Authentication is not possible with the Java Client

Patrick

unread,

Dec 4, 2019, 1:55:12 PM12/4/19

to RavenDB - 2nd generation document database

Hey,

I am using the Java Client for the very first time. Currently I have a problem where I am not able to connect to my database from code.

```

KeyStore clientStore = KeyStore.getInstance("PKCS12");
clientStore.load(new FileInputStream("C:\\cert\\.pfx"), "".toCharArray());
DocumentStore store = new DocumentStore(
        new String[]{"https://.de"},
        ""
);

store.setCertificate(clientStore);
store.initialize();

```

I am using the .pfx file that I have imported into my user store in windows which I am using to authenticate in Browser. Using the cert I get this error:

```

Caused by: java.lang.IllegalStateException: Unable to configure ssl context: Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

Caused by: java.security.UnrecoverableKeyException: Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

Caused by: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

```

When I use a client certificate generated from the raven server it tells me to use .cer and .key file instead due to a bug.

```

Caused by: java.lang.IllegalStateException: Unable to find certificate for alias: '1'. If you generated certificate using RavenDB server, then it might be related to: https://github.com/dotnet/corefx/issues/30946. Please try to create Keystore using *.crt and *.key files instead of *.pfx.

```

The issue with that is that Java does not support the format the raven server generates the certificate I think. I really don't know how to authenticate using those files.

Best Regards

Patrick

Oren Eini (Ayende Rahien)

unread,

Dec 4, 2019, 3:33:08 PM12/4/19

to ravendb

Did you edit the file names?

C:\\cert\\.pfx

--
You received this message because you are subscribed to the Google Groups "RavenDB - 2nd generation document database" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ravendb+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/ravendb/fa280e3f-8e28-42c7-ada7-07d2826babc5%40googlegroups.com.

--

Oren Eini
CEO / Hibernating Rhinos LTD

Mobile: +972-52-548-6969

Sales: sa...@ravendb.net

Skype: ayenderahien

Support: sup...@ravendb.net

Oren Eini (Ayende Rahien)

unread,

Dec 4, 2019, 3:34:59 PM12/4/19

to ravendb

I checked out tests, and we use basically the same code:

https://github.com/ravendb/ravendb-jvm-client/blob/fb9519b888d46af6262041c3758fd2c01bfda024/src/test/java/net/ravendb/client/driver/RavenTestDriver.java#L80-L84

Iftah Ben Zaken

unread,

Dec 5, 2019, 4:03:11 AM12/5/19

to RavenDB - 2nd generation document database

Let's try to use the .crt and .key files instead of the provided .pfx to rule out a problem with the pfx file.

You can convert the .crt and .key files to .pem format:

cat cert.crt cert.key > cert.pem

Then import it like in this answer:

https://stackoverflow.com/questions/2138940/import-pem-into-java-key-store

Patrick Spiegel

unread,

Dec 5, 2019, 2:48:08 PM12/5/19

to rav...@googlegroups.com

I had no luck so far setting up authentification for Raven. But the issue in coreFx seems to be fixed. Is there any ETA when there will be a fixed certificate generation?

Holen Sie sich Outlook für iOS

Von: rav...@googlegroups.com im Auftrag von Iftah Ben Zaken <if...@ravendb.net>
Gesendet: Donnerstag, Dezember 5, 2019 10:03 AM
An: RavenDB - 2nd generation document database
Betreff: [RavenDB] Re: Authentication is not possible with the Java Client

--

You received this message because you are subscribed to the Google Groups "RavenDB - 2nd generation document database" group.
To unsubscribe from this group and stop receiving emails from it, send an email to ravendb+u...@googlegroups.com.

To view this discussion on the web visit https://groups.google.com/d/msgid/ravendb/48809663-7747-4790-bd4a-250f4816da53%40googlegroups.com.

Patrick

unread,

Dec 6, 2019, 1:14:24 PM12/6/19

to RavenDB - 2nd generation document database

So I have created a cacerts file using the command keytool -import -alias your-alias -keystore cacerts -file certificate.der

I have imported the generated file with the code I posted previously. Still no success yet.

The certificate has all permissions as you can see (I uploaded the cacerts file)

Caused by: net.ravendb.client.exceptions.security.AuthorizationException: Forbidden access to Runtime@https://database.de, GET https://database.de/topology?name=Runtime&first-topology-update

I now get a permission denied error.

Iftah Ben Zaken

unread,

Dec 8, 2019, 1:36:06 AM12/8/19

to RavenDB - 2nd generation document database

Can you paste the full stack trace of the error?

What is the RavenDB server version? Java client version?

I want to try to reproduce it.

Just to be clear, to make sure I understand correctly:

Are you able to authenticate with this certificate using the browser but not able to authenticate using the Java client?

Patrick

unread,

Dec 8, 2019, 2:15:29 AM12/8/19

to RavenDB - 2nd generation document database

Are you able to authenticate with this certificate using the browser but not able to authenticate using the Java client?

Yes, that is correct. For short term usage I have worked around by moving the application on the server running the application. But I'd like to access the web interface too.

I have tried to use the two .pfx files and I have used the cacerts. All three with different errors.

Thats the one I am using to authenticate.

And it is definetly the correct one.

