certpath.SunCertPathBuilderException: unable to find valid certification path

Utilice un pequeño utilitario de Atlassian: https://confluence.atlassian.com/kb/unable-to-connect-to-ssl-services-due-to-pkix-path-building-failed-779355358.html

A continuación el ejemplo que hice :

[German@KDU ssl]$ java -cp . SSLPoke 

Utility to debug Java connections to SSL servers

Usage: 

  java SSLPoke

or for more debugging:

  java -Djavax.net.debug=ssl SSLPoke

Eg. to test the SSL certificate at https://localhost, use

  java SSLPoke localhost 443

[German@KDU ssl]$ java -cp . SSLPoke 127.0.0.1 7002

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)

at java.base/sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:290)

at java.base/sun.security.validator.Validator.validate(Validator.java:264)

at java.base/sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:343)

at java.base/sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:226)

at java.base/sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:133)

at java.base/sun.security.ssl.ClientHandshaker.checkServerCerts(ClientHandshaker.java:1947)

at java.base/sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1777)

at java.base/sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:264)

at java.base/sun.security.ssl.Handshaker.processLoop(Handshaker.java:1092)

at java.base/sun.security.ssl.Handshaker.processRecord(Handshaker.java:1026)

at java.base/sun.security.ssl.SSLSocketImpl.processInputRecord(SSLSocketImpl.java:1137)

at java.base/sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1074)

at java.base/sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)

at java.base/sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1402)

at java.base/sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:733)

at java.base/sun.security.ssl.AppOutputStream.write(AppOutputStream.java:67)

at java.base/sun.security.ssl.AppOutputStream.write(AppOutputStream.java:81)

at SSLPoke.main(SSLPoke.java:31)

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at java.base/sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)

at java.base/sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)

at java.base/java.security.cert.CertPathBuilder.build(CertPathBuilder.java:297)

at java.base/sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)

... 18 more

[German@KDU ssl]$ 

[German@KDU ssl]$ java -cp . -Djavax.net.ssl.trustStore=/Users/German/Oracle/Middleware/Oracle_Home/wlserver/server/lib/DemoTrust.jks SSLPoke 127.0.0.1 7002 

Successfully connected

[German@KDU ssl]$ 

como era de esperar uno de los problemas clasicos es setear el trust store en el java system properties, ademas algunos otros properties de ayuda para debug ssl :

-Djavax.net.debug=ssl:handshake:verbose

-Djavax.net.debug=ssl
-Djavax.net.ssl.keyStoreType=pkcs12
-Djavax.net.ssl.keyStore=client.p12
-Djavax.net.ssl.keyStorePassword=whatever
-Djavax.net.ssl.trustStoreType=jks
-Djavax.net.ssl.trustStore=client-truststore.jks
-Djavax.net.ssl.trustStorePassword=whatever

Changing weblogic.xml at deployment time

Executing: java weblogic.PlanGenerator -all -plan plan.xml ear/war(file)

Java Plan we can get a sample of Plan.xml. From here we can edit it to do modifications at deployment time:

<?xml version='1.0' encoding='UTF-8'?>
<deployment-plan xmlns="http://xmlns.oracle.com/weblogic/deployment-plan" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/weblogic/deployment-plan http://xmlns.oracle.com/weblogic/deployment-plan/1.0/deployment-plan.xsd" global-variables="false">
  <application-name>presentacion-0.0.1-SNAPSHOT.war</application-name>
  <variable-definition>
     <variable>  
        <name>nameValue</name> 
        <value>webapp/presentacion-0.0.1-SNAPSHOT</value> 
     </variable>    
  </variable-definition>
  <module-override>
    <module-name>presentacion-0.0.1-SNAPSHOT.war</module-name>
    <module-type>war</module-type>
    <module-descriptor external="true">
      <root-element>weblogic-web-app</root-element>
      <uri>WEB-INF/weblogic.xml</uri>
      <variable-assignment>
        <name>nameValue</name>
        <xpath>/weblogic-web-app/context-root</xpath>
        <operation>replace</operation>  
      </variable-assignment> 
    </module-descriptor>
  </module-override>
  <config-root>.</config-root>
</deployment-plan>

Maven example:

        <plugin>
                <groupId>com.oracle.weblogic</groupId>
                <artifactId>weblogic-maven-plugin</artifactId>
                <version>12.1.3-0-0</version>
                <configuration>
                    <adminurl>t3://127.0.0.1:7001</adminurl>
                    <plan>refactoring.xml</plan>
                    <user>weblogic</user>
                    <password>welcome1</password>
                    <upload>true</upload>
                    <action>deploy</action>
                    <remote>true</remote>
                    <verbose>true</verbose>
                    <source>target/${project.artifactId}-${project.version}.${project.packaging}</source>
                    <name>${project.artifactId}</name>
                    <targets>AdminServer</targets>
                </configuration>
            </plugin>

CNFE Quartz Job

A common problem is to a CNFE when a different job try to execute a job that is not is its classpath. This happens when different jobs are using the same quartz schema. This issue can be fixed by using different tables for Quartz persistence:

org.quartz.jobStore.tablePrefix = QRTZ_

Or to use different schedule name:

 <property name="schedulerName" value="quartzScheduler"/>

This can be checked in the column: SCHED_NAME of QRTZ_JOB_DETAILS.
Check the JOB_NAME column that contains the FQDN class

####<Feb 1, 2018 11:54:52 PM CLT> <Notice> <Stdout> <server> <WLSServer01> <QuartzScheduler_quartzScheduler-1517345673963_MisfireHandler> <<WLS Kernel>> <> <> <1517540092414> <BEA-000000> <23:54:52.413 [QuartzScheduler_quartzScheduler-1517345673963_MisfireHandler] ERROR org.springframework.scheduling.quartz.LocalDataSourceJobStore - MisfireHandler: Error handling misfires: Couldn't store trigger 'DEFAULT.cronTriggerNotificaSolicitud' for 'DEFAULT.complexJobDetailNotificaSolicitud' job:cl.devweb.aviso.cron.ExecuteNotificaSolicitud
org.quartz.JobPersistenceException: Couldn't store trigger 'DEFAULT.cronTriggerNotificaSolicitud' for 'DEFAULT.complexJobDetailNotificaSolicitud' job:cl.devweb.aviso.cron.ExecuteNotificaSolicitud
  at org.quartz.impl.jdbcjobstore.JobStoreSupport.storeTrigger(JobStoreSupport.java:1223) ~[quartz-2.2.1.jar:?]
  at org.quartz.impl.jdbcjobstore.JobStoreSupport.doUpdateOfMisfiredTrigger(JobStoreSupport.java:1037) ~[quartz-2.2.1.jar:?]
  at org.quartz.impl.jdbcjobstore.JobStoreSupport.recoverMisfiredJobs(JobStoreSupport.java:986) ~[quartz-2.2.1.jar:?]
  at org.quartz.impl.jdbcjobstore.JobStoreSupport.doRecoverMisfires(JobStoreSupport.java:3187) ~[quartz-2.2.1.jar:?]
  at org.quartz.impl.jdbcjobstore.JobStoreSupport$MisfireHandler.manage(JobStoreSupport.java:3935) [quartz-2.2.1.jar:?]
  at org.quartz.impl.jdbcjobstore.JobStoreSupport$MisfireHandler.run(JobStoreSupport.java:3956) [quartz-2.2.1.jar:?]
Caused by: java.lang.ClassNotFoundException: cl.devweb.aviso.cron.ExecuteNotificaSolicitud
  at weblogic.utils.classloaders.GenericClassLoader.findLocalClass(GenericClassLoader.java:357) ~[weblogic.server.merged.jar:12.1.3.0.0]
  at weblogic.utils.classloaders.GenericClassLoader.findClass(GenericClassLoader.java:318) ~[weblogic.server.merged.jar:12.1.3.0.0]
  at weblogic.utils.classloaders.ChangeAwareClassLoader.findClass(ChangeAwareClassLoader.java:80) ~[weblogic.server.merged.jar:12.1.3.0.0]
  at java.lang.ClassLoader.loadClass(ClassLoader.java:425) ~[?:1.7.0_91]
  at java.lang.ClassLoader.loadClass(ClassLoader.java:358) ~[?:1.7.0_91]
  at weblogic.utils.classloaders.GenericClassLoader.loadClass(GenericClassLoader.java:186) ~[weblogic.server.merged.jar:12.1.3.0.0]
  at weblogic.utils.classloaders.ChangeAwareClassLoader.loadClass(ChangeAwareClassLoader.java:50) ~[weblogic.server.merged.jar:12.1.3.0.0]
  at org.springframework.scheduling.quartz.ResourceLoaderClassLoadHelper.loadClass(ResourceLoaderClassLoadHelper.java:78) ~[spring-context-support-4.2.1.RELEASE.jar:4.2.1.RELEASE]
  at org.springframework.scheduling.quartz.ResourceLoaderClassLoadHelper.loadClass(ResourceLoaderClassLoadHelper.java:83) ~[spring-context-support-4.2.1.RELEASE.jar:4.2.1.RELEASE]
  at org.quartz.impl.jdbcjobstore.StdJDBCDelegate.selectJobDetail(StdJDBCDelegate.java:852) ~[quartz-2.2.1.jar:?]
  at org.quartz.impl.jdbcjobstore.JobStoreSupport.storeTrigger(JobStoreSupport.java:1205) ~[quartz-2.2.1.jar:?]
  ... 5 more>

More info: http://forums.terracotta.org/forums/posts/list/7073.page

How to handle Secrets

How to handle Secrets in repositories is always an issue (Chicken or the egg).

There are several initiatives, however still I like to keep in a separate file that must be handled manually by sysadmin/devops:


https://security.web.cern.ch/security/recommendations/en/password_alternatives.shtml

https://coderwall.com/p/kucyaw/protect-secret-data-in-git-repo
https://www.vaultproject.io/
https://spring.io/blog/2016/06/24/managing-secrets-with-vault
https://github.com/stuinzuri/SimpleJavaKeyStore

Yet Another summary to solve this topic:
https://dev.to/bpedro/how-to-securely-store-api-keys-ab6

JDBC Statement Timeout

To enable this feature, go to Admin Console -> JDBC Data Source: Configuration: Connection Pool, and set "Statement Timeout" greater than 0.

            stmt = conn.createStatement();
            stmt.setQueryTimeout(1);
            // java.sql.Statement.setQueryTimeout();

java.sql.SQLException: ORA-01013: user requested cancel of current operation to the server log.

If It Is Working Don't Change

As seen in real life :P

http://wiki.c2.com/?IfItIsWorkingDontChange

http://publicdomainreview.org/collections/chapbooks-of-the-eighteenth-century-1882/

Event-Driven Architecture

From O'Reilly.

Quartz Race Condition (in a cluster)

There is race condition (ABA problem)  when using Quartz cluster.
This may be translate in the below stacktrace:

For a strategy coding should not happen, however under certain circumstances, it does. (in particular WebLogic & Oracle DB)

The workaround is to set the following property:

org.quartz.jobStore.acquireTriggersWithinLock=true

As established in the official documentation it shouldn't be necessary:

org.quartz.jobStore.acquireTriggersWithinLock
Whether or not the acquisition of next triggers to fire should occur within an explicit database lock. This was once necessary (in previous versions of Quartz) to avoid dead-locks with particular databases, but is no longer considered necessary, hence the default value is “false”.

27-dic-2017 12h04=""  [See nested exception: java.sql.SQLIntegrityConstraintViolationException: ORA-00001: restricción única (USERS.QRTZ_TRIGGERS_PK) violada
].
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'quartzScheduler' defined in ServletContext resource [/WEB-INF/spring/root-context.xml]: Invocation of init method failed; nested exception is org.quartz.JobPersistenceException: Couldn't store trigger 'DEFAULT.cronTriggerUserNotificacion' for 'DEFAULT.complexJobDetailUserNotificacion' job:ORA-00001: restricción única (USERS.QRTZ_TRIGGERS_PK) violada
 [See nested exception: java.sql.SQLIntegrityConstraintViolationException: ORA-00001: restricción única (USERS.QRTZ_TRIGGERS_PK) violada
]
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.initializeBean(AbstractAutowireCapableBeanFactory.java:1578)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.doCreateBean(AbstractAutowireCapableBeanFactory.java:545)
    at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.createBean(AbstractAutowireCapableBeanFactory.java:482)
    at org.springframework.beans.factory.support.AbstractBeanFactory$1.getObject(AbstractBeanFactory.java:305)
    at org.springframework.beans.factory.support.DefaultSingletonBeanRegistry.getSingleton(DefaultSingletonBeanRegistry.java:230)
    Truncated. see log file for complete stacktrace

• https://en.wikipedia.org/wiki/ABA_problem
• https://github.com/quartz-scheduler/quartz/issues/107
• https://jira.terracotta.org/jira/si/jira.issueviews:issue-html/QTZ-120/QTZ-120.html
• https://jira.spring.io/browse/SPR-1812

O'reilly Architecture

From O'reilly Neal Ford & Mark Richards presentation. These are one of several interesting points:

Trends 2017

From infoq:

Now, we should see 2018 trends :)