Quarkus Apache Camel Error javax.net.ssl.SSLException java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty

[cesarjv]

Good afternoon, I am currently working with Quarkus 2.16 and Apache Camel 3.20.1, and I have the following error that happens when doing the native compilation with GraalVm and it runs in a Docker container, when I do not apply native compilation there is no problem:

javax.net.ssl.SSLException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
    at java.base@17.0.7/sun.security.ssl.Alert.createSSLException(Alert.java:133)
    at java.base@17.0.7/sun.security.ssl.TransportContext.fatal(TransportContext.java:378)
    at java.base@17.0.7/sun.security.ssl.TransportContext.fatal(TransportContext.java:321)
    at java.base@17.0.7/sun.security.ssl.TransportContext.fatal(TransportContext.java:316)
    at java.base@17.0.7/sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1712)
    at java.base@17.0.7/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:470)
    at java.base@17.0.7/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)
    at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142)
    at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376)
    at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:393)
    at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:236)
    at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:186)
    at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89)
    at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:72)
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:56)
    at org.apache.camel.component.http.HttpProducer.executeMethod(HttpProducer.java:445)
    at org.apache.camel.component.http.HttpProducer.process(HttpProducer.java:273)
    at org.apache.camel.support.AsyncProcessorConverterHelper$ProcessorToAsyncProcessorBridge.process(AsyncProcessorConverterHelper.java:66)
    at org.apache.camel.processor.SendProcessor.process(SendProcessor.java:172)
    at org.apache.camel.impl.engine.CamelInternalProcessor.process(CamelInternalProcessor.java:392)
    at org.apache.camel.processor.Pipeline$PipelineTask.run(Pipeline.java:104)
    at org.apache.camel.impl.engine.DefaultReactiveExecutor$Worker.schedule(DefaultReactiveExecutor.java:181)
    at org.apache.camel.impl.engine.DefaultReactiveExecutor.scheduleMain(DefaultReactiveExecutor.java:59)
    at org.apache.camel.processor.Pipeline.process(Pipeline.java:165)
    at org.apache.camel.impl.engine.CamelInternalProcessor.process(CamelInternalProcessor.java:392)
    at org.apache.camel.component.platform.http.vertx.VertxPlatformHttpConsumer.lambda$handleRequest$2(VertxPlatformHttpConsumer.java:201)
    at io.vertx.core.impl.ContextBase.lambda$null$0(ContextBase.java:137)
    at io.vertx.core.impl.ContextInternal.dispatch(ContextInternal.java:264)
    at io.vertx.core.impl.ContextBase.lambda$executeBlocking$1(ContextBase.java:135)
    at io.quarkus.vertx.core.runtime.VertxCoreRecorder$14.runWith(VertxCoreRecorder.java:576)
    at org.jboss.threads.EnhancedQueueExecutor$Task.run(EnhancedQueueExecutor.java:2449)
    at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1478)
    at org.jboss.threads.DelegatingRunnable.run(DelegatingRunnable.java:29)
    at org.jboss.threads.ThreadLocalResettingRunnable.run(ThreadLocalResettingRunnable.java:29)
    at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
    at java.base@17.0.7/java.lang.Thread.run(Thread.java:833)
    at org.graalvm.nativeimage.builder/com.oracle.svm.core.thread.PlatformThreads.threadStartRoutine(PlatformThreads.java:775)
    at org.graalvm.nativeimage.builder/com.oracle.svm.core.posix.thread.PosixPlatformThreads.pthreadStartRoutine(PosixPlatformThreads.java:203)

My main Rest Route code is like the following:

package org.tmve.customer.ms.route;
import org.apache.camel.builder.RouteBuilder;
import org.apache.camel.model.rest.RestBindingMode;
import org.apache.http.conn.HttpHostConnectException;
import org.eclipse.microprofile.config.inject.ConfigProperty;
import org.tmve.customer.ms.beans.Customer;
import org.tmve.customer.ms.exceptions.InvalidFormatException;
import org.tmve.customer.ms.exceptions.RequiredValueException;
import org.tmve.customer.ms.processor.*;

import javax.enterprise.context.ApplicationScoped;
import java.net.UnknownHostException;
import java.text.SimpleDateFormat;
import java.util.TimeZone;

import static org.apache.camel.model.rest.RestParamType.body;

