Cannot find key for certificate in keystore

[AlexandruCiobanu]

Hi Phil,
I have a strange issue with the inbound server. We receive messages form a third party that fail with Cannot find key for certificate in keystore of type [PKCS12] from provider [SUN version 11] with size [1] and aliases: {psgOURID}. I am not sure why it happens because we receive many other payloads form other parties and we do not encounter this issue. The psgOURID is redacted of course, but it is our peppol id. I see that for other inbounds it does spil the right message that it is using the right alias, our peppol id and that it found it.
Do you have any idea why this would happen?

Thanks,
Alex

[2024-02-07T22:49:02,638] [PEPPOL] [INFO ] [http-nio-18080-exec-1] Logging incoming AS4 message to '/home/as2/as4-peppol-server/as4dump/2024/02/07/224902-476-0250c4f4-a1c1-4f65-a253-8754249f5b16.as4in' including headers -- com.helger.phase4.dump.AS4IncomingDumperFileBased.openOutputStream(AS4IncomingDumperFileBased.java:132)
[2024-02-07T22:49:02,651] [PEPPOL] [ERROR] [http-nio-18080-exec-1] Cannot find key for certificate in keystore of type [PKCS12] from provider [SUN version 11] with size [1] and aliases: {psgOURID} -- org.apache.wss4j.common.crypto.Merlin.getPrivateKey(Merlin.java:631)
[2024-02-07T22:49:02,652] [PEPPOL] [ERROR] [http-nio-18080-exec-1] Error processing the WSSSecurity Header -- com.helger.phase4.servlet.soap.SOAPHeaderElementProcessorWSS4J._verifyAndDecrypt(SOAPHeaderElementProcessorWSS4J.java:315)
org.apache.wss4j.common.ext.WSSecurityException: Cannot find key for certificate
	at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.getPrivateKey(EncryptedKeyProcessor.java:269) ~[wss4j-ws-security-dom-3.0.2.jar:3.0.2]
	at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:225) ~[wss4j-ws-security-dom-3.0.2.jar:3.0.2]
	at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.handleToken(EncryptedKeyProcessor.java:90) ~[wss4j-ws-security-dom-3.0.2.jar:3.0.2]
	at org.apache.wss4j.dom.engine.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:340) ~[wss4j-ws-security-dom-3.0.2.jar:3.0.2]
	at org.apache.wss4j.dom.engine.WSSecurityEngine.processSecurityHeader(WSSecurityEngine.java:251) ~[wss4j-ws-security-dom-3.0.2.jar:3.0.2]
	at com.helger.phase4.servlet.soap.SOAPHeaderElementProcessorWSS4J._verifyAndDecrypt(SOAPHeaderElementProcessorWSS4J.java:179) ~[phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.soap.SOAPHeaderElementProcessorWSS4J.processHeaderElement(SOAPHeaderElementProcessorWSS4J.java:503) ~[phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4IncomingHandler._processSoapHeaderElements(AS4IncomingHandler.java:466) ~[phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4IncomingHandler.processEbmsMessage(AS4IncomingHandler.java:635) ~[phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4RequestHandler._handleSoapMessage(AS4RequestHandler.java:1389) ~[phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4RequestHandler.lambda$handleRequest$5(AS4RequestHandler.java:1846) ~[phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4IncomingHandler.parseAS4Message(AS4IncomingHandler.java:366) [phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4RequestHandler.handleRequest(AS4RequestHandler.java:1865) [phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4RequestHandler.handleRequest(AS4RequestHandler.java:1904) [phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4XServletHandler.handleRequest(AS4XServletHandler.java:436) [phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.phase4.servlet.AS4XServletHandler.handleRequest(AS4XServletHandler.java:474) [phase4-lib-2.7.5-SNAPSHOT.jar:2.7.5-SNAPSHOT]
	at com.helger.xservlet.handler.simple.XServletHandlerToSimpleHandler.onRequest(XServletHandlerToSimpleHandler.java:241) [ph-xservlet-10.1.7.jar:10.1.7]
	at com.helger.xservlet.AbstractXServlet._invokeHandler(AbstractXServlet.java:355) [ph-xservlet-10.1.7.jar:10.1.7]
	at com.helger.xservlet.AbstractXServlet.service(AbstractXServlet.java:540) [ph-xservlet-10.1.7.jar:10.1.7]
	at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658) [servlet-api.jar:6.0]
	at com.helger.xservlet.AbstractXServlet.service(AbstractXServlet.java:596) [ph-xservlet-10.1.7.jar:10.1.7]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:205) [catalina.jar:10.1.9]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [catalina.jar:10.1.9]
	at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) [tomcat-websocket.jar:10.1.9]
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [catalina.jar:10.1.9]
