No available certificate or key corresponds to the SSL cipher suites which

Hi,
I have only recently started with SSL. So far I have managed to secure a Tomcat Server on my local area network with SSL. However when using the same keystore to start an Apache Derby Network Server with SSL I am getting the above mentioned error. Attached is the outpout a keytool -v -list provides for the keystore I am using. Can someone help in identifying what the problem is please? What I find confusing is that the same keystore works in conjunction with Tomcat while it does not in conjunction with Derby. Thanks
Keystore type: JKS
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: thmb
Creation date: Dec 11, 2010
Entry type: PrivateKeyEntry
Certificate chain length: 2
Certificate[1]:
Owner: EMAILADDRESS=x <at> t-online.de, CN=THMB, OU=IT, O=x, L=x, ST=x, C=DE
Issuer: EMAILADDRESS=x <at> t-online.de, CN=THMB CA, OU=IT, O=x, L=x, ST=x, C=DE
Serial number: 1
Valid from: Sat Dec 11 12:50:08 CET 2010 until: Sun Dec 11 12:50:08 CET 2011
Certificate fingerprints:
     MD5: A8:27:6E:B4:81:E0:6B:23:B4:A7:4C:13:4B:16:80:EC
     SHA1: B9:9F:2B:CA:03:40:00:A0:4B:03:A0:CD:E7:E7:8F:61:9D:B9:26:42
     Signature algorithm name: SHA1withRSA
     Version: 3
Certificate[2]:
Owner: EMAILADDRESS=x <at> t-online.de, CN=THMB CA, OU=IT, O=x, L=x, ST=x, C=DE
Issuer: EMAILADDRESS=x <at> t-online.de, CN=THMB CA, OU=IT, O=x, L=x, ST=x, C=DE
Serial number: 95e743a14724966f
Valid from: Sat Dec 11 12:44:17 CET 2010 until: Tue Dec 08 12:44:17 CET 2020
Certificate fingerprints:
     MD5: 8D:D4:44:B6:37:EC:51:CD:25:85:E8:F1:0A:A9:30:2D
     SHA1: E7:04:DB:FC:DA:16:FE:46:88:56:C5:0B:65:D5:0F:DF:AC:0E:A1:D7
     Signature algorithm name: SHA1withRSA
     Version: 3
Edited by: user13506192 on 22.12.2010 00:08
I have now tried to run the Derby Server on Windows with this keystore. On this platform I am getting the following exception:
java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: com.sun.net.internal.ssl.DefaultSSLContextImpl)
Can someone please help? Should more information be required to analyse what is causing this, please let me know.
Thanks a lot in advance.
Regards
Thomas

Not sure what imports are used in the programs as both the server and the client program are standard software, i.e. the Apache Derby Network Server and the IJ SQL command line client that comes with it.
I request/enforce SSL use by supplying command line parameters at server (/ client) start up, i.e.
java -jar -Djavax.net.ssl.keyStore=myServerKeyStore.jks -Djavax.net.ssl.keyStorePassword=xxx -Djavax.net.ssl.trustStore=myServerTrustStore.jks -Djavax.net.ssl.trustStorePassword=xxx derbyrun.jar server start -ssl paarAuthentication
java -jar -Djavax.net.ssl.keyStore=myClientKeyStore.jks -Djavax.net.ssl.keyStorePassword=xxx -Djavax.net.ssl.trustStore=myClientTrustStore.jks -Djavax.net.ssl.trustStorePassword=xxx derbyrun.jar ij
After having recreated my certificates and keystores the exception which originally lead to this post are no longer given and the server and the client program can now properly be started. So not sure what the problem was, but may be no need to further investigate as the scenario now works.
Thanks & Regards
Thomas

Similar Messages

  • How to add a Cipher Suite using RSA 1024 algorithm to the 'SSL Cipher Suite Order' GPO