@ApplicationScoped
public class ResRoute extends RouteBuilder {

    @ConfigProperty(name = "client.findIndividualCustomerByDocId")
    String findIndividualCustomerByDocId;

    @ConfigProperty(name = "client.findOrganizacionCustomerByDocId")
    String findOrganizacionCustomerByDocId;

    @ConfigProperty(name = "path.openapi")
    String pathOpenapi;

    @ConfigProperty(name = "descripcion.servicio")
    String descripcionServicio;

    private ConfigureSsl configureSsl;

    public ResRoute() {
        configureSsl = new ConfigureSsl();
    }


    @Override
    public void configure() throws Exception {

        restConfiguration()
                .bindingMode(RestBindingMode.json)
                .dataFormatProperty("json.in.disableFeatures", "FAIL_ON_UNKNOWN_PROPERTIES")
                .apiContextPath(pathOpenapi)
                .apiProperty("api.title", "FindCustomerByDocId")
                .apiProperty("api.description", descripcionServicio)
                .apiProperty("api.version", "1.0.0")
                .apiProperty("cors", "true");

        rest("/users/")
                .get("/{user_id}/customers").to("direct:/{user_id}/customers")
                .outType(Customer.class)
                .param().name("FindCustomerByDocIdResponse").type(body).description("parametro de salida").required(true)
                .endParam()
                .to("direct:pipeline");

