Control-M Application Integrator 9.0.18 REST or Web Service job fails with " javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty"

Knowledge Article

Control-M Application Integrator 9.0.18 REST or Web Service job fails with " javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty"
Control-M Application Integrator 9.0.18 REST or Web Service job fails with " javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty"
Control-M Application Integrator
Control-M Application Integrator
Control-M Application Integrator 9.0.18
Control-M Application Pack 9.0.18
Control-M Application Integrator 9.0.18 REST or Web Service job fails with " javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty" even when the REST or Web Service is using an SSL Certificate signed by a public Certificate Authority (CA).
This is caused by the default Java Key Store used as the Trust Store for the Control-M Application Pack 9.0.18 being empty.
The following steps can be used to resolve this issue:

On Unix/Linux:
  1. mv $CONTROLM/cm/AP/data/DATABASE/ctmdbcerts $CONTROLM/cm/AP/data/DATABASE/ctmdbcerts.old
  2. cp $CONTROLM/JRE/lib/security/cacerts $CONTROLM/cm/AP/data/DATABASE/ctmdbcerts
  3. $CONTROLM/JRE/bin/keytool -storepasswd -new ctmdb123 -keystore $CONTROLM/cm/AP/data/DATABASE/ctmdbcerts -storepass changeit
  4. Import any previously imported CA certificates using the import_certificate script:
    cd $CONTROLM/cm/AP/exe/
    ./import_certificate.sh "CA-Alias" "CA-cert"
  5. Restart the AP container:  $CONTROLM/cm/AP/exe/apmanager stop

On Windows:
  1. Rename the file "C:\Program Files\BMC Software\Default\CM\AP\data\DATABASE\ctmdbcerts" to "C:\Program Files\BMC Software\Default\CM\AP\data\DATABASE\ctmdbcerts.old"
  2. Copy the file "C:\Program Files\BMC Software\Default\JRE\lib\security\cacerts" and place it the directory "C:\Program Files\BMC Software\Default\CM\AP\data\DATABASE"
  3. Rename the file "C:\Program Files\BMC Software\Default\CM\AP\data\DATABASE\cacerts" to "C:\Program Files\BMC Software\Default\CM\AP\data\DATABASE\ctmdbcerts"
  4. Run the command: "C:\Program Files\BMC Software\Default\JRE\bin\keytool" -storepasswd -new ctmdb123 -keystore "C:\Program Files\BMC Software\Default\CM\AP\data\DATABASE\ctmdbcerts" -storepass changeit
    • Note: If receiving an error on this step try the follow alternate syntax: "C:\Program Files\BMC Software\Default\JRE\bin\keytool" -storepasswd -new ctmdb123 -keystore "C:\Program Files\BMC Software\Default\CM\AP\data\DATABASE\ctmdbcerts"
      • When prompted for the Keystore password, type changeit and then press enter
  5. Import any previously imported CA certificates using the script: "C:\Program Files\BMC Software\Default\CM\AP\exe\import_certificate.bat" "CA-Alias" "CA-cert"
  6. Restart the AP container:  "C:\Program Files\BMC Software\Default\CM\AP\exe\apmanager" stop 

Note: If the authentication method is set to basic in the Application Integrator job definition, ensure to mark the field "Use preemptive authentication" to succeed in the login phase
Control-M Application Integrator
Control-M Application Integrator
Control-M Application Integrator 9.0.18
Control-M Application Pack 9.0.18
Control-M Application Integrator
Control-M Application Integrator
Control-M Application Integrator 9.0.18
Control-M Application Pack 9.0.18
Attachment(s):