http://coldfusion.com logo
Join Slack
Powered by
Hi Team, I am trying to run command box test from ...
# cfml-general
r
Hi Team, I am trying to run command box test from docker container and it's throwing below error. Did a bit of research that points to some cert issue while loading from trustStore.But not able to find the root cause and fix it. Can any1 please help with this one. I checked that the certs are getting loaded from 
-<http://Djavax.net|Djavax.net>.ssl.trustStore=/opt/coldfusion/jre/lib/security/cacerts
and these certs are present at the required location
Copy code
Error executing tests:Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
=====================================================================================

root@29f6b39bf07c:/etc/linode# ls -l /opt/coldfusion/jre/lib/security/cacerts
-rwxrwxrwx 1 cfusion root 114607 Mar  6 12:35 /opt/coldfusion/jre/lib/security/cacerts
b
@Roshani Singh empty trust anchor usually means your cacerts (trust store) file is empty or corrupt
Which Docker container?
I've run into this with minibox before
r
Hi @bdw429s, I am using docker version and the container is Linode specfic.
Copy code
docker --version
Docker version 20.10.23, build 7155243
How can we check if the certs is corrupt? It doesn't seems empty.
b
@Roshani Singh I wasn't asking about the Docker version. I was asking the name of the image
e.g.
Copy code
docker run -it foundeo/minibox sh
in this example, the image name is 
foundeo/minibox
How can we check if the certs is corrupt?
When I've seen this, the actual file was 
0KB
But you can use openssl to test it
r
This is the docker image which is Linode specfic:
Copy code
devenv-lindev-1
The file is having some size so it's not empty.As u said I will check how can we test it with openssl to see if it's corrupt or not.
Output of openssl verify: 
error in verify
Copy code
OpenSSL> verify /opt/coldfusion/jre/lib/security/cacerts
unable to load certificate
140055175713984:error:0909006C:PEM routines:get_name:no start line:../crypto/pem/pem_lib.c:745:Expecting: TRUSTED CERTIFICATE
error in verify
b
I'm not familiar with that error message, but it would seem to imply your trust store is corrupt
Also, I see you're trying to use the JRE's trust store. Did you get errors before when using Lucee's baked in cacerts file?
Is there a reason you switched to the JRE's cacerts file?
I'm also not sure if 
openssl verify
is the command you want either. From the docs, it appears to be for verifying a single cert, not a store
r
The reason why checked for JRE certs is because when I do ps java it showed that the trustStore is using is this one: 
<http://Djavax.net|Djavax.net>.ssl.trustStore=/opt/coldfusion/jre/lib/security/cacerts
Copy code
cfusion    232     1  0 Mar20 ?        00:13:13 /opt/jdk-11.0.10/bin/java -classpath /opt/ColdFusion/cfusion/bin/../runtime/bin/tomcat-juli.jar:/opt/ColdFusion/cfusion/bin/../bin/cf-bootstrap.jar:/opt/ColdFusion/cfusion/bin/../bin/cf-startup.jar:/opt/ColdFusion/cfusion/bin/../runtime/lib/*:/opt/ColdFusion/cfusion/bin/../lib/oosdk/lib:/opt/ColdFusion/cfusion/bin/../lib/oosdk/lib/*:/opt/ColdFusion/cfusion/bin/../lib/oosdk/classes:/opt/ColdFusion/cfusion/bin/../lib/oosdk/classes/*:/virtual/linode.com/www/lib/javaload:/virtual/linode.com/www/lib/javaload/*:/usr/share/java:/usr/share/java/*: -server -Djava.awt.headless=true -Xms256m -Xmx1024m --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED --add-opens=java.base/java.nio=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/sun.util.cldr=ALL-UNNAMED --add-opens=java.base/sun.util.locale.provider=ALL-UNNAMED -Djdk.attach.allowAttachSelf=true -Dcoldfusion.home=/opt/ColdFusion/cfusion/bin/.. -Djava.security.egd=/dev/urandom -Duser.language=en -Dcoldfusion.rootDir=/opt/ColdFusion/cfusion/bin/.. -Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=true -Dcoldfusion.libPath=/opt/ColdFusion/cfusion/bin/../lib -Dorg.apache.coyote.USE_CUSTOM_STATUS_MSG_IN_HEADER=true -Dcoldfusion.jsafe.defaultalgo=FIPS186Random -Dorg.eclipse.jetty.util.log.class=org.eclipse.jetty.util.log.JavaUtilLog -Djava.util.logging.config.file=/opt/ColdFusion/cfusion/bin/../lib/logging.properties -Djava.locale.providers=COMPAT,SPI -Dsun.font.layoutengine=icu -Djava.security.properties=/etc/linode/java/java.security -Djavax.net.ssl.trustStore=/opt/coldfusion/jre/lib/security/cacerts -Djavax.net.ssl.trustStorePassword=changeit -Djava.net.preferIPv4Stack=true -Djava.net.preferIPv4Addresses=true -Dlog4j2.formatMsgNoLookups=true -XX:+UseParallelGC -XX:MaxMetaspaceSize=2048m -Dcoldfusion.classPath=/opt/ColdFusion/cfusion/bin/../lib/updates,/opt/ColdFusion/cfusion/bin/../lib,/opt/ColdFusion/cfusion/bin/../lib/axis2,/opt/ColdFusion/cfusion/bin/../gateway/lib/,/opt/ColdFusion/cfusion/bin/../wwwroot/WEB-INF/cfform/jars,/opt/ColdFusion/cfusion/bin/../wwwroot/WEB-INF/flex/jars,/opt/ColdFusion/cfusion/bin/../lib/oosdk/lib,/opt/ColdFusion/cfusion/bin/../lib/oosdk/classes,/virtual/linode.com/www/lib com.adobe.coldfusion.bootstrap.Bootstrap -start
b
OH, this is an Adobe ColdFusion install? That wasn't clear from your message
and now I'm quite confused
Your original question said 
I am trying to run command box test
which I (perhaps incorrectly) assumed to be referring to the
Copy code
box testbox run
command, but CommandBox is written in Lucee!
So I have no idea what you are doing now, lol
Perhaps you should start back at the beginning and show exactly what you are trying to do, how you are doing it, what commands you are running, and the full output.
@Roshani Singh
r
Ohh so sorry for the confusion. Let me paste from the start what I am trying to do.
ā€¢ I have running docker image:
Copy code
NAME                     IMAGE                         COMMAND                  SERVICE             CREATED             STATUS                 PORTS
devenv-lindev-1          lindev                        "/docker-entrypoint.ā€¦"   lindev              2 weeks ago         Up    6 days
ā€¢ Opened a container shell:
Copy code
rosingh@yow-mpqy7 devenv % docker exec -it devenv-lindev-1 /bin/bash
root@29f6b39bf07c:/opt/ColdFusion#
ā€¢ Trying running the test like:
Copy code
# box testbox run '<https://lindev.local/tests/runner.cfm>'
Executing tests <https://lindev.local/tests/runner.cfm?&directory=tests.specs&recurse=true&reporter=json&verbose=true> please wait...



ERROR (5.8.0+00695)

Error executing tests:Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
And here comes the exception.
b
So you are using CommandBox's 
testbox run
command
r
yes
b
What you need to understand is that CommandBox, which is powered by Lucee, is what is making the actual HTTP request (via a <CFHTTP> call inside the CommandBox source code)
So it is going to be using Lucee's trust store, not ACF's
šŸ”– 1
In an HTTPS call, the client is the one who trusts the server
CommandBox/Lucee is the client here
So looking at Adobe CF's trust store and jvm args is a waste of time
I don't know where you have CommandBox installed, but Lucee's trust store will be here most likely
Copy code
~/.CommandBox/engine/cfml/cli/lucee-server/context/security/cacerts
šŸ‘€ 1
That's the trust store in use to negotiate the SSL connection and it's the trust store file you need to be looking at
r
I see testbox here:
Copy code
root@29f6b39bf07c:/opt/testbox# ls -larth
total 68K
-rwxr--r--  1 root    root   25 Dec 13  2021 testbox-4.5.0+5-202112132349
-rwxr--r--  1 root    root 4.0K Dec 13  2021 readme.md
-rwxr--r--  1 root    root 1.2K Dec 13  2021 license.txt
-rwxr--r--  1 root    root 5.8K Dec 13  2021 changelog.md
-rwxr--r--  1 root    root  417 Dec 13  2021 Application.cfc
-rwxr--r--  1 root    root 2.2K Dec 13  2021 box.json
drwxr-xr-x  1 cfusion root 4.0K Mar  6 12:34 ..