        from("direct:pipeline")
                .doTry()
                .process(new FindCustomerByDocIdProcessorReq())
                .log("\n["+getCurrentDate()+"]"+"User ID: ${exchangeProperty[userId]}")
                .log("\n["+getCurrentDate()+"]"+"Tipo de Documento (Num): ${exchangeProperty[documentTypeNum]}")
                .log("\n["+getCurrentDate()+"]"+"Tipo de Cliente: ${exchangeProperty[customerType]}")
                .choice()
                    .when(simple("${exchangeProperty[customerType]} == 'NATURAL'"))
                        .process(new FindIndividualCustomerByDocIdProcessorReq())
                        .log("\n["+getCurrentDate()+"]"+"Entrada del microservicio FindIndividualCustomerByDocId ${exchangeProperty[findIndividualCustomerByDocIdRequest]}")
                        .to(configureSsl.setupSSLContext(getCamelContext(), findIndividualCustomerByDocId))
                        .process(new FindIndividualCustomerByDocIdProcessorRes())
                        .log("\n["+getCurrentDate()+"]"+"Salida del microservicio FindIndividualCustomerByDocId ${exchangeProperty[findIndividualCustomerByDocIdResponse]}")
                        .log("\n["+getCurrentDate()+"]"+"Salida del microservicio BSS FindCustomerByDocId ${exchangeProperty[findCustomerByDocIdResponse]}")
                    .when(simple("${exchangeProperty[customerType]} == 'JURIDICO'"))
                        .process(new FindOrganizationCustomerByDocIdProcessorReq())
                        .log("\n["+getCurrentDate()+"]"+"Entrada del microservicio FindOrganizationCustomerByDocId ${exchangeProperty[findOrganizationCustomerByDocIdRequest]}")
                        .to(configureSsl.setupSSLContext(getCamelContext(), findOrganizacionCustomerByDocId))
                        .process(new FindOrganizationCustomerByDocIdProcessorRes())
                        .log("\n["+getCurrentDate()+"]"+"Salida del microservicio FindOrganizationCustomerByDocId ${exchangeProperty[findOrganizationCustomerByDocIdResponse]}")
                        .log("\n["+getCurrentDate()+"]"+"Salida del microservicio BSS FindCustomerByDocId ${exchangeProperty[findCustomerByDocIdResponse]}")
                .endChoice()
                .endDoTry()
                .doCatch(RequiredValueException.class)
                .process(new FindCustomerByDocIdProcessorInvalidFormatException())
                .log("\n["+getCurrentDate()+"]"+"Descripcion de la Exception: ${exception.message}")
                .log("\n["+getCurrentDate()+"]"+"Salida del microservicio BSS FindCustomerByDocId: ${exchangeProperty[bodyRs]}")
                .doCatch(HttpHostConnectException.class)
                .process(new FindCustomerByDocIdProcessorHttpHostConectionException())
                .log("\n["+getCurrentDate()+"]"+"Descripcion de la Exception: ${exception.message}")
                .log("\n["+getCurrentDate()+"]"+"Salida del microservicio BSS FindCustomerByDocId: ${exchangeProperty[bodyRs]}")
                .doCatch(InvalidFormatException.class)
                .process(new FindCustomerByDocIdProcessorInvalidFormatException())
                .log("\n["+getCurrentDate()+"]"+"Descripcion de la Exception: ${exception.message}")
                .log("\n["+getCurrentDate()+"]"+"Salida del microservicio BSS FindCustomerByDocId: ${exchangeProperty[bodyRs]}")
                /* .doCatch(NotFoundException.class)
                .process(new FindCustomerByDocIdProcessorInvalidFormatException())
                .log("\n["+getCurrentDate()+"]"+"Salida del microservicio ${exchangeProperty[microserviceName]} ${exchangeProperty[boydResponse]}")
                .log("\n["+getCurrentDate()+"]"+"Salida del BSS FindAccountBalance ${exchangeProperty[bodyRs]}") */
                .doCatch(UnknownHostException.class)
                .process(new FindCustomerByDocIdProcessorInformationSubscriber())
                .log("\n["+getCurrentDate()+"]"+"Descripcion de la Exception: ${exception.message}")
                .log("\n["+getCurrentDate()+"]"+"Salida del microservicio BSS FindCustomerByDocId: ${exchangeProperty[bodyRs]}");
                /*.doCatch(Exception.class)
                .process(new FindCustomerByDocIdProcessorException())
                .log("\n["+getCurrentDate()+"]"+"Descripcion de la Exception ${exception.message}")
                .log("\n["+getCurrentDate()+"]"+"Salida del microservicio BSS FindCustomerByDocId ${exchangeProperty[bodyRs]}");*/
    }

    private String getCurrentDate() {
        String timeStamp ="";
        SimpleDateFormat formatter = new SimpleDateFormat("yyyy-MM-dd'T'HH:mm:ssZ");
        formatter.setTimeZone(TimeZone.getTimeZone("GMT-4"));
        timeStamp= formatter.format(new java.util.Date());
        return timeStamp;
    }
}

The error occurs in the following line in the Class Rest Route, when it makes the call to the configuration of the ConfigureSsl class that I attach below:

Class ConfigureSsl

package org.tmve.customer.ms.route;

import lombok.extern.slf4j.Slf4j;
import org.apache.camel.CamelContext;
import org.apache.camel.Endpoint;
import org.apache.camel.component.http.HttpComponent;
import org.apache.camel.support.jsse.KeyManagersParameters;
import org.apache.camel.support.jsse.KeyStoreParameters;
import org.apache.camel.support.jsse.SSLContextParameters;
import org.apache.camel.support.jsse.TrustManagersParameters;
import org.apache.http.conn.ssl.AllowAllHostnameVerifier;
import org.eclipse.microprofile.config.ConfigProvider;

@Slf4j
public class ConfigureSsl {
    
    private String password = ConfigProvider.getConfig().getValue("client.password", String.class);
    private String resource = ConfigProvider.getConfig().getValue("client.file", String.class);
    
     public Endpoint setupSSLContext(CamelContext camelContext, String url) throws Exception {

