Error with EC Domain Parameters After Cloning Configurations for a new company

[zalborzi]

I cloned the configuration of an existing setup (company3) to create a new setup (company0) in MVD, replicating properties, JSON files, and certificates. I can run company3, however, I'm encountering an error when starting the company0, despite both configurations being identical. The error message is:

Caused by: org.eclipse.edc.spi.EdcException: com.nimbusds.jose.JOSEException: unable to convert key pair: java.security.InvalidKeyException: EC domain parameters must be encoded in the algorithm identifier

Has anyone faced a similar issue or can offer guidance on resolving this EC key-related error? Any help would be greatly appreciated.

[paullatzelsperger]

Hey @zalborzi!
without a full stack trace there is not much we can do.

If you generated the keys for connector0 yourself, and imported them into the keystone, please be sure to read this section of the Readme carefully.

That said, some more information regarding how your generate the keys, specifically EC parameters, curve, etc., how keys are imported into the JKS, info about your Java version, your operating system, etc. would be required.

If I had to guess, I'd say this has to do with missing EC algorithm parameters in a DER-encoded PKCS#8 private key. The fact that it's a JOSEException indicates that this happens when attempting to convert a locally stored key-pair into a JWK (JsonWebKey).

for reference: ECPrivateKeyImpl.java (the link is from JDK 8, but the code is the same in Java 21)

[zalborzi]

Hello @paullatzelsperger

I appreciate your response. I encountered an issue when attempting to update the company3-keystore.jks even with the private-key.pem and cert.pem provided in the project. Following the steps to import the new key into the keystore resulted in the error. Here's what I did:

1. Initially, I generated a PKCS#12 keystore using the command:

   openssl pkcs12 -export -in cert.pem -inkey private-key.pem -out keystore.p12 -name company3 -passout pass:test123
   

2. Subsequently, I attempted to convert the PKCS#12 file to a JKS format with the following command:

   keytool -importkeystore -srckeystore keystore.p12 -srcstoretype pkcs12 -srcstorepass test123 -destkeystore company3-keystore.jks -deststoretype jks -deststorepass test123 -alias company3
   

This process led to the following error when replacing the key in company3-keystore.jks.

Here is the full stack trace:

2024-02-15 11:52:50 Listening for transport dt_socket at address: 5007
2024-02-15 11:52:50 WARNING 2024-02-15T10:52:50.71059734 Configuration file does not exist: dataspaceconnector-configuration.properties. Ignoring.
2024-02-15 11:52:50 INFO 2024-02-15T10:52:50.721982716 Initialized FS Configuration
2024-02-15 11:52:50 INFO 2024-02-15T10:52:50.813851299 Initialized Boot Services
2024-02-15 11:52:50 INFO 2024-02-15T10:52:50.999586632 Initialized FS Vault
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.001140216 Initialized Core Default Services
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.028286799 HTTPS enforcement it not enabled, please enable it in a production environment
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.068972716 HTTPS enforcement it not enabled, please enable it in a production environment
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.071150424 Initialized Core Services
2024-02-15 11:52:51 WARNING 2024-02-15T10:52:51.071428799 Settings: No setting found for key 'edc.hostname'. Using default value 'localhost'
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.075967549 Initialized JSON-LD Extension
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.099196007 Initialized Control Plane Default Services
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.100744257 Initialized org.eclipse.edc.connector.contract.ContractNegotiationDefaultServicesExtension
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.117369549 Initialized Jetty Service
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.118058882 Initialized Jersey Web Service
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.119411632 Initialized Identity Did Core
2024-02-15 11:52:51 WARNING 2024-02-15T10:52:51.119592549 No TransactionContext registered, a no-op implementation will be used, not suitable for production environments
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.119937924 Initialized org.eclipse.edc.identityhub.IdentityHubExtension
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.120125716 Initialized Credentials Verifier
2024-02-15 11:52:51 WARNING 2024-02-15T10:52:51.120637966 There were missing service registrations in extension class org.eclipse.edc.iam.did.service.DecentralizedIdentityServiceExtension: org.eclipse.edc.spi.iam.IdentityService
2024-02-15 11:52:51 INFO 2024-02-15T10:52:51.120724174 Initialized Distributed Identity Service
2024-02-15 11:52:51 SEVERE 2024-02-15T10:52:51.123945549 Error booting runtime: java.lang.reflect.InvocationTargetException
2024-02-15 11:52:51 org.eclipse.edc.spi.system.injection.EdcInjectionException: java.lang.reflect.InvocationTargetException
2024-02-15 11:52:51     at org.eclipse.edc.spi.system.injection.ProviderMethod.invoke(ProviderMethod.java:66)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.injection.lifecycle.RegistrationPhase.invokeAndRegister(RegistrationPhase.java:51)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.injection.lifecycle.RegistrationPhase.lambda$invokeProviderMethods$0(RegistrationPhase.java:45)
2024-02-15 11:52:51     at java.base/java.lang.Iterable.forEach(Iterable.java:75)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.injection.lifecycle.RegistrationPhase.invokeProviderMethods(RegistrationPhase.java:45)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.injection.lifecycle.ExtensionLifecycleManager.provide(ExtensionLifecycleManager.java:70)
2024-02-15 11:52:51     at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
2024-02-15 11:52:51     at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
2024-02-15 11:52:51     at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
2024-02-15 11:52:51     at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:197)
2024-02-15 11:52:51     at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1625)
2024-02-15 11:52:51     at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
2024-02-15 11:52:51     at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
2024-02-15 11:52:51     at java.base/java.util.stream.ReduceOps$ReduceOp.evaluateSequential(ReduceOps.java:921)
2024-02-15 11:52:51     at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
2024-02-15 11:52:51     at java.base/java.util.stream.ReferencePipeline.collect(ReferencePipeline.java:682)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.ExtensionLoader.bootServiceExtensions(ExtensionLoader.java:67)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.runtime.BaseRuntime.bootExtensions(BaseRuntime.java:139)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.runtime.BaseRuntime.boot(BaseRuntime.java:200)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.runtime.BaseRuntime.boot(BaseRuntime.java:83)