drwxr-xr-x  2 root    root 4.0K Mar  6 12:34 test-visualizer
drwxr-xr-x  2 root    root 4.0K Mar  6 12:34 test-browser
drwxr-xr-x  7 root    root 4.0K Mar  6 12:34 apidocs
drwxr-xr-x  4 root    root 4.0K Mar  6 12:34 test-harness
drwxr-xr-x  7 root    root 4.0K Mar  6 12:34 tests
drwxr-xr-x  2 root    root 4.0K Mar  6 12:34 test-runner
drwxr-xr-x  9 root    root 4.0K Mar  6 12:34 .
drwxr-xr-x 10 root    root 4.0K Mar  6 12:34 system
b
@Roshani Singh I have no idea why you're showing me that or what you want me to do with it, lol,
testbox has nothing at all to do with this
It's running inside the ACF app, and unrelated to CommandBox
I gave you the path to the Lucee trust store inside of CommandBox. Find it and check it
r
yes On it.
Yes so I found it the location u provide above. Doesn't seem empty given the size.
Copy code
root@29f6b39bf07c:~/.CommandBox/engine/cfml/cli/lucee-server/context/security# ls -l
total 112
-rw-r--r-- 1 root root 111388 Mar 21 10:13 cacerts
root@29f6b39bf07c:~/.CommandBox/engine/cfml/cli/lucee-server/context/security#
Not sure if it's helpful or relevant . Ran the below command to list the certs of the trust store:
Copy code
./keytool -list -v -keystore ~/.CommandBox/engine/cfml/cli/lucee-server/context/security/cacerts -storepass changeit > crt.txt
All certs seemed fine except one which was valid till 
2019
.
Copy code
Alias name: utnuserfirstobjectca [jdk]
Creation date: Mar 21, 2023
Entry type: trustedCertEntry

Owner: CN=UTN-USERFirst-Object, OU=<http://www.usertrust.com>, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
Issuer: CN=UTN-USERFirst-Object, OU=<http://www.usertrust.com>, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
Serial number: 44be0c8b500024b411d3362de0b35f1b
Valid from: Fri Jul 09 14:31:20 EDT 1999 until: Tue Jul 09 14:40:36 EDT 2019
Certificate fingerprints:
	 SHA1: E1:2D:FB:4B:41:D7:D9:C3:2B:30:51:4B:AC:1D:81:D8:38:5E:2D:46
	 SHA256: 6F:FF:78:E4:00:A7:0C:11:01:1C:D8:59:77:C4:59:FB:5A:F9:6A:3D:F0:54:08:20:D0:F4:B8:60:78:75:E5:8F
Signature algorithm name: SHA1withRSA
Subject Public Key Algorithm: 2048-bit RSA key
b
I assume if you switch to HTTP, this error goes away, but it doesn't really solve it
Have you hit 
<https://lindev.local/tests/runner.cfm?&directory=tests.specs&recurse=true&reporter=json&verbose=true>
direclty with a browser or 
curl
to see what happens
What can you tell us about the SSL cert this server is using? is it self signed? Valid?
r
When the test hit via browser , it's redirecting to non-secure site.
b
I don't see any indication that is a "redirect"
but regardless, if your browser can't verify the cert, I doubt Java can
ā€¢ find out what is invalid about the cert ā€¢ fix it ā€¢ šŸ™‚
If you click the "cert is not valid" link, it will open the cert for you to look at
r
Like it asked manually if want to continue to non-secure site(like usually it does for not valid certs).
b
That's not a redirect
That's just your browser warning you
A "redirect" is when the server responds with a 
30x
status code and a 
location
header and then the browser sends a second HTTP request to the new URL
Regardless, it doesn't change what you need to do to fix which I put above
r
I think I understand why I am getting this non-secure cert error because it got expired on 15th March and I haven't pulled the latest container with updated certs. Let me do that and retry.
b
Yep
r
Yeah I mean u right, I probably used for the wrong term here šŸ™‚
Thanks for the help. Let me try that out if that solves the issue. Else will get back here šŸ™
Open in Slack
PreviousNext
Powered by