    Following a VA test the Default Domain GPO has been set to enable the SSL Cipher Suite Order.  Following the change Symantec Endpoint Protection Manager doesn't work properly as the the Home, Monitors and Reports pages are blank and an Schannel error is
    logged in the SEPM server's event log.
    I have spoken to Symantec and I have been told that we need to allow the RSA 1024 bit algorithm but they can't tell me which cipher suite this would be.  I have looked in the GPO setting and can't see an RSA 1024 suite but have found some in this article:
    http://tools.ietf.org/html/draft-ietf-tls-56-bit-ciphersuites-01
    I want to know how to add an additional cipher suite into the setting safely.  Am I able to just add the suite into the GPO setting (eg TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA) or do I need to do anything else beforehand?
    If anyone has any advice regarding this or cipher suite orders and troubleshooting SSL problems it would be much appreciated,
    Thanks
    Chris

    Hi Chris,
    Based on my research, RSA_EXPORT1024_DES_CBC_SHA is a previous cipher suite, which is supported, you can enable it use
    SSL Cipher Suite Order policy setting under Administrative Templates\Network\SSL Configuration Settings.
    More information for you:
    TLS/SSL Cryptographic Enhancements
    http://technet.microsoft.com/en-us/library/cc766285(v=WS.10).aspx
    Best Regards,
    Amy

  • SSL Server: No available certificate or key.... exception

    Hi,
    I want to create a very simple SSL Server for testing purposes.
    I have searched google and these forums for an answer, but anything that I found did not help (will say below what I tried).
    Here is my code:
    import java.io.IOException;
    import javax.net.ssl.SSLServerSocket;
    import javax.net.ssl.SSLServerSocketFactory;
    public class Server {
         private int port = 25000;
         private SSLServerSocketFactory factory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
         public Server() {          
              try {
                   SSLServerSocket socket = (SSLServerSocket) factory.createServerSocket(port);
                   Echo echo = new Echo(socket);
                   Thread t = new Thread(echo);
                   t.start();
              } catch (IOException e) {
                   e.printStackTrace();
         public static void main(String[] args) {
              new Server();
    }and
    import java.io.BufferedReader;
    import java.io.BufferedWriter;
    import java.io.IOException;
    import java.io.InputStream;
    import java.io.InputStreamReader;
    import java.io.OutputStream;
    import java.io.OutputStreamWriter;
    import javax.net.ssl.SSLServerSocket;
    import javax.net.ssl.SSLSocket;
    public class Echo implements Runnable {
         SSLServerSocket socket;
         public Echo(SSLServerSocket socket) {
              this.socket = socket;
         @Override
         public void run() {
              try {
                   SSLSocket connectedSocket = (SSLSocket) socket.accept();
                   // creating the streams
                   InputStream inputstream = connectedSocket.getInputStream();
                InputStreamReader inputstreamreader = new InputStreamReader(inputstream);
                BufferedReader in = new BufferedReader(inputstreamreader);
                OutputStream outputstream = connectedSocket.getOutputStream();
                OutputStreamWriter outputstreamwriter = new OutputStreamWriter(outputstream);
                BufferedWriter out = new BufferedWriter(outputstreamwriter);
                // echoing...
                String input = "";
                while (input.compareTo("abort") != 0) {
                     input = in.readLine();
                     System.out.println("Server received message: " + input);
                     out.write(input + " " + input);
                     out.flush();
              } catch (IOException e) {
                   e.printStackTrace();
    }When I run the code, I get
    javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled.
         at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.checkEnabledSuites(Unknown Source)
         at com.sun.net.ssl.internal.ssl.SSLServerSocketImpl.accept(Unknown Source)
         at Echo.run(Echo.java:24)
    Line 24 in Echo.java is SSLSocket connectedSocket = (SSLSocket) socket.accept();
    I have created a keystore according to the JSSE documentation: http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore
    I have tried relative and full pathnames for javax.net.ssl.keyStore, as well as copying the keystore right into the directory with the class-files
    I have tried to set javax.net.ssl.keyStore (and javax.net.ssl.keyStorePassword) via the command line's -D switch and via System.setProperty
    After all that failed, I even tried to import the generated public key into the server's keystore as well
    No matter what I did, I always get above exception upon calling accept().
    I am using Java 6 (Java(TM) SE Runtime Environment (build 1.6.0_17-b04)) on Windows 7 64 Bit
    Any help is appreciated.

    I have created a keystore according to the JSSE documentation: http://java.sun.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore
    Are you sure you created a keystore with an RSA keypair, and not a DSA keypair?

