title: TrustStore fails to init but KeyStore successful
body: <p>I am trying to configure Tomcat so that my web application can use LDAPS. It all works fine on the UAT server but for some reason the production server cannot initialize the trust store.
  I have turned on debugging (via <code>-Djavax.net.debug=all</code>) and the error is:</p>
  
  <blockquote>
    <p>default context init failed: java.io.IOException: Keystore was tampered with, or password was incorrect</p>
  </blockquote>
  
  <p>I am 100% sure that the password is correct, as I have run keytool and listed the contents of the truststore, as well as taken the same file from the working UAT server.</p>
  
  <p>As an experiment, I configured Tomcat to use the same store file for both keystore and truststore (I realise this is not a typical setup, but from my understanding the file formats etc are the same so they should both load):</p>
  
  <p><code>-Djavax.net.ssl.trustStorePassword=xxx
  -Djavax.net.ssl.trustStore=C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\.keystore
  -Djavax.net.ssl.keyStorePassword=xxx
  -Djavax.net.ssl.keyStore=C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin\.keystore</code></p>
  
  <p>and the keystore works:</p>
  
  <blockquote>
    <p>keyStore is : C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin.keystore <br>
    keyStore type is : jks <br>
    keyStore provider is : <br> 
    init keystore <br> init keymanager of type SunX509
    *** <br> found key for : tomcat</p>
  </blockquote>
  
  <p>whilst the truststore fails.. for the <em>same file and password!</em>:</p>
  
  <blockquote>
    <p>trustStore is: C:\Program Files\Apache Software Foundation\Tomcat 7.0\bin.keystore<br>
    trustStore type is : jks<br>
    trustStore provider is : <br>
    init truststore<br>
    default context init failed: java.io.IOException: Keystore was tampered with, or password was incorrect</p>
  </blockquote>
  
  <p>From the web application the stack trace has some more detail (whether it helps I'm not sure.. I studied the java source for TrustManagerFactoryImpl and matched it with the logging but it didn't explain the behaviour)</p>
  
  <pre><code>javax.naming.CommunicationException: &lt;ldap url&gt;:636 [Root exception is java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)]
      at com.sun.jndi.ldap.Connection.&lt;init&gt;(Unknown Source)
      at com.sun.jndi.ldap.LdapClient.&lt;init&gt;(Unknown Source)
      at com.sun.jndi.ldap.LdapClient.getInstance(Unknown Source)
      at com.sun.jndi.ldap.LdapCtx.connect(Unknown Source)
      at com.sun.jndi.ldap.LdapCtx.&lt;init&gt;(Unknown Source)
      at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(Unknown Source)
      at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(Unknown Source)
      at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(Unknown Source)
      at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(Unknown Source)
      at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
      at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
      at javax.naming.InitialContext.init(Unknown Source)
      at javax.naming.InitialContext.&lt;init&gt;(Unknown Source)
      at javax.naming.directory.InitialDirContext.&lt;init&gt;(Unknown Source)
      at com.mycompany.fde.util.LDAPHelper.initialBindSSL(LDAPHelper.java:116)
      at com.mycompany.fde.util.LDAPHelper.&lt;init&gt;(LDAPHelper.java:91)
      at com.mycompany.fde.util.LDAPHelper.getInstance(LDAPHelper.java:58)
      at com.mycompany.fde.server.work.StartupWork.startupStage1(StartupWork.java:224)
      at com.mycompany.fde.server.work.StartupWork.call(StartupWork.java:121)
      at com.mycompany.fde.server.work.StartupWork.call(StartupWork.java:47)
      at java.util.concurrent.FutureTask.run(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
      at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
      at java.lang.Thread.run(Unknown Source)
  Caused by: java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
      at javax.net.ssl.DefaultSSLSocketFactory.throwException(Unknown Source)
      at javax.net.ssl.DefaultSSLSocketFactory.createSocket(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
      at java.lang.reflect.Method.invoke(Unknown Source)
      at com.sun.jndi.ldap.Connection.createSocket(Unknown Source)
      ... 24 more
  Caused by: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)
      at java.security.Provider$Service.newInstance(Unknown Source)
      at sun.security.jca.GetInstance.getInstance(Unknown Source)
      at sun.security.jca.GetInstance.getInstance(Unknown Source)
      at javax.net.ssl.SSLContext.getInstance(Unknown Source)
      at javax.net.ssl.SSLContext.getDefault(Unknown Source)
      at javax.net.ssl.SSLSocketFactory.getDefault(Unknown Source)
      ... 29 more
  Caused by: java.io.IOException: Keystore was tampered with, or password was incorrect
      at sun.security.provider.JavaKeyStore.engineLoad(Unknown Source)
      at sun.security.provider.JavaKeyStore$JKS.engineLoad(Unknown Source)
      at java.security.KeyStore.load(Unknown Source)
      at sun.security.ssl.TrustManagerFactoryImpl.getCacertsKeyStore(Unknown Source)
      at sun.security.ssl.SSLContextImpl$DefaultSSLContext.getDefaultTrustManager(Unknown Source)
      at sun.security.ssl.SSLContextImpl$DefaultSSLContext.&lt;init&gt;(Unknown Source)
      at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
      at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
      at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
      at java.lang.reflect.Constructor.newInstance(Unknown Source)
      ... 35 more
  Caused by: java.security.UnrecoverableKeyException: Password verification failed
      ... 45 more
  </code></pre>
  
  <p>I'm at a complete loss - any help/ideas would be much appreciated!</p>