Failed to validate certificate with latest Java 7

Ignition
1

Hello,

after updating a dev system to the latest Java 7 (1.7.0_13 on Win7-64) i am unable to start the designer or clients.
I already tried clearing the Ignition and Java caches without success.
Any idea what could be wrong?

Java WebStart fails with an InvalidKeyException.

sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: java.security.InvalidKeyException: Wrong key usage
	at sun.security.validator.PKIXValidator.doValidate(Unknown Source)
	at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
	at sun.security.validator.Validator.validate(Unknown Source)
	at sun.security.validator.Validator.validate(Unknown Source)
	at sun.security.validator.Validator.validate(Unknown Source)
	at com.sun.deploy.security.TrustDecider.validateChain(Unknown Source)
	at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(Unknown Source)
	at com.sun.javaws.security.AppPolicy.grantUnrestrictedAccess(Unknown Source)
	at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResourcesHelper(Unknown Source)
	at com.sun.javaws.security.JNLPSignedResourcesHelper.checkSignedResources(Unknown Source)
	at com.sun.javaws.Launcher.prepareResources(Unknown Source)
	at com.sun.javaws.Launcher.prepareAllResources(Unknown Source)
	at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
	at com.sun.javaws.Launcher.prepareToLaunch(Unknown Source)
	at com.sun.javaws.Launcher.launch(Unknown Source)
	at com.sun.javaws.Main.launchApp(Unknown Source)
	at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
	at com.sun.javaws.Main.access$000(Unknown Source)
	at com.sun.javaws.Main$1.run(Unknown Source)
	at java.lang.Thread.run(Unknown Source)
Caused by: java.security.cert.CertPathValidatorException: java.security.InvalidKeyException: Wrong key usage
	at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(Unknown Source)
	at sun.security.provider.certpath.PKIXCertPathValidator.doValidate(Unknown Source)
	at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(Unknown Source)
	at java.security.cert.CertPathValidator.validate(Unknown Source)
	... 20 more
Caused by: java.security.InvalidKeyException: Wrong key usage
	at java.security.Signature.initVerify(Unknown Source)
	at sun.security.provider.certpath.OCSPResponse.verifyResponse(Unknown Source)
	at sun.security.provider.certpath.OCSPResponse.<init>(Unknown Source)
	at sun.security.provider.certpath.OCSP.check(Unknown Source)
	at sun.security.provider.certpath.OCSPChecker.check(Unknown Source)
	... 24 more
2

Go to Control Panel>Java, and then to the Advanced tab. Expand “Security”. Are either of the following two options selected?
“Check publisher certificate for revocation”
“Enable online certificate validation”

If they are, deselect them.

3

Thank you for the quick reply.

Deselecting those setting worked, but i am pretty sure that our IT department will not like this solution. Is this something that might be fixed in future Java / Ignition versions?

4

What version of Ignition are you currently using? This may be due to the certificate being expired in an older version of Ignition. Upgrading may correct the inability to validate the certificate.

5

The Ignition version is already the latest 7.5.5

6

Is the computer that your launching the client/designer on connected to the internet?

7

Yes, it is. This is my private dev system, so there should be nothing preventing certificate evaluation. I just tried to disable the firewall but that made no difference.
The gateway runs in a VM on the same machine.

8

I will put a ticket in the system to have the development team take a look at this. I found some information regarding this error message, but it has to do with a potential bug in Java. The work around that I described to you is also found on the Oracle website. We do have some related forum threads in our forums.

9

You are right, this is open bug in Java. I should have looked there first. (http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=7174966).

Seems that Java 7 is not able to evaluate certificates issued by Comodo.

10

Correct

1 Like
11

Good excuse for us to get a new cert anyhow. We’ll have a cert from Symantec in 7.5.6. That’s the best we can do.

12

I installed the latest version of Ignition (Ignition-7.6.0-windows-x64-installer) and the latest version of java (Version 7 Update 21) yesterday and still have this problem.

The workarounds above did not fix it ether.

Thanks.

13

Really!? Our current cert is valid until 2016…

What are the cert details you see under the Java control panel > Security > Certificates?

14

What certificate type should I look at?
There is Trusted Certificates, Secure Site, Signer CA, Secure Site CA and Client Authentication.
And a User and System tab.

15

Trusted / User

16

There is nothing in there, completely empty.

My computers OS is Ubuntu Linux, I’m running Ignition on a Windows 7 virtual machine (vmware).
Don’t know if this could have anything to do with the problem.

Thanks.

17

How can I get the necessary certificates?

Thanks.

18

You do not need any certificates. The certificates are contained within the application. I suspect that something is strange with your java installation, as we are unable to reproduce this issue. You might try updating to the latest version of Java 7?