Cannot create or update Business Cards

[horacis]

Hello

We upgraded smp from 6.0.7 to 7.2.0. Create or update of Business Cards in version 6.0.7 works fine.

In version 7.2.0 (on Apache Tomcat 10.1.34 using java 11 (11.0.25+9-post-Ubuntu-1ubuntu124.04)) we have an issue:
Found no certificate alias matching 'pop000203-smp' in the provided aliases [].
Is it known issue or it is due to wrong configuration?

From log:
[2025-01-30T09:08:42,068] [SMP-SERVER] [INFO ] [http-nio-9090-exec-3] PD client uses disabled hostname verification -- com.helger.pd.client.PDHttpClientSettings.resetToConfiguration(PDHttpClientSettings.java:110)
[2025-01-30T09:08:42,071] [SMP-SERVER] [INFO ] [http-nio-9090-exec-3] PD client keystore successfully loaded -- com.helger.pd.client.PDHttpClientSettings.resetToConfiguration(PDHttpClientSettings.java:123)
[2025-01-30T09:08:42,072] [SMP-SERVER] [INFO ] [http-nio-9090-exec-3] PD client key successfully loaded -- com.helger.pd.client.PDHttpClientSettings.resetToConfiguration(PDHttpClientSettings.java:134)
[2025-01-30T09:08:42,074] [SMP-SERVER] [INFO ] [http-nio-9090-exec-3] PD client truststore successfully loaded -- com.helger.pd.client.PDHttpClientSettings.resetToConfiguration(PDHttpClientSettings.java:143)
[2025-01-30T09:08:42,087] [SMP-SERVER] [INFO ] [http-nio-9090-exec-3] PD client successfully set SSL context -- com.helger.pd.client.PDHttpClientSettings.resetToConfiguration(PDHttpClientSettings.java:155)
[2025-01-30T09:08:42,845] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,846] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,846] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,846] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,846] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,847] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,847] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,847] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,847] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,847] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,848] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,848] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,848] [SMP-SERVER] [WARN ] [http-nio-9090-exec-3] Found no certificate alias matching 'pop000203-smp' in the provided aliases [] -- com.helger.httpclient.security.PrivateKeyStrategyFromAliasCaseInsensitive.chooseAