Keytool error java io ioexception derinputstream getlength lengthtag 109 too big

Problem

Issue occurs when trying to collect mail from a exchange mailbox.

This can be root cause of outgoing connection failures to Application Links too.

The below error appears in the logs:

 Caused by: java.security.KeyStoreException: problem accessing trust storejava.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.
 at sun.security.ssl.TrustManagerFactoryImpl.engineInit(Unknown Source)
 at javax.net.ssl.TrustManagerFactory.init(Unknown Source)
 at org.apache.http.nio.conn.ssl.SSLLayeringStrategy.createSSLContext(SSLLayeringStrategy.java:85)
 at org.apache.http.nio.conn.ssl.SSLLayeringStrategy.createDefaultSSLContext(SSLLayeringStrategy.java:103)
 ... 41 more

Cause

• The keystore configured for SSL couldn’t be read by keytool neither as JKS nor PKCS#12 keystore. So, this can affect Tomcat. 

• Often how this error occurs is when certs are copied from Windows to Unix ie you have raised a CSR and you have received via email a signed certificate or a set of multiple signed certs from your certificate Authority. A CA could be Verisign or other main stream vendor or even the security team within your organization. 
• There are extra characters found at the end of the certificate file which the “certificate parser” is attempting to interpret as the start or end of a certificate section. The most common way to encounter this error is to have one, or more, blank lines at the end of the certificate file.  A line termination sequence is permitted (but not required) at the end of the final “—–END”  line (Sometimes you may have more than one encoded cert in a file), but there can be no more than one termination sequence of characters. Reference to webspheretools.com.

Diagnose

PKCS#7/P7B Format

The PKCS#7 or P7B format is usually stored in Base64 ASCII format and has a file extention of .p7b or .p7c. P7B certificates contain «——BEGIN PKCS7——» and «——END PKCS7——» statements. A P7B file only contains certificates and chain certificates, not the private key. Several platforms support P7B files including Microsoft Windows and Java Tomcat.

PKCS#12/PFX Format

The PKCS#12 or PFX format is a binary format for storing the server certificate, any intermediate certificates, and the private key in one encryptable file. PFX files usually have extensions such as .pfx and .p12. PFX files are typically used on Windows machines to import and export certificates and private keys.

For more details you can refer to https://www.sslshopper.com/ssl-converter.html (External Site)

Resolution

• Re-setup the Certificates
• Remove the PKCS12 setting for trust store set in the service parameters, but have a back of your .PFX files!
• Delete everything after the final “—–END” line.  Check the lines using a good editor that shows you the characters being used, don’t trust your eyes.
• Having back up of the keystore always helps to restore it when disaster happens.

Unfortunately configuring/supporting SSL is not covered under since customers use a variety of products and configurations. A great way to get support for unsupported queries is to ask questions on , our active user-community Q&A site.Atlassian Support OfferingsAtlassian Answers

As a lot of users, I got tired of the SSL certificate error page every time I visit the controller’s page.

Unfortunately, Ubiquiti doesn’t provide an “easy” upload functionality through the web interface.

But they do provide some documentation, which seems easy and quick enough. Or so I thought.

Ubiquiti documentation

You can find the relevant documentation on the Ubiquiti online documentation page.

To import an SSL certificate, you simply need to use the java ace.jar located under the /usr/lib/unifi directory.

java -jar lib/ace.jar import_cert <signed_cert> [<other_intermediate_root_certs>...]

But this does not work for me. After running the above command, I got an error that the certificate could not be imported into the keystore.

Using the keytool

During my search for a solution, I came across a Git repository of Steve Jenkins. This repository includes a shell script for installing SSL certificates on the Unifi controller.

Being cautious using scripts from the internet, I searched for the commands that actually import the certificate.

I noticed the script uses the keytool utility to handle the SSL certificate import.

Before messing around with it, I first tried out and see what the keytool actually does.
In short, keytool is a key and certificate management utility. It allows users to administer their own public/private key pairs and associate certificates for self-authentication.
It also allows users to cache the public keys (in the form of certificates) of their communicating peers.

First, lets check and see what is stored inside the keystore.

You can do this by using the following command:

sudo keytool -list -keystore /var/lib/unifi/keystore

The keytool asks you to enter a password. The default keystore password is aircontrolenterprise .

Once you enter the password, you see a list of all the certificates currently present in the keystore.

Digging deeper into the script, you’ll see that you first need tot delete the cerficiate with the “unifi” alias before you import the new one. You can delete it using the following command:

sudo keytool -delete -alias unifi -keystore /var/lib/unifi/keystore 

After that you can run the keytool utility again to confirm that the certificate is no longer present.

Import your SSL certificate

The next step is to import the new SSL certificate. You can do this by running the following commands:

openssl pkcs12 -export -in <certificate.crt> -inkey <certificate_key.key>  -out <tempfile> -passout pass:aircontrolenterprise -name unifi

keytool -importkeystore -srckeystore <tempfile> -srcstoretype pkcs12 -srcstorepass aircontrolenterprise -destkeystore /var/lib/unifi/keystore -deststorepass aircontrolenterprise -deststoretype pkcs12 -alias unifi -trustcacerts

However, this did not do the tick for me. When importing the SSL certificate, I got the following error:

Keytool error: java.io.IOException: DerInputStream.getLength(): lengthTag=109, too big.

If you also get a similar error, you can try running the commands as follow:

openssl pkcs12 -export -nodes -out <tempfile> -inkey <certificate_key.key> -in <certificate.crt> -certfile <bundle.ca-bundle> -passout pass:aircontrolenterprise -name unifi

keytool -importkeystore -srckeystore <tempfile> -srcstorepass aircontrolenterprise -destkeystore /var/lib/unifi/keystore -deststorepass aircontrolenterprise -alias unifi -trustcacerts

This creates a new keystore in JKS format. Unifi does not have a problem with it, but when you list the certificates, you’ll see a warning like this:

Warning:
The JKS keystore uses a proprietary format. It is recommended to migrate to PKCS12 which is an industry standard format using "keytool -importkeystore -srckeystore /var/lib/unifi/keystore -destkeystore /var/lib/unifi/keystore -deststoretype pkcs12".

In addition, if you want to convert the keystore to the PKCS12 format, you can back it up and run the displayed command:

keytool -importkeystore -srckeystore /var/lib/unifi/keystore -destkeystore /var/lib/unifi/keystore -deststoretype pkcs12

The only thing left to do is to restart the Unifi controller and you are good to go!

systemctl restart unifi

I’m the founder of Netronix, a software company that specializes in Ruby / Ruby on Rails development.
I have been developing and deploying a wide variety of online business and content applications. Hands-on experience in Ruby & PHP, although my focus lies mostly on the cutting edge of Ruby / Rails programming.
View all posts by Michaël Rigart