users@glassfish.java.net

Re: Glassfish v2 won't start "UnrecoverableKeyException: Cannot recover key

From: <glassfish_at_javadesktop.org>
Date: Fri, 21 Sep 2007 09:03:25 PDT

I've tried to apply the WA given in

http://www.netbeans.org/issues/show_bug.cgi?id=116062

but, was able to make the GF v2 successful start after deleting and recreating the keys
(alias) with the masterpassword (adminadmin).

found useful information in:
http://www.thawte.com/ssl-digital-certificates/technical-support/keygen/tomcat_keygen.html

my keytool is from "1.5.0_10" but NB & GF are installed with jdk 1.6u1 with root.

# cd /opt/glassfish-v2-b58g/domains/domain1/config
# keytool -keypasswd -keystore keystore.jks -list
Enter keystore password: adminadmin

Keystore type: jks
Keystore provider: SUN

Your keystore contains 4 entries

xws-security-server, Sep 21, 2007, keyEntry,
Certificate fingerprint (MD5): E4:E3:A9:02:3C:B0:36:0C:C1:48:6E:0E:3E:5C:5E:84
wssip, Sep 21, 2007, keyEntry,
Certificate fingerprint (MD5): 1A:0E:E9:69:7D:D0:80:AD:5C:85:47:91:EB:0D:11:B1
xws-security-client, Sep 21, 2007, keyEntry,
Certificate fingerprint (MD5): D1:45:A1:A9:6D:A9:57:9F:69:35:E3:4C:63:B6:98:C9
s1as, Sep 21, 2007, keyEntry,
Certificate fingerprint (MD5): 8B:46:0A:71:B2:A5:77:10:FB:8A:75:6B:33:BB:2B:15


# keytool -keypasswd -keystore cacerts.jks -list
Enter keystore password: adminadmin

Keystore type: jks
Keystore provider: SUN

Your keystore contains 37 entries
...
xwss-certificate-authority
wssip,xws-security-server,xws-security-client
...

here tried changeit and adminadmin for the key but none worked.
# keytool -keypasswd -keystore keystore.jks -alias xws-security-server
Enter keystore password: adminadmin
Enter key password for <xws-security-server>
keytool error: java.security.UnrecoverableKeyException: Cannot recover key

Delete the keys from keystore.jks, each time give keystore password as adminadmin
# keytool -delete -alias xws-security-server -keystore keystore.jks
# keytool -delete -alias wssip -keystore keystore.jks
# keytool -delete -alias xws-security-client -keystore keystore.jks

Regenerate the keys, give keystore password as adminadmin, and enter
the information as shown below for each key:
# keytool -genkey -alias xws-security-server -keystore keystore.jks
# keytool -genkey -alias xws-security-client -keystore keystore.jks
# keytool -genkey -alias wssip -keystore keystore.jks

What is your first and last name?
 [Unknown]: fully qualified domain host name as host.france.sun.com
What is the name of your organizational unit?
 [Unknown]: SUN
What is the name of your organization?
 [Unknown]: SUN
What is the name of your City or Locality?
 [Unknown]: SCA
What is the name of your State or Province?
 [Unknown]: LA
What is the two-letter country code for this unit?
 [Unknown]: US
Is CN=<FQDN>, OU=SUN, O=SUN, L=SCA, ST=LA, C=US correct?
 [no]: yes

Enter key password for <wssip>
   (RETURN if same as keystore password):

Delete the keys from cacerts.jks, each time give keystore password: adminadmin
# keytool -delete -alias xws-security-server -keystore cacerts.jks
# keytool -delete -alias xws-security-client -keystore cacerts.jks
# keytool -delete -alias wssip -keystore cacerts.jks
# keytool -delete -alias xwss-certificate-authority -keystore cacerts.jks

Regenerate the keys in cacerts.jks as for keystore.jks
# keytool -genkey -alias xws-security-server -keystore cacerts.jks
# keytool -genkey -alias xws-security-client -keystore cacerts.jks
# keytool -genkey -alias wssip -keystore cacerts.jks
# keytool -genkey -alias xwss-certificate-authority -keystore cacerts.jks

as above.

In IDE-start GF v2 => ok
[Message sent by forum member 'nouar38' (nouar38)]

http://forums.java.net/jive/thread.jspa?messageID=236494