            KeyStoreParameters keyStoreParameters = new KeyStoreParameters();
            /*log.info(resource);*/
            /*log.info(password);*/
            keyStoreParameters.setResource(resource);
            keyStoreParameters.setPassword(password);

            KeyManagersParameters keyManagersParameters = new KeyManagersParameters();
            keyManagersParameters.setKeyStore(keyStoreParameters);
            keyManagersParameters.setKeyPassword(password);
            /*log.info("keyManagersParameters "+ keyManagersParameters);*/

            TrustManagersParameters trustManagersParameters = new TrustManagersParameters();
            trustManagersParameters.setKeyStore(keyStoreParameters);
            /*log.info("trustManagersParameters "+ trustManagersParameters);*/

            SSLContextParameters sslContextParameters = new SSLContextParameters();
            sslContextParameters.setKeyManagers(keyManagersParameters);
            sslContextParameters.setTrustManagers(trustManagersParameters);
            /*log.info("sslContextParameters "+ sslContextParameters);*/

            HttpComponent httpComponent = camelContext.getComponent("https", HttpComponent.class);
            httpComponent.setSslContextParameters(sslContextParameters);
            httpComponent.setX509HostnameVerifier(new AllowAllHostnameVerifier());
            /*log.info("httpComponent "+ httpComponent); */

            return httpComponent.createEndpoint(url);
        }

}

Attached my properties file:

#https
quarkus.ssl.native=true
quarkus.http.ssl-port=${PORT:8080}
quarkus.http.read-timeout=${READ_TIMEOUT:30000}
quarkus.http.insecure-requests=disabled
quarkus.http.ssl.certificate.key-store-file=${UBICATION_CERTIFICATE_SSL:srvdevrma1.jks}
quarkus.http.ssl.certificate.key-store-file-type=JKS
quarkus.http.ssl.certificate.key-store-password=${PASSWORD_CERTIFICATE_SSL:service123}
quarkus.http.ssl.certificate.key-store-key-alias=${ALIAS_CERTIFICATE_SSL:srvdevrma1}
quarkus.http.cors=true

client.file=srvdevrma1.jks
client.password=service123

#GlobalVariables
server.variables.msgType=RESPONSE
server.variables.msgTypeError=ERROR
descripcion.servicio=MicroServicio orquestador encargado de realizar la consulta de detalle de facturas para cuentas postpago..

error.400.code=INVALID_ARGUMENT
error.400.message=Client specified an invalid argument, request body or query param

error.403.code=PERMISSION_DENIED
error.403.message=Authenticated user has no permission to access the requested resource

error.404.code=NOT_FOUND
error.404.message=A specified resource is not found

error.500.code=INTERNAL
error.500.message=Server error

error.503.code=UNAVAILABLE
error.503.message=Service unavailable

error.504.code=TIMEOUT
error.504.message=Request timeout exceeded. Try it later

descripcion.servicio=MicroServicio que permite orquestar la busqueda de informacion asociados a clientes Naturales y Juridicos

#endpoints_ms- local
client.findIndividualCustomerByDocId=${UBICATION-URL-FIND-INDIVIDUAL-CUSTOMER-BY-DOC-ID:https://localhost:8081/api/FindIndividualCustomerByDocId}
client.findOrganizacionCustomerByDocId=${UBICATION-URL-FIND-ORGANIZATION-CUSTOMER-BY-DOC-ID:https://localhost:8082/api/FindOrganizationCustomerByDocId}
#timeZone
quarkus.jackson.timezone=${TIME_ZONE:GMT-4}

#Ruta OpenApi
path.openapi=/users/.*/customers/openapi/swagger-ui/
quarkus.camel.openapi.expose.enabled=true
#camel.rest.api-context-path = /openapi.yaml
#quarkus.swagger-ui.urls.camel = /openapi.yaml
#openapi
quarkus.smallrye-openapi.path=/api/FindCustomerByDocId/swagger
#quarkus.swagger-ui.path= /api/FindCustomerByDocId/swagger-ui/
quarkus.swagger-ui.always-include=true

#opentelemetry
quarkus.application.name=FindCustomerByDocId
quarkus.opentelemetry.enabled=true
quarkus.opentelemetry.tracer.exporter.otlp.endpoint=${URL_JAEGER:http://172.28.2.107:4317}
quarkus.log.console.format=%d{HH:mm:ss} %-5p traceId=%X{traceId}, parentId=%X{parentId}, spanId=%X{spanId}, sampled=%X{sampled} [%c{2.}] (%t) %s%e%n
quarkus.http.header."X-Content-Type-Options".value=nosniff
quarkus.http.header."X-Frame-Options".value=DENY
quarkus.http.header."Content-Security-Policy".value=default-src

My pom.xml:

<?xml version="1.0"?>
<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
  <modelVersion>4.0.0</modelVersion>
  <groupId>org.tmve.customer</groupId>
  <artifactId>find-customer-by-doc-id</artifactId>
  <version>1.0.0-SNAPSHOT</version>
  <properties>
    <compiler-plugin.version>3.10.1</compiler-plugin.version>
    <maven.compiler.release>17</maven.compiler.release>
    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
    <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
    <quarkus.platform.artifact-id>quarkus-bom</quarkus.platform.artifact-id>
    <quarkus.platform.group-id>io.quarkus.platform</quarkus.platform.group-id>
    <quarkus.platform.version>2.16.7.Final</quarkus.platform.version>
    <skipITs>true</skipITs>
    <surefire-plugin.version>3.0.0-M7</surefire-plugin.version>
    <jacoco.version>0.8.7</jacoco.version>
    <java.version>17</java.version>
  </properties>
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>${quarkus.platform.group-id}</groupId>
        <artifactId>${quarkus.platform.artifact-id}</artifactId>
        <version>${quarkus.platform.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>${quarkus.platform.group-id}</groupId>
        <artifactId>quarkus-camel-bom</artifactId>
        <version>${quarkus.platform.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-rest-openapi</artifactId>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-bean</artifactId>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-direct</artifactId>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-http</artifactId>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-jackson</artifactId>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-jaxb</artifactId>
    </dependency>

    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-log</artifactId>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-rest</artifactId>
    </dependency>
    <dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-resteasy-jsonb</artifactId>
    </dependency>
    <dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-arc</artifactId>
    </dependency>
    <dependency>
      <groupId>org.projectlombok</groupId>
      <artifactId>lombok</artifactId>
      <version>1.18.22</version>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-openapi-java</artifactId>
    </dependency>
    <dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-smallrye-openapi</artifactId>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>swagger-ui</artifactId>
      <version>4.11.1</version>
    </dependency>
    <dependency>
      <groupId>org.apache.camel.quarkus</groupId>
      <artifactId>camel-quarkus-opentelemetry</artifactId>
    </dependency>
    <dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-opentelemetry-exporter-otlp</artifactId>
    </dependency>
    <dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-junit5</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>io.quarkus</groupId>
      <artifactId>quarkus-jacoco</artifactId>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>io.rest-assured</groupId>
      <artifactId>rest-assured</artifactId>
    </dependency>
  </dependencies>

Dockerfile.native

FROM registry.access.redhat.com/ubi8/ubi-minimal:8.6
WORKDIR /work/
ADD src/main/resources/srvdevrma1.jks /work/srvdevrma1.jks
RUN chown 1001 /work \
    && chmod "g+rwX" /work \
    && chown 1001:root /work
COPY --chown=1001:root target/*-runner /work/application
EXPOSE 8080
USER 1001
ENV TZ="America/Caracas"
CMD ["./application", "-Dquarkus.http.host=0.0.0.0"]

That could be happening? First time this error happens to me

[quarkus-bot[bot]]

/cc @sberyozkin (security)

[sberyozkin]

Looks like srvdevrma1.jks has to be added to the native image

[cesarjv]

How do you do this?

[sberyozkin]

@cesarjv Adding something like quarkus.native.additional-build-args=-H:IncludeResources=.*\\.jks to application.properties should do it