X509TrustManager Implementation Available

Question

I call the AWS API, I continue to work with the error

Exception in thread "main" com.amazonaws.AmazonClientException: Unable to execute HTTP request: java.security.cert.CertificateException: No X509TrustManager implementation available at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:709) at com.amazonaws.http.AmazonHttpClient.doExecute(AmazonHttpClient.java:449) at com.amazonaws.http.AmazonHttpClient.executeWithTimer(AmazonHttpClient.java:411) at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:360) at com.amazonaws.services.kms.AWSKMSClient.doInvoke(AWSKMSClient.java:2723) at com.amazonaws.services.kms.AWSKMSClient.invoke(AWSKMSClient.java:2693) at com.amazonaws.services.kms.AWSKMSClient.generateDataKey(AWSKMSClient.java:1488) at com.infor.aws.KMSTest.createDEK(KMSTest.java:217) at com.infor.aws.KMSTest.main(KMSTest.java:144) Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No X509TrustManager implementation available at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509) at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) at sun.security.ssl.Handshaker.process_record(Handshaker.java:914) at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:353) at com.amazonaws.http.conn.ssl.SdkTLSSocketFactory.connectSocket(SdkTLSSocketFactory.java:132) at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:141) at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:353) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:498) at com.amazonaws.http.conn.ClientConnectionManagerFactory$Handler.invoke(ClientConnectionManagerFactory.java:76) at com.amazonaws.http.conn.$Proxy2.connect(Unknown Source) at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:380) at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236) at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:184) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:55) at com.amazonaws.http.apache.client.impl.SdkHttpClient.execute(SdkHttpClient.java:72) at com.amazonaws.http.AmazonHttpClient.executeOneRequest(AmazonHttpClient.java:854) at com.amazonaws.http.AmazonHttpClient.executeHelper(AmazonHttpClient.java:697) ... 8 more Caused by: java.security.cert.CertificateException: No X509TrustManager implementation available at sun.security.ssl.DummyX509TrustManager.checkServerTrusted(SSLContextImpl.java:1119) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491) ... 35 more 

I looked at several threads here in Stackoverflow and added all the necessary properties of Truststore, truststoretype. I tried this stream . But nothing works. Has anyone come across this? I call it as shown below

 TrustManagerFactory tmf = TrustManagerFactory .getInstance(TrustManagerFactory.getDefaultAlgorithm()); KeyStore ks = KeyStore.getInstance("BCFKS"); ks.load(new FileInputStream("<jre-home>\\\\lib\\\\security\\\\cacerts"), "changeit".toCharArray()); tmf.init(ks); // Get hold of the trust manager X509TrustManager x509Tm = null; for (TrustManager tm : tmf.getTrustManagers()) { if (tm instanceof X509TrustManager) { x509Tm = (X509TrustManager) tm; break; } } 

Answer 1

This was allowed when we moved the initialization of the AWS client to a place after setting the trust store password. In my code, I created the AWS client too early.

Answer 2

After debugging for several hours, it turned out to be a damaged keystore in my case. Check if you can list the contents of the keystore with the keytool command.