2024-02-15 11:52:51     at org.eclipse.edc.boot.system.runtime.BaseRuntime.main(BaseRuntime.java:71)
2024-02-15 11:52:51 Caused by: java.lang.reflect.InvocationTargetException
2024-02-15 11:52:51     at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
2024-02-15 11:52:51 SLF4J: No SLF4J providers were found.
2024-02-15 11:52:51 SLF4J: Defaulting to no-operation (NOP) logger implementation
2024-02-15 11:52:51 SLF4J: See https://www.slf4j.org/codes.html#noProviders for further details.
2024-02-15 11:52:51     at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
2024-02-15 11:52:51     at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
2024-02-15 11:52:51     at java.base/java.lang.reflect.Method.invoke(Method.java:568)
2024-02-15 11:52:51     at org.eclipse.edc.spi.system.injection.ProviderMethod.invoke(ProviderMethod.java:61)
2024-02-15 11:52:51     ... 20 more
2024-02-15 11:52:51 Caused by: org.eclipse.edc.spi.EdcException: com.nimbusds.jose.JOSEException: unable to convert key pair: java.security.InvalidKeyException: EC domain parameters must be encoded in the algorithm identifier
2024-02-15 11:52:51     at org.eclipse.edc.iam.did.parser.PrivateKeyWrapperParserFunction.apply(PrivateKeyWrapperParserFunction.java:39)
2024-02-15 11:52:51     at org.eclipse.edc.iam.did.parser.PrivateKeyWrapperParserFunction.apply(PrivateKeyWrapperParserFunction.java:31)
2024-02-15 11:52:51     at org.eclipse.edc.spi.security.AbstractPrivateKeyResolver$1.parse(AbstractPrivateKeyResolver.java:53)
2024-02-15 11:52:51     at org.eclipse.edc.vault.filesystem.FsPrivateKeyResolver.resolvePrivateKey(FsPrivateKeyResolver.java:74)
2024-02-15 11:52:51     at org.eclipse.edc.iam.did.service.DecentralizedIdentityServiceExtension.identityService(DecentralizedIdentityServiceExtension.java:68)
2024-02-15 11:52:51     ... 25 more
2024-02-15 11:52:51 Caused by: com.nimbusds.jose.JOSEException: unable to convert key pair: java.security.InvalidKeyException: EC domain parameters must be encoded in the algorithm identifier
2024-02-15 11:52:51     at com.nimbusds.jose.jwk.PEMEncodedKeyParser.parseKeys(PEMEncodedKeyParser.java:108)
2024-02-15 11:52:51     at com.nimbusds.jose.jwk.JWK.parseFromPEMEncodedObjects(JWK.java:897)
2024-02-15 11:52:51     at org.eclipse.edc.iam.did.parser.PrivateKeyWrapperParserFunction.apply(PrivateKeyWrapperParserFunction.java:37)
2024-02-15 11:52:51     ... 29 more
2024-02-15 11:52:51 Caused by: org.bouncycastle.openssl.PEMException: unable to convert key pair: java.security.InvalidKeyException: EC domain parameters must be encoded in the algorithm identifier
2024-02-15 11:52:51     at org.bouncycastle.openssl.jcajce.JcaPEMKeyConverter.getKeyPair(Unknown Source)
2024-02-15 11:52:51     at com.nimbusds.jose.jwk.PEMEncodedKeyParser.toKeyPair(PEMEncodedKeyParser.java:131)
2024-02-15 11:52:51     at com.nimbusds.jose.jwk.PEMEncodedKeyParser.parseKeys(PEMEncodedKeyParser.java:95)
2024-02-15 11:52:51     ... 31 more
2024-02-15 11:52:51 Caused by: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyException: EC domain parameters must be encoded in the algorithm identifier
2024-02-15 11:52:51     at jdk.crypto.ec/sun.security.ec.ECKeyFactory.engineGeneratePublic(ECKeyFactory.java:158)
2024-02-15 11:52:51     at java.base/java.security.KeyFactory.generatePublic(KeyFactory.java:351)
2024-02-15 11:52:51     ... 34 more
2024-02-15 11:52:51 Caused by: java.security.InvalidKeyException: EC domain parameters must be encoded in the algorithm identifier
2024-02-15 11:52:51     at jdk.crypto.ec/sun.security.ec.ECPublicKeyImpl.parseKeyBits(ECPublicKeyImpl.java:103)
2024-02-15 11:52:51     at java.base/sun.security.x509.X509Key.decode(X509Key.java:391)
2024-02-15 11:52:51     at java.base/sun.security.x509.X509Key.decode(X509Key.java:402)
2024-02-15 11:52:51     at jdk.crypto.ec/sun.security.ec.ECPublicKeyImpl.<init>(ECPublicKeyImpl.java:71)
2024-02-15 11:52:51     at jdk.crypto.ec/sun.security.ec.ECKeyFactory.implGeneratePublic(ECKeyFactory.java:225)
2024-02-15 11:52:51     at jdk.crypto.ec/sun.security.ec.ECKeyFactory.engineGeneratePublic(ECKeyFactory.java:154)
2024-02-15 11:52:51     ... 35 more

[paullatzelsperger]

Please read carefully the section of the Readme I linked above. It specifically advises against using openssl but to use the KeyStoreExplorer. The error seems to be exactly what is described there.

[zalborzi]

KeyStore Explorer should be used to manage keystores (from UI). Using openssl combined with keytool to obtain a JKS keystore will result in a keystore the EDC cannot read (incompatible inclusion of key parameters).

Thank you!

For those who may face the same error: This indicates that we should not reuse an existing jks file either.