AnsweredAssumed Answered

AFX SSL Installation Error

Question asked by Steve Alexandre on Sep 18, 2019
Latest reply on Feb 4, 2020 by Almos Kovacs

Like • Show 0 Likes0
Comment • 14

Hi,

When I try to install the AFX Server, I have an error :

[root@akhenaton deploy]# ./installAFX.sh -q
Is JAVA_HOME set?
Current value JAVA_HOME=/etc/alternatives/java_sdk_openjdk
/etc/alternatives/java_sdk_openjdk directory is present
New value JAVA_HOME=/etc/alternatives/java_sdk_openjdk
Installation started on Wed Sep 18 10:38:04 UTC 2019

QUIET mode specified. User prompts will be disabled.
Setting MULE_HOME to /home/oracle/AFX/esb...

Expanding AFX server archive to /tmp/AFX...

Configuring AFX environment script...

Configuring SSL Certificates for AFX Server...
Args: createclient afx.localhost.localdomain /tmp/AFX/esb/conf
Error: A JNI error has occurred, please check your installation and try again
Exception in thread "main" java.lang.NoClassDefFoundError: org/bouncycastle/jce/provider/BouncyCastleProvider
at java.lang.Class.getDeclaredMethods0(Native Method)
at java.lang.Class.privateGetDeclaredMethods(Class.java:2701)
at java.lang.Class.privateGetMethodRecursive(Class.java:3048)
at java.lang.Class.getMethod0(Class.java:3018)
at java.lang.Class.getMethod(Class.java:1784)
at sun.launcher.LauncherHelper.validateMainClass(LauncherHelper.java:544)
at sun.launcher.LauncherHelper.checkAndLoadMain(LauncherHelper.java:526)
Caused by: java.lang.ClassNotFoundException: org.bouncycastle.jce.provider.BouncyCastleProvider
at java.net.URLClassLoader.findClass(URLClassLoader.java:381)
at java.lang.ClassLoader.loadClass(ClassLoader.java:424)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:349)
at java.lang.ClassLoader.loadClass(ClassLoader.java:357)
... 7 more

FATAL ERROR!! Failed to create SSL certificate for AFX server using Aveksa CA

FAILURE!! AFX installation FAILED due to FATAL ERRORS on Wed Sep 18 10:38:09 UTC 2019

Please see /tmp/afx-install.log for more information.

Steve Alexandre Sep 24, 2019 8:14 AM

Correct Answer

Hi Kristian,

Yes with webex support, finally he has just unzip manually the zip AFX file and it's working.

No idea about why installing the AFX with the script from the installation package doesn't working with this patch while it was working in other version.

See the reply in context

No one else had this question

Outcomes

Kristian Nordman Sep 18, 2019 10:15 AM

Hi!

The error you are receiving:

Exception in thread "main" java.lang.NoClassDefFoundError: org/bouncycastle/jce/provider/BouncyCastleProvider

is a result of java not being able to find bouncycastle which provides the encryption required to set up SSL.

I was able to replicate your problem by removing a library from my installation:

/home/oracle/wildfly/standalone/deployments/aveksa.ear/APP-INF/lib/bcprov-jdk15-1.46.jar

Could you verify for me that you have this library and that it is readable?

Actions

Steve Alexandre @ Kristian Nordman on Sep 18, 2019 11:16 AM

Hi,

Thanks for your search.

When I take a look in my other environment where AFX is installed, I'm not found this file in the same directory of you.

Here where he is located :

/home/oracle/AFX/esb/lib/opt/bcprov-jdk16-1.46.jar
/home/oracle/AFX/mmc-console/webapps/mmc/WEB-INF/lib/bcprov-jdk16-140.jar
/home/oracle/database/lib/bcprov-jdk15-1.46.jar
/home/oracle/wildfly-10.1.0.Final/modules/system/layers/base/org/bouncycastle/main/bcprov-jdk15on-1.52.jar

Actions

Kristian Nordman @ Steve Alexandre on Sep 19, 2019 6:48 AM

I see, I believe your problem is that the library is missing from the correct folder. The scripts which create the client certificate specifically source the ones from IG&L and if it is missing from the specific folder it will not be used and result in the error you are having.

Try copying /home/oracle/database/lib/bcprov-jdk15-1.46.jar to /home/oracle/wildfly/standalone/deployments/aveksa.ear/APP-INF/lib/bcprov-jdk15-1.46.jar and see if that resolves your issue. If it does, you will have need to customize your deployment to make the change permanent.

Actions

Steve Alexandre @ Kristian Nordman on Sep 19, 2019 6:56 AM

Thank you for your reply.

I will have a webex tomorrow with RSA Support.

FYI, we have install rsa as enterprise application with customer database so the deployment made by the product himself is not in /home/oracle/wildfly/standalone/deployments/ but in /home/oracle/wildfly/standalone/tmp and there are no aveksa.ear in these directory/subdirectory.

Will post the solution tomorrow.

Actions

Kristian Nordman @ Steve Alexandre on Sep 24, 2019 4:00 AM

Did you find a solution for this?

Actions

Steve Alexandre @ Kristian Nordman on Sep 24, 2019 8:14 AM

Hi Kristian,

Yes with webex support, finally he has just unzip manually the zip AFX file and it's working.

No idea about why installing the AFX with the script from the installation package doesn't working with this patch while it was working in other version.

Actions

Ian Staines

@ Steve Alexandre on Sep 24, 2019 10:50 AM

The dynamically created afx.zip archive would have all of the current aveksa server trusted certificates and passphrases in it. The installation files would not contain this updated information.

1 person found this helpful

Actions

Ian Staines

@ Ian Staines on Dec 3, 2019 5:51 PM

For AFX issues please refer to the master AFX troubleshooting article.

000038029 - Troubleshooting AFX Connector issues in RSA Identity Governance & Lifecycle

Actions

Steve Alexandre @ Ian Staines on Dec 4, 2019 4:00 AM

Hi IAN,

This KB refer only about connectors and not the AFX Server. By the way, this is resolved since september now.

Actions

Almos Kovacs @ Steve Alexandre on Feb 3, 2020 4:37 AM

Hi,

Could you please share the step by step solution for the issue with me?
I'm struggling with the same issue.

Thanks in advance,
Álmos

Actions

Ian Staines

@ Almos Kovacs on Feb 3, 2020 12:34 PM

I do not believe a root cause for this issue was ever determined so we do not have any specific guidance for this issue.

My understanding is that this was resolved by reinstalling AFX using the general guidance in this article:

000034089 - How to install Access Fulfillment Express (AFX) for use with RSA Identity Governance & Lifecycle

Actions

Almos Kovacs @ Ian Staines on Feb 4, 2020 3:48 AM

Reinstalling? The problem is with the installation itself.

When I try to install the AFX Server...

./installAFX.sh -q

Actions

Steve Alexandre @ Ian Staines on Feb 4, 2020 4:14 AM

Yes sorry, you have to reinstall with the procedure manually (unzip/permissions/etc..) and in my case, I have to change the keystore too and modify the afx password to changeit because it was a purge db, not a full reinstall of aveksa.

Actions

Almos Kovacs @ Steve Alexandre on Feb 4, 2020 4:20 AM

Thanks for your replies.

I'm going to retry the procedure then from scratch.

Actions

14 Replies

Kristian Nordman Sep 18, 2019 10:15 AM
Mark Correct
Correct Answer
Hi!

The error you are receiving:
Exception in thread "main" java.lang.NoClassDefFoundError: org/bouncycastle/jce/provider/BouncyCastleProvider
is a result of java not being able to find bouncycastle which provides the encryption required to set up SSL.

I was able to replicate your problem by removing a library from my installation:
```
/home/oracle/wildfly/standalone/deployments/aveksa.ear/APP-INF/lib/bcprov-jdk15-1.46.jar
```
Could you verify for me that you have this library and that it is readable?
Like • Show 0 Likes0
Actions
- Steve Alexandre @ Kristian Nordman on Sep 18, 2019 11:16 AM
  Mark Correct
  Correct Answer
  Hi,
  
  Thanks for your search.
  When I take a look in my other environment where AFX is installed, I'm not found this file in the same directory of you.
  Here where he is located :
  /home/oracle/AFX/esb/lib/opt/bcprov-jdk16-1.46.jar
  /home/oracle/AFX/mmc-console/webapps/mmc/WEB-INF/lib/bcprov-jdk16-140.jar
  /home/oracle/database/lib/bcprov-jdk15-1.46.jar
  /home/oracle/wildfly-10.1.0.Final/modules/system/layers/base/org/bouncycastle/main/bcprov-jdk15on-1.52.jar
  Like • Show 0 Likes0
  Actions
  - Kristian Nordman @ Steve Alexandre on Sep 19, 2019 6:48 AM
    Mark Correct
    Correct Answer
    I see, I believe your problem is that the library is missing from the correct folder. The scripts which create the client certificate specifically source the ones from IG&L and if it is missing from the specific folder it will not be used and result in the error you are having.
    
    Try copying /home/oracle/database/lib/bcprov-jdk15-1.46.jar to /home/oracle/wildfly/standalone/deployments/aveksa.ear/APP-INF/lib/bcprov-jdk15-1.46.jar and see if that resolves your issue. If it does, you will have need to customize your deployment to make the change permanent.
    Like • Show 0 Likes0
    Actions
    - Steve Alexandre @ Kristian Nordman on Sep 19, 2019 6:56 AM
      Mark Correct
      Correct Answer
      Thank you for your reply.
      I will have a webex tomorrow with RSA Support.
      FYI, we have install rsa as enterprise application with customer database so the deployment made by the product himself is not in /home/oracle/wildfly/standalone/deployments/ but in /home/oracle/wildfly/standalone/tmp and there are no aveksa.ear in these directory/subdirectory.
      
      Will post the solution tomorrow.
      Like • Show 0 Likes0
      Actions
      - Kristian Nordman @ Steve Alexandre on Sep 24, 2019 4:00 AM
        Mark Correct
        Correct Answer
        Did you find a solution for this?
        Like • Show 0 Likes0
        Actions
        Steve Alexandre @ Kristian Nordman on Sep 24, 2019 8:14 AM
        Unmark Correct
        Correct Answer
        Hi Kristian,
        
        Yes with webex support, finally he has just unzip manually the zip AFX file and it's working.
        No idea about why installing the AFX with the script from the installation package doesn't working with this patch while it was working in other version.
        Like • Show 0 Likes0
        Actions
        Ian Staines @ Steve Alexandre on Sep 24, 2019 10:50 AM
        Mark Correct
        Correct Answer
        The dynamically created afx.zip archive would have all of the current aveksa server trusted certificates and passphrases in it. The installation files would not contain this updated information.
        1 person found this helpful
        Like • Show 2 Likes2
        Actions
        Ian Staines @ Ian Staines on Dec 3, 2019 5:51 PM
        Mark Correct
        Correct Answer
        For AFX issues please refer to the master AFX troubleshooting article.
        000038029 - Troubleshooting AFX Connector issues in RSA Identity Governance & Lifecycle
        Like • Show 0 Likes0
        Actions
        Steve Alexandre @ Ian Staines on Dec 4, 2019 4:00 AM
        Mark Correct
        Correct Answer
        Hi IAN,
        This KB refer only about connectors and not the AFX Server. By the way, this is resolved since september now.
        Like • Show 0 Likes0
        Actions
        Almos Kovacs @ Steve Alexandre on Feb 3, 2020 4:37 AM
        Mark Correct
        Correct Answer
        Hi,
        
        Could you please share the step by step solution for the issue with me?
        I'm struggling with the same issue.
        
        Thanks in advance,
        Álmos
        Like • Show 0 Likes0
        Actions
        Ian Staines @ Almos Kovacs on Feb 3, 2020 12:34 PM
        Mark Correct
        Correct Answer
        I do not believe a root cause for this issue was ever determined so we do not have any specific guidance for this issue.
        
        My understanding is that this was resolved by reinstalling AFX using the general guidance in this article:
        
        000034089 - How to install Access Fulfillment Express (AFX) for use with RSA Identity Governance & Lifecycle
        Like • Show 1 Like1
        Actions
        Almos Kovacs @ Ian Staines on Feb 4, 2020 3:48 AM
        Mark Correct
        Correct Answer
        Reinstalling? The problem is with the installation itself.
        
        When I try to install the AFX Server...
        ./installAFX.sh -q
        Like • Show 0 Likes0
        Actions
        Steve Alexandre @ Ian Staines on Feb 4, 2020 4:14 AM
        Mark Correct
        Correct Answer
        Yes sorry, you have to reinstall with the procedure manually (unzip/permissions/etc..) and in my case, I have to change the keystore too and modify the afx password to changeit because it was a purge db, not a full reinstall of aveksa.
        Like • Show 0 Likes0
        Actions
        Almos Kovacs @ Steve Alexandre on Feb 4, 2020 4:20 AM
        Mark Correct
        Correct Answer
        Thanks for your replies.
        I'm going to retry the procedure then from scratch.
        Like • Show 0 Likes0
        Actions

AFX SSL Installation Error

Outcomes

Related Content

Recommended Content