKS instance of/from that keystore file
With a DESede cypher

It doesnt matter to much that you made the password plain text, because the init for that keystore is not lazy it is done upfront.

3

I’m getting the same error, or what looks like the same one. Here is my stack trace and then a description of my setup and circumstances below.

2 [main] ERROR com.servoy.j2db.util.Debug - Throwable
java.security.InvalidKeyException: No installed provider supports this key: (null)
at javax.crypto.Cipher.a(DashoA13*…)
at javax.crypto.Cipher.init(DashoA13*…)
at javax.crypto.Cipher.init(DashoA13*…)
at com.servoy.j2db.util.Settings.load(Settings.java:171)
at com.servoy.j2db.util.Settings.loadFromFile(Settings.java:50)
at com.servoy.j2db.server.ApplicationServer.main(ApplicationServer.java:179)
Exception in thread “main” java.io.IOException: No installed provider supports this key: (null)
at com.servoy.j2db.util.Settings.load(Settings.java:90)
at com.servoy.j2db.util.Settings.loadFromFile(Settings.java:50)
at com.servoy.j2db.server.ApplicationServer.main(ApplicationServer.java:179)

We have a system that has been running under SSL for several months. This system had a JKS keystore containing a SHA1withRSA key from InstantSSL which expired. I removed the old key and added a new key, also SHA1withRSA, also from InstantSSL. The keystore password, and the settings in servoy.properties did not change. The file permissions did not change. Keytool seems to be happy with the keystore and the new certificate. Yet, I get the error above. Looking at the j2db.util.Settings.load source code, it would seem to be a decryption problem.

Any help is welcomed. This is affecting an important system.

Thanks!

4

try to replace all the properties in the servoy.properties file that has a value that starts with “encrypted:” with there plain text password file.
Then load that file and save it again. That should then save all your passwords with then new keystore.

You have to close down servoy, reset the passwords, start servoy and then save the properties file.

5

Hi Johan,

Thanks for the reply. Yes, I ultimately did that, and it was a necessary step. However, in the end, I don’t believe that generated the initial error. I believe the keystore generation was handled incorrectly, thus causing a skew between the initial primary key and alias, the CSR, and the generated certificate and alias. Though keytool happily worked with the keystore and certs, and the password for opening it was valid, the keystore itself was not valid. This kept the crypto calls in j2db from opening the keystore, and generating the exception. Incidently, for posterity, the same exception as an incorrect password would.

Thanks,

Guerry