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [catalina.jar:10.1.9]
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:166) [catalina.jar:10.1.9]
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) [catalina.jar:10.1.9]
	at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482) [catalina.jar:10.1.9]
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115) [catalina.jar:10.1.9]
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) [catalina.jar:10.1.9]
	at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:676) [catalina.jar:10.1.9]
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [catalina.jar:10.1.9]
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:341) [catalina.jar:10.1.9]
	at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391) [tomcat-coyote.jar:10.1.9]
	at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) [tomcat-coyote.jar:10.1.9]
	at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:894) [tomcat-coyote.jar:10.1.9]
	at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1741) [tomcat-coyote.jar:10.1.9]
	at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) [tomcat-coyote.jar:10.1.9]
	at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) [tomcat-util.jar:10.1.9]
	at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) [tomcat-util.jar:10.1.9]
	at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-util.jar:10.1.9]
	at java.base/java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: org.apache.wss4j.common.ext.WSSecurityException: Cannot find key for certificate
	at org.apache.wss4j.common.crypto.Merlin.getPrivateKey(Merlin.java:632) ~[wss4j-ws-security-common-3.0.2.jar:3.0.2]
	at org.apache.wss4j.dom.processor.EncryptedKeyProcessor.getPrivateKey(EncryptedKeyProcessor.java:265) ~[wss4j-ws-security-dom-3.0.2.jar:3.0.2]
	... 42 more
[2024-02-07T22:49:02,656] [PEPPOL] [ERROR] [http-nio-18080-exec-1] Failed to process SOAP header element {http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd}Security with processor com.helger.phase4.servlet.soap.SOAPHeaderElementProcessorWSS4J@423a9c76; error details: [[Ebms3Error@0x5fe886d0: category=Processing; description=[Ebms3Description@0x7589479d: lang=en; value=The encrypted data reference the Security header intended for the "ebms" SOAP actor could not be decrypted by the Security Module.]; errorCode=EBMS:0102; errorDetail=Error processing the WSSSecurity Header: Technical details: org.apache.wss4j.common.ext.WSSecurityException - Cannot find key for certificate; origin=null; refToMessageInError=null; severity=failure; shortDescription=FailedDecryption]] -- com.helger.phase4.servlet.AS4IncomingHandler._processSoapHeaderElements(AS4IncomingHandler.java:480)
[2024-02-07T22:49:02,661] [PEPPOL] [INFO ] [http-nio-18080-exec-1] Now signing AS4 message [SOAP_12]. KeyIdentifierType=BST_DIRECT_REFERENCE; KeyAlias=psg000308; SignAlgo=http://www.w3.org/2001/04/xmldsig-more#rsa-sha256; DigestAlgo=http://www.w3.org/2001/04/xmlenc#sha256; C14NAlgo=http://www.w3.org/2001/10/xml-exc-c14n# -- com.helger.phase4.messaging.crypto.AS4Signer._createSignedMessage(AS4Signer.java:80)
[2024-02-07T22:49:02,674] [PEPPOL] [INFO ] [http-nio-18080-exec-1] Processing AS4 response message -- com.helger.phase4.peppol.server.spi.StoringServletMessageProcessorSPI.processAS4ResponseMessage(StoringServletMessageProcessorSPI.java:235)
[2024-02-07T22:49:02,674] [PEPPOL] [INFO ] [http-nio-18080-exec-1] Wrote response to '/home/as2/as4-peppol-server/as4dump/2024/02/07/224902-477-0250c4f4-a1c1-4f65-a253-8754249f5b16.response' (5996 bytes) -- com.helger.phase4.peppol.server.spi.StoringServletMessageProcessorSPI.processAS4ResponseMessage(StoringServletMessageProcessorSPI.java:249)
[2024-02-07T22:49:02,675] [PEPPOL] [INFO ] [http-nio-18080-exec-1] Logging outgoing AS4 message to '/home/as2/as4-peppol-server/as4dump/2024/02/07/[email protected]' including headers -- com.helger.phase4.dump.AS4OutgoingDumperFileBased.openOutputStream(AS4OutgoingDumperFileBased.java:145)
[2024-02-07T22:49:02,675] [PEPPOL] [INFO ] [http-nio-18080-exec-1] Wrote metadata to '/home/as2/as4-peppol-server/as4dump/2024/02/07/224902-479-0250c4f4-a1c1-4f65-a253-8754249f5b16.metadata' -- com.helger.phase4.peppol.server.servlet.Phase4PeppolWebAppListener$1.onEndRequest(Phase4PeppolWebAppListener.java:193)

[phax]

That is most likely caused by the sender using the wrong certificate to encrypt the message.
Evtl. they skipped the SMP lookup?

[AlexandruCiobanu]

I was suspecting that much, thanks for confirming.