#823590 ca-certificates: Having changed the keystore password (for server's security reaosons), update crashes

Package:
ca-certificates-java
Source:
ca-certificates-java
Submitter:
Guillaume Muller
Date:
2021-02-19 23:33:05 UTC
Severity:
wishlist
#823590#5
Date:
2016-05-06 09:40:03 UTC
From:
To:
Dear Maintainer,

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
Changed password of java's keystore

   * What exactly did you do (or not do) that was effective (or
     ineffective)?
apt-get install ca-certificates

   * What was the outcome of this action?

org.debian.security.InvalidKeystorePasswordException: Cannot open Java keystore. Is the password correct?
        at org.debian.security.KeyStoreHandler.load(KeyStoreHandler.java:68)
        at org.debian.security.KeyStoreHandler.<init>(KeyStoreHandler.java:52)
        at org.debian.security.UpdateCertificates.<init>(UpdateCertificates.java:65)
        at org.debian.security.UpdateCertificates.main(UpdateCertificates.java:51)
Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
        at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:772)
        at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:55)
        at java.security.KeyStore.load(KeyStore.java:1214)
        at org.debian.security.KeyStoreHandler.load(KeyStoreHandler.java:66)
        ... 3 more
Caused by: java.security.UnrecoverableKeyException: Password verification failed
        at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:770)
        ... 6 more
E: /etc/ca-certificates/update.d/jks-keystore exited with code 1.

   * What outcome did you expect instead?

That my password is asked...

*** End of the template - remove these template lines ***
#823590#16
Date:
2018-05-04 20:58:16 UTC
From:
To:
Hi Guillaume,

Why are you changing the password of a keystore holding the public keys
of the certification authorities? There is nothing secret inside.

Emmanuel Bourg
#823590#19
Date:
2018-05-04 20:58:16 UTC
From:
To:
Hi Guillaume,

Why are you changing the password of a keystore holding the public keys
of the certification authorities? There is nothing secret inside.

Emmanuel Bourg
#823590#24
Date:
2019-12-17 15:11:03 UTC
From:
To:
Penerima yang dihormati,

anda mendapat lampiran ini dengan pdf yang mengandungi maklumat yang sangat
serius, penting dan berharga. Ia mengenai tema bahawa semua orang di planet
ini adalah sebahagian daripada. Jadi, cadangan yang hangat untuk mengambil
sedikit masa dan membaca artikel penting ini.


Selamat tinggal
#823590#27
Date:
2019-12-17 15:11:03 UTC
From:
To:
Penerima yang dihormati,

anda mendapat lampiran ini dengan pdf yang mengandungi maklumat yang sangat
serius, penting dan berharga. Ia mengenai tema bahawa semua orang di planet
ini adalah sebahagian daripada. Jadi, cadangan yang hangat untuk mengambil
sedikit masa dan membaca artikel penting ini.


Selamat tinggal
#823590#34
Date:
2020-04-02 13:27:25 UTC
From:
To:
tags 823590 - important + wishlist
found 823590 20190405
thanks

Hi there,

Not speaking for Guillaume, but the Debian package explicitly supports
this configuration, for more than 10 years now:
```
root@harlock:~# zless /usr/share/doc/ca-certificates-java/changelog.gz
[...]
ca-certificates-java (20081022) unstable; urgency=low

  * debian/jks-keystore.hook:
    - Don't stop after first error during the update. LP: #244412.
      Closes: #489748.
    - Call keytool with -noprompt.
  * On initial install, add locally added certificates. LP: #244410.
    Closes: #489748.
  * Install /etc/default/cacerts to set options:
    - storepass, holding the password for the keystore.
    - updates, to enable/disable updates of the keystore.
  * Only use the keytool command from OpenJDK or Sun Java. Closes: #496587.