ONTOTEXT ANSWER:
That is a fairly common issue with Java and quite hard to debug. There may be a number of cases where this exception is thrown. Fortunately, all of them are quite distinct! And, even better, the root cause is always the same – a misconfigured SSL certificate. So, let’s take a look at what it might be.
- The GraphDB cluster doesn’t work. The issue may appear when you are using the cluster. In this case, it’s likely because you are using self-signed certificates and didn’t add them to all workers. This case was covered in our previous blog post on securing GraphDB with SSL.
- External service doesn’t work. This may be because of SPARQL federation, reconciliation, virtualization or anything else that requires connection to the external service. Likely, the certificate of that external service is dubious.
- The server doesn’t start outright. This happens when you are trying to enable security and using an external service – OAuth, Open ID, LDAP, Kerberos, etc. As part of the startup procedure, GraphDB checks the external service… And that brings us back to point 2.
There are two resolutions and a possible path for debugging.
- Get a better certificate. If you are the one issuing the certificate in the first place, you can make sure that it uses a trusted certificate signing authority. Did you know that Let’s Encrypt signs certificates for free?
- Trust your certificate. You can explicitly add your certificate to the Java trust store. Java has two stores – a keystore for your own certificates (by default, empty), and a trust store for valid certification authorities (by default, contains the major CAs of the world). There are two ways to resolve your problem:
- You can add the certificate of the external service to the keystore – as servers trust their own keys. This can only be done when you actually have the certificate, i.e., you manage the external service. One example of such a case is setting up the GraphDB cluster with self-signed certificates.
- You can add the CA to the trust store. Each CA exposes their own intermediate certificate, which you can add to the store.
If all else fails, you can debug the problem by starting GraphDB in network debug mode. This is achieved by passing the following Java flag: “-Djavax.net.debug=all”. The flag can be passed as an argument to the startup script or within the environment variable GDB_JAVA_OPTS
However, if you’ve reached the part with debugging, you may want to contact us! That being said, we can’t properly debug your application ourselves without your certificate.
Did this help you solve your issue? Your opinion is important not only to us but also to your peers.
Share this article
