Changing password of cacerts file prior to JRE upgrade causes error: Failed to load the jvm key store using the default password or specified password - Known Error

Changing password of cacerts file prior to JRE upgrade causes error: Failed to load the jvm key store using the default password or specified password Description Changing password of cacerts file prior to JRE upgrade causes this error in the agent logs: Failed to load the jvm key store using the default password or specified password

Steps to Reproduce

1. Set up a MID Server with an older JRE version e.g. an Orlando/JRE 8 install. 2. Change the trustStore password of the jre/lib/security/cacerts file (keytool -storepasswd -keystore /agent/jre/lib/security/cacerts). From "changeit" to something else. 3. In conf/wrapper-override.conf add the following: wrapper.java.additional.4=-Djavax.net.ssl.trustStorePassword= 4. Upgrade MID to one with a newer JRE. e.g. Quebec/JRE 11.

You will observe errors in agent logs but mid should upgrade successfully.

02/02/21 15:32:55 (992) AutoUpgrade.3600 SEVERE *** ERROR *** Failed to load the jvm key store using the default password or specified password! java.io.IOException: Keystore was tampered with, or password was incorrect at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:785) at sun.security.provider.JavaKeyStore$JKS.engineLoad(JavaKeyStore.java:56) at sun.security.provider.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:224) at sun.security.provider.JavaKeyStore$DualFormatJKS.engineLoad(JavaKeyStore.java:70) at java.security.KeyStore.load(KeyStore.java:1445) at com.glide.communications.GlideTrustStoreManager.loadCacertsKeyStore(GlideTrustStoreManager.java:49) at com.service_now.mid.security.policy.MIDTLSPolicy.getTrustManager(MIDTLSPolicy.java:111) at com.glide.communications.GlideSSLProtocolSocketFactory.createGlideSSLContext(GlideSSLProtocolSocketFactory.java:154) at com.glide.communications.GlideSSLProtocolSocketFactory.getSSLContext(GlideSSLProtocolSocketFactory.java:210) at com.glide.communications.GlideSSLProtocolSocketFactory.createSocket(GlideSSLProtocolSocketFactory.java:265) at org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707) at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.open(MultiThreadedHttpConnectionManager.java:1361) at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387) at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171) at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) at com.glide.communications.HTTPClient.doExecute(HTTPClient.java:497) at com.glide.communications.HTTPClient.doExecute(HTTPClient.java:462) at com.glide.communications.HTTPClient.executeMethod(HTTPClient.java:380) at com.glide.communications.HTTPDownloader.downloadUrl(HTTPDownloader.java:108) at com.service_now.mid.util.PackageDownloader.fromUrlWithRetry(PackageDownloader.java:25) at com.service_now.mid.dist.upgrade.MIDUpgrader.downloadCheckFileFromUpgradeServer(MIDUpgrader.java:478) at com.service_now.mid.dist.upgrade.MIDUpgrader.runJavaTests(MIDUpgrader.java:426) at com.service_now.mid.dist.upgrade.MIDUpgrader.runPreUpgradeCheck(MIDUpgrader.java:408) at com.service_now.monitor.AutoUpgrade.attemptUpgrade(AutoUpgrade.java:165) at com.service_now.monitor.AutoUpgrade.run(AutoUpgrade.java:111) at com.service_now.monitor.AMonitor.runit(AMonitor.java:155) at com.service_now.monitor.AMonitor.access$200(AMonitor.java:44) at com.service_now.monitor.AMonitor$MonitorTask.execute(AMonitor.java:148) at com.service_now.monitor.base.AMonitorTask.run(AMonitorTask.java:29) at java.util.TimerThread.mainLoop(Timer.java:555) at java.util.TimerThread.run(Timer.java:505) Caused by: java.security.UnrecoverableKeyException: Password verification failed at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:783) ... 30 more Workaround After carefully considering the severity and frequency of this problem and the risk of attempting a fix, it has been decided to not address this issue in any current or future releases. We do not make these decisions lightly, and we apologize for any inconvenience.

This error does not prevent the MID Server upgrade completing.