FWD » Core Development » Runtime Infrastructure

As reported by Constantin:

I get a "certificate_unknown" error when trying to terminate the server via "-k".

To confirm, I started a server session:

P2J_HOME=/home/ges/projects/1811q/ ./server.sh -a ../../uast/build/lib/testcases.jar net:connection:secure=true net:serr:secure_port=3334

Then I tried to simply check its status:

P2J_HOME=/home/ges/projects/1811q/ ./server.sh -s net:connection:secure=true net:server:secure_port=3334

Error connecting to server
javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.SSLSocketImpl.checkEOF(SSLSocketImpl.java:1508)
        at sun.security.ssl.SSLSocketImpl.checkWrite(SSLSocketImpl.java:1520)
        at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:70)
        at java.io.ObjectOutputStream$BlockDataOutputStream.drain(ObjectOutputStream.java:1876)
        at java.io.ObjectOutputStream$BlockDataOutputStream.setBlockDataMode(ObjectOutputStream.java:1785)
        at java.io.ObjectOutputStream.<init>(ObjectOutputStream.java:247)
        at com.goldencode.p2j.net.NetSocket.<init>(NetSocket.java:79)
        at com.goldencode.p2j.net.SessionManager.createQueue(SessionManager.java:1036)
        at com.goldencode.p2j.net.LeafSessionManager.connectDirect(LeafSessionManager.java:201)
        at com.goldencode.p2j.main.ServerDriver.connect(ServerDriver.java:728)
        at com.goldencode.p2j.main.ServerDriver.statusWorker(ServerDriver.java:629)
        at com.goldencode.p2j.main.ServerDriver.status(ServerDriver.java:500)
        at com.goldencode.p2j.main.ServerDriver.start(ServerDriver.java:420)
        at com.goldencode.p2j.main.CommonDriver.process(CommonDriver.java:398)
        at com.goldencode.p2j.main.ServerDriver.process(ServerDriver.java:146)
        at com.goldencode.p2j.main.ServerDriver.main(ServerDriver.java:758)
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1916)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:279)
        at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:273)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1469)
        at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:213)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:901)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:837)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1035)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1344)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1371)
        at sun.security.ssl.SSLSocketImpl.getSession(SSLSocketImpl.java:2233)
        at com.goldencode.p2j.net.NetSocket.<init>(NetSocket.java:75)
        ... 9 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)
        at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
        at sun.security.validator.Validator.validate(Validator.java:260)
        at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1451)
        ... 17 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
        at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
        at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
        ... 23 more
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@

...

^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@[09/08/2015 12:40:56 EDT] (Incoming.run():WARNING) {Incoming SSL Connector} initialization failure
javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
        at sun.security.ssl.SSLSocketImpl.checkEOF(SSLSocketImpl.java:1508)
        at sun.security.ssl.SSLSocketImpl.checkWrite(SSLSocketImpl.java:1520)
        at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:70)
        at java.io.ObjectOutputStream$BlockDataOutputStream.drain(ObjectOutputStream.java:1876)
        at java.io.ObjectOutputStream$BlockDataOutputStream.setBlockDataMode(ObjectOutputStream.java:1785)
        at java.io.ObjectOutputStream.<init>(ObjectOutputStream.java:247)
        at com.goldencode.p2j.net.NetSocket.<init>(NetSocket.java:79)
        at com.goldencode.p2j.net.RouterSessionManager$Incoming.run(RouterSessionManager.java:1389)
        at java.lang.Thread.run(Thread.java:745)
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
        at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1991)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1098)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1344)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1371)
        at sun.security.ssl.SSLSocketImpl.getSession(SSLSocketImpl.java:2233)
        at com.goldencode.p2j.net.NetSocket.<init>(NetSocket.java:75)
        at com.goldencode.p2j.net.RouterSessionManager$Incoming.run(RouterSessionManager.java:1389)
        at java.lang.Thread.run(Thread.java:745)

The same output is seen when trying to kill the server.

Just moving a reminder out of my email and into here:

Greg Shah wrote (in an email):

The key is that the ServerDriver can be used for more than just starting the server. It can be used with a -k to kill the server, a -s to check the status and a -w to wait until the server is initialized. All of these are exposed in our "standard" server.sh.

The status codes that can be returned from these operations include:

RUNNING 0
TIMEOUT 1
UNKNOWN 2
STOPPED 3

At this time, we've broken something in the ServerDriver and/or standard configuration for our test environments. We can't currently use any of these modes. I think this is not going to work for you until we fix #2693, but I haven't specifically tested the customer's server project.

So, once this is fixed we'll be able to replace our arbitrary long wait on starting a server with a status check loop.