"IOException: parseAlgParameters failed: ObjectIdentifier()" error on startup after securing connection to Elasticsearch with PKCS#12 certificate generated with a higher major version of JDK

Issue

• Liferay DXP does not start up after securing the connection to Elasticsearch and, more specifically, after generating the Elasticsearch certificate .p12 using the keytool in a JDK with a higher major version than the one in which Liferay DXP is running. For example: Liferay DXP is using JDK8 and you are generating Elasticsearch certs using JDK 11.
• The error shown is:

  The activate method has thrown an exception
  
  java.lang.RuntimeException: java.io.IOException: parseAlgParameters failed: ObjectIdentifier() -- data isn't an object ID (tag = 48)
  
  at com.liferay.portal.search.elasticsearch7.internal.connection.RestHighLevelClientFactory.createSSLContext(RestHighLevelClientFactory.java:172)

 

Environment

• Liferay DXP using JDK version 8
• PKCS#12 certificate (.p12) generated with a JDK version greater than 8.

 

Resolution

This is a JDK bug. You can do the following:

• A.) Use the same version of JDK in both Liferay and Elasticsearch servers
• B.) Use JKS format instead of PKCS12 for the Keystore

 

Additional Information

• JDK-8202837 : PBES2 AlgorithmId encoding error in PKCS12 KeyStore
• JDK-8267837 : JDK 7u/8u PKCS12KeyStore.parseAlgParameters exception
• Securing Elasticsearch
• Support Coverage