  • Why, when I successfully connect to Server 2012 Essentials R2 via Anywhere Access does the Remote Desktop Connection use the self signed certificate for RDP instead of the SSL certificate I installed when I set up access anywhere?

    Scenario:
    Windows Server 2012 R2 Essentials
    I purchased an SSL Cert from GoDaddy and I managed (after some challenges) to set up Anywhere access to use that new SSL Cert. I to rebooted the server and I am able to login to Anywhere Access vis https (using the SSL certificate) from PC, Mac and iOS.
    So far so good.
    The problem I am having is that when I click to launch a remote desktop connection to the server RDP connection wants to use the self signed SSL certificate of the server rather than the SSL Certificate I installed into Anywhere Access. As a result, I get
    a security warning like this: "The identity of the remote computer cannot be verified. Do you want to connect anyway?"
    The name in the certificate appears as ACME-SERVER.ACMEDOMAIN.local  instead of the SSL Certificate I installed, which is
    remote.acmedomain.com
    If I lick to accept, RDP does work fine, it;s just using a self signed certificate. I want it to use the trusted certificate that I purchased and installed.
    My guess is that there must be an additional step to tell Anywhere Access that when it generates the RDP session that it should use the cert? OR, is this just how it works?

    Because....
    the server does not have a 'trusted' certificate assigned to it.
    Only the RDP Gateway has the trusted certificate for the external name.
    If you want to remove that error, you have to do one of the following:
    Make sure your domain uses a public top level domaim, and get a public trusted certificate for your server.
    So, something like,
    server.domain.publicdomain.com
    Or,
    Install that certificate on your remote computer so it is trusted.
    Robert Pearman SBS MVP
    itauthority.co.uk |
    Title(Required)
    Facebook |
    Twitter |
    Linked in |
    Google+

  • Trying to set up encrypted mails but I'm confused about certificates and keys

    Hello all,
    My first foray into encrypted emails and I'm already confused! To begin with, I'm trying to exchange mails with one other person, who I believe uses Outlook. So far:
    He's sent me his certificate (although I thought I would receive his public key) which is a file called smime.p7m. I don't know what to do with this.
    I've successfully followed the instructions at https://support.mozilla.org/en-US/kb/digitally-signing-and-encrypting-messages. When I start a new mail, I can either go to the Enigmail menu and switch on encryption / digital signing and it seems fine, or I can go to the dropdown on the S/MIME button and it says "You need to set up one or more personal certificates before you can use this security feature." Are these two different ways of doing the same thing (in which case I'll use the one that works!) or not?
    As you can see, I'm getting confused between keys and certificates! If some kind person could take a minute to explain what my next steps are, that would be much appreciated. I couldn't find anything on the Thunderbird support pages, though I know I need to send him my public key.
    Thanks in advance.
    Stuart.

    Stuart8, good find, that article.
    I found the main disincentive to using the built-in S/MIME capability is that it's not immediately obvious where to get your certificate and keys. Most providers want $$$ for them, which is natural enough if they are actually going to validate you in some way. I did at one time have a Thawte certificate and even enough WOT vouches to be a low-grade WOT Attorney.
    Once you have your key, it's a bit of a pfaff to install it into Thunderbird. You'll probably find that S/MIME is the default in business correspondence, since many businesses operate their own mail servers, ftp servers and so on and probably have an arrangement to generate self-issued certificates or to buy them on a commercial basis from a CA.
    Enigmail/OpenPGP doesn't require any financial outlay on your part, but is harder to get your keys properly validated since there's not much of a formal WOT nor a reliable central registry. You generate your own keys and it's pretty much all based on mutual trust.
    Since the two systems are incompatible, you need to have set up the same as whatever your correspondent is using.
    I suspect that you have discovered that it's a two-way process. In order for a correspondent to send you an encrypted message, you must both be using the same system, and he must have your public key to encrypt his message, and you'll need his in order to reply with encryption. So yes, he needs to send you his public key for you to send to him, but what he sends to you needs YOUR public key.
    Obviously, signing messages is a useful halfway house. I believe that you sign with your private key, and the recipient will have to download your public key to validate your signature. Whilst a signature doesn't safeguard your privacy, it goes some way to proving that the message came from who it says it came from and that it hasn't been altered in transit. (I really can't understand why banks, lawyers, insurance companies haven't picked up on these encryption and signing schemes. Perhaps they actually prefer all those awful phone calls where you need to struggle to recall supposedly unforgettable names and dates! ;-) )
    In practice, I find that if you sign a message to an outfit who don't know what to do with it, their numpty anti-virus system will probably barf on the signature which it thinks is executable code and therefore must be a virus or worm. :-(

  • SChannel error- The SSL server credential's certificate does not have a private key information property attached to it.

    We have a public SSL certificate that allows for Active Directory sync with LDAPS on port 636 with our email smart host. This was working fine and suddenly stopped working and we are now getting SChannel errors Event ID 36869. There were no changes made
    to the Exchange server, the firewall or the DC which holds the certificate. I have run a new certreq from the DC and then re-keyed the public SSL certificate and re-installed 3 times but the error does not go away and AD Sync with the vendor
    fails. When I run LDP.exe the connection on port 636 fails with "cannot open connection" and the system event log throws the S Channel event 36869 "The SSL server credential's certificate does
    not have a private key information property attached to it"  There is no software firewall set on the DC. When I run Certutil -VerifyStore MY  it shows the current certificates as well as the revoked and expired certificates
    correctly. Certificate 0 is the public cert and is listed with Server and Client authentication, the FQDN of the server is correct and "Certificate is Valid" is listed. The private cert is Certificate 1 and has server and client authentication, the
    FQDN is correct, Private key is not exportable and it ends with Certificate is Valid. I do not see a point in re-keying the cert again until I figure out what the root of the problem is. I have read in some forums that the private cert should not be set to
    expire after the public cert but that does not make a lot of sense when in a situation like this the private cert is of course newer than the public. In fact it is too early to renew the public cert. I have been troubleshooting this for a few days and at this
    point I would have to drop my AD sync with the vendor to LDAP in order to add new users. I do not want to do that for obvious reasons and I do not want to have our spam filtering and email archive service running without Directory sync. Any help would be greatly
    appreciated.

    Hi,
    Have you tried this?
    How to assign a private key to a new certificate after you use the Certificates snap-in to delete the original certificate in Internet Information Services
    http://support.microsoft.com/kb/889651
    Best Regards,
    Amy

  • My Wireless mac keypad has stopped properly working. The keys sometime do not correspond to the result, or a a simultaneous duel actio, for example when the delete button is pressed the. Ursor does go backwards, but it also turns the sound up. Any ideas?

    My Wireless mac keypad has stopped properly working. The keys sometime do not correspond to the result, or a a simultaneous duel actio, for example when the delete button is pressed the. Ursor does go backwards, but it also turns the sound up. The keyboard is properly connected to the computer, and the battery life is up in the nineties.
    Help please !!!!

    Hi, thankyou for your response. Can I just confirm that you mean turning the computer on and off again, or re-booting the whole system. If it is the first I have already turned the system on and off, with no luck.
    Regards

  • My keyboard on my Apple Mac Book doesn't correspond to the control keys

    I Press the keys on my Apple Mac book keyboard and the characters that are produced do not correspond to what is shown on the keys

    Casminfromvik wrote:
    I Press the keys on my Apple Mac book keyboard and the characters that are produced do not correspond to what is shown on the keys
    If you tell us what country you are in and give an example of keys that produce the wrong thing, we can probably tell you which input source you need to activate.

  • New install of SQL 2014 Std MSDN. Get "The SQL Server product key is not valid. To proceed, re-enter the product key values from the Certificate of Authenticity (COA) or SQL Server packaging."

    Trying to install a new version of SQL 2014 Std 64 or x86. Installing on Windows 8.1Pro 64bit machine.
    I get:
    "TITLE: SQL Server Setup failure.
    SQL Server Setup has encountered the following error:
    The SQL Server product key is not valid. To proceed, re-enter the product key values from the Certificate of Authenticity (COA) or SQL Server packaging.
    Error code 0x858C0017."
    I looked at the summary log and that is the only error.
    I made sure there were no other instances of SQL on this machine. Uninstalled all VS2013 and sql instances just in case. IF there is somewhere to check if a previous version or license is causing the issue, i would be glad to check.
    Any help would be appreciated.

    Hi,
    Please read this thread with similar issue
    http://social.msdn.microsoft.com/Forums/sqlserver/en-US/bdd94577-515c-49fa-be44-008eacece057/installing-sql-server-2012-on-a-new-vm-error-code-0x858c0017?forum=sqlsetupandupgrade
    Please mark this reply as answer if it solved your issue or vote as helpful if it helped so that other forum members can benefit from it
    My Technet Articles

  • How to Provide the Certificate Generation key while configuring WorkFlow Manager 1.0

    Hi,
    I am new to Workflow manager.I am configuring it in a SharePoint Farm with Allow Workflow Management over Http on this computer option.
    Its asking for Certificate Generation key for joining to the Farm.
    Could anyone help me how to get the Certificate Generation key.
    Please advice
    Thanks, Vijay Arul Lourdu

    we forgot the auto-generated Certificate
    Generation Key. Can you tell us the detail instructions to find it? Thanks.

  • Case insensitive search on subject name to retrieve a certificate from key chain.

    Hi,
    I need to find the client certificate from key chain based on the subject name.
    Currently, I am using attribute kSecLabelItemAttr and providing the subject name to create the attribute list for the API "SecKeychainSearchCreateFromAttributes" which gives the certificate.
    Problem: This certificate search is case sensitive for the subject name.
    Question: Is there a way to do a case insensitive search on a subject name to get a certificate on snow leopard? I found the attribute "kSecMatchCaseInsensitive" which works with key "kSecClassCertificate" in the API "SecItemCopyMatching", but the key kSecClassCertificate is only available for 10.7 and later.
    https://developer.apple.com/library/mac/#documentation/Security/Reference/keycha inservices/Reference/reference.html#//apple_ref/doc/uid/TP30000898-CH4g-SW7
    Any help is highly appreciated.
    Thanks!

    I think there is issue with your logon trigger :
    "IF ((USER = 'MyAppUSER') OR(USER = 'MyAppREPORTINGUSER')) THEN"
    it should be :
    IF UPPER(USER) = 'MYAPPUSER' OR UPPER(USER) = 'MYAPPREPORTINGUSER' THEN
    because user name stored in Upper case. Check and try.
    HTH
    Girish Sharma

  • Display key in the selection screen and Key & Text in the report

    Hi,
    For the infoobject in the query,
    In the variable selection screen When i want to select any value it should display only key, and in the report i want to display key and text of that infoobject.
    Is it possible?
    Thanks
    Rani

    Hi
    Display As
    Here you determine whether and in what format the individual characteristic values of the characteristic are presented:
    ·        (Standard): The standard display type for characteristic values corresponds to the setting in InfoObject maintenance under Tab Page: Business Explorer.
    ·        No Display: The characteristic display is hidden. This function is useful, for example, with the currency/unit characteristic as the currencies are also shown in the key figures.
    ·        Key and Text: The characteristic values are displayed by their technical key and text.
    ·        Text: The characteristic values are displayed by their text.
    ·        Key: The characteristic values are displayed by their technical key.
    ·        Text and Key: The characteristic values are displayed by their text and technical key.
    In the dropdown box below, you can select the type of text you want to use if you set a display type that contains text. The following options are available:
    ·        Standard: The shortest available text for the characteristic values is used as the text.
    ·        Short text: The short text for the characteristic values is used as the text.
    ·        Long text: The long text for the characteristic values is used as the text.
    ·        Medium text: The medium text for the characteristic values is used as the text.

  • JPA: Availability of generated keys

    Hi
    If I create an entity which has an auto-generated key and call the persist method of the entity manager, can I then assume that the key is immediately available in the entity or only after a subsequent call of the flush method?
    In general, the synchronization with the datasource may be delayed by the application server until commit time of the associated transaction. But the immediate availability of auto-generated keys can be crucial in session beans with container-managed transactions if the corresponding creation methods want to make use of the keys.
    Unfortunately, I couldn't find any definitive answer in the JPA specification.
    Thanks for any help, Stephan

    I must be missing something. I'm calling persist on my entity but i'm not getting a value for my primary key. Then when I go to put it in a relationship the whole thing dies. I even tried using flush and that didn't help either.
    I'm essentially doing
    beginTransaction();
    EntityA a = new EntityA();
    persist(a);
    EntityB b = new EntityB();
    b.setA(a);
    persist(b);
    commit();Is there some annotation I need so that the primary key is set on persist ?

  • Certificates from CA's and the keystore

    Hello all,
    I have tracked through a series of forum topics that seem to ask similar questions and receive similar answers regarding both signing jars and using the certificates for communications.
    Forgive the overlap, but I have a slightly related question.
    Is the only way to use the keystore (and keytool to manage the keystore) when signing jars by generating a key pair at the start? Is that why all the examples always start with that option, and none of them start from a scenario that is different?
    Is it possible to come in with an existing CA signed certificate, and the CA's root certificate and sign the jars? Would that setup work for communication at all?
    I have tried this for signing, and both certificates end up as trustedCertEntries within the keystore, but this does not allow the signing of jars since there is no keyEntry. The error message is:
    "jarsigner: Certificate chain not found for: and. and must reference a valid KeyStore key entry containing a private key and corresponding public key certificate chain."
    I have not tried it for communication.
    Is there some other alternative to generating the key-pair directly in the keystore, exporting the csr, and getting the CA to sign and reply to that csr?
    My question stems from a customer wanting to only provide the certificate they want to use, and maybe the CA root cert if necessary.
    Thanks much in advance!
    Edited by: gennadius on Dec 19, 2007 3:52 PM

    Is it possible to come in with an existing CA signed certificateBut this isn't the beginning of the process.
    A signed certificate results from a Certificate Signing Request (CSR) being submitted to a CA.
    A CSR is generated from a private key/public key pair. But it only contains the public key. So you have to get it signed and then re-import it to the same keystore which originally contained the private key, to complete the association between the signed cert and the private key.
    The signed certicificate is a public authentication that the owner of this certificate uniquely owns this public key, which corresponds to a private key. Without the private key the entire exercise can't get started.
    So unless you can find a way to get the private key from whereever it was when the CSR process was started, just importing the signed certificate doesn't give you a prioviate key. Without a private key, you can't sign things, decrypt, be an SSL authenticated endpoint, etc.
    And if you could cart private keys around like that, they wouldn't be private, so the entire point of PKI is lost.

  • Any Function module or BAPIs are available to get scheme name for the inter

    I have internal order no value in table  AUFK-AUFNR ,  and the internal order corresponding Scheme value is available in IMPR-PRNAM . Now I want to inner join both the tables to extract the data , but there is no common field . Is there any Function module or BAPIs are available to get scheme name for the internal orders?

    look at DB-VIEW  "V_IVP_OR".
    Regards,
    Laurent

Maybe you are looking for

  • Swindled, lied too, and lack of customer care!

    Back in Auguest, we qualified for "new" phones.  We've been customers for over 10 years.  We visited a local Verison store in Pataskala Ohio.  We were looking to get into the "smart phones".  We saw several, some very nice and EXPENSIVE ones, a few t

  • IMovie HD (6) themes won't finish rendering, thus can't use themes!

    Question: iMovie HD (6) themes will not load into the timeline! I select the theme, etc., then when I click apply, it acts like it is rendering the theme, but then I hear my MacBook's "problem" tone and the rendering theme disappears. Can anyone tell

  • ISE + Selfregistering

    Hi, i have a wireless network with peap authentication and some VIP users on the network. Now i want to "pimp" that SSID with a self-service and want to make use of the My Devices Portal if this is possible. 1. User gets permission to access the wire

  • Flash Player 9.0.124 MSI Problems

    I've downloaded the 9.0.124 version of Adobe Flash Player (both Active_X & Plugin versions), but am not able to put them into a Group Policy Object. When I try to include them in the GPO, I receive the message "Add operation failed. Unable to extract

  • Functionality Of MEB

    Hello, I would like to know the Functionality Of MEB(Maintenance Event Buider) with some business process. Regards, Rakesh