Here is the stacktrace from my first post.

[08:10:04 WARN]: java.lang.IllegalStateException: Unable to configure ssl context: Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.http.RequestExecutor.createClient(RequestExecutor.java:1086)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.http.RequestExecutor.lambda$new$0(RequestExecutor.java:178)

[08:10:04 WARN]: at java.base/java.util.concurrent.ConcurrentHashMap.computeIfAbsent(ConcurrentHashMap.java:1705)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.http.RequestExecutor.<init>(RequestExecutor.java:178)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.http.RequestExecutor.create(RequestExecutor.java:182)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.documents.DocumentStore.getRequestExecutor(DocumentStore.java:183)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.documents.operations.MaintenanceOperationExecutor.getRequestExecutor(MaintenanceOperationExecutor.java:32)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.documents.operations.MaintenanceOperationExecutor.send(MaintenanceOperationExecutor.java:61)

[08:10:04 WARN]: at de.soulcraft.SoulcraftPlugIn.ensureDatabaseExists(SoulcraftPlugIn.java:139)

[08:10:04 WARN]: at de.soulcraft.SoulcraftPlugIn.createDocumentStore(SoulcraftPlugIn.java:122)

[08:10:04 WARN]: at de.soulcraft.SoulcraftPlugIn.onEnable(SoulcraftPlugIn.java:59)

[08:10:04 WARN]: at org.bukkit.plugin.java.JavaPlugin.setEnabled(JavaPlugin.java:263)

[08:10:04 WARN]: at org.bukkit.plugin.java.JavaPluginLoader.enablePlugin(JavaPluginLoader.java:338)

[08:10:04 WARN]: at org.bukkit.plugin.SimplePluginManager.enablePlugin(SimplePluginManager.java:420)

[08:10:04 WARN]: at org.bukkit.craftbukkit.v1_14_R1.CraftServer.enablePlugin(CraftServer.java:467)

[08:10:04 WARN]: at org.bukkit.craftbukkit.v1_14_R1.CraftServer.enablePlugins(CraftServer.java:381)

[08:10:04 WARN]: at net.minecraft.server.v1_14_R1.MinecraftServer.a(MinecraftServer.java:474)

[08:10:04 WARN]: at net.minecraft.server.v1_14_R1.DedicatedServer.init(DedicatedServer.java:290)

[08:10:04 WARN]: at net.minecraft.server.v1_14_R1.MinecraftServer.run(MinecraftServer.java:876)

[08:10:04 WARN]: at java.base/java.lang.Thread.run(Thread.java:835)

[08:10:04 WARN]: Caused by: java.security.UnrecoverableKeyException: Get Key failed: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

[08:10:04 WARN]: at java.base/sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:454)

[08:10:04 WARN]: at java.base/sun.security.util.KeyStoreDelegator.engineGetKey(KeyStoreDelegator.java:90)

[08:10:04 WARN]: at java.base/java.security.KeyStore.getKey(KeyStore.java:1050)

[08:10:04 WARN]: at java.base/sun.security.ssl.SunX509KeyManagerImpl.<init>(SunX509KeyManagerImpl.java:145)

[08:10:04 WARN]: at java.base/sun.security.ssl.KeyManagerFactoryImpl$SunX509.engineInit(KeyManagerFactoryImpl.java:70)

[08:10:04 WARN]: at java.base/javax.net.ssl.KeyManagerFactory.init(KeyManagerFactory.java:271)

[08:10:04 WARN]: at org.apache.http.ssl.SSLContextBuilder.loadKeyMaterial(SSLContextBuilder.java:302)

[08:10:04 WARN]: at org.apache.http.ssl.SSLContextBuilder.loadKeyMaterial(SSLContextBuilder.java:323)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.http.RequestExecutor.createSSLContext(RequestExecutor.java:1099)

[08:10:04 WARN]: at de.soulcraft.shaded.ravendb.http.RequestExecutor.createClient(RequestExecutor.java:1084)

[08:10:04 WARN]: ... 19 more

[08:10:04 WARN]: Caused by: javax.crypto.BadPaddingException: Given final block not properly padded. Such issues can arise if a bad key is used during decryption.

[08:10:04 WARN]: at java.base/com.sun.crypto.provider.CipherCore.unpad(CipherCore.java:975)

[08:10:04 WARN]: at java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:1056)

[08:10:04 WARN]: at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:853)

[08:10:04 WARN]: at java.base/com.sun.crypto.provider.PKCS12PBECipherCore.implDoFinal(PKCS12PBECipherCore.java:408)

[08:10:04 WARN]: at java.base/com.sun.crypto.provider.PKCS12PBECipherCore$PBEWithSHA1AndDESede.engineDoFinal(PKCS12PBECipherCore.java:440)

[08:10:04 WARN]: at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2208)

[08:10:04 WARN]: at java.base/sun.security.pkcs12.PKCS12KeyStore.lambda$engineGetKey$0(PKCS12KeyStore.java:398)

[08:10:04 WARN]: at java.base/sun.security.pkcs12.PKCS12KeyStore$RetryWithZero.run(PKCS12KeyStore.java:294)

[08:10:04 WARN]: at java.base/sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:392)

[08:10:04 WARN]: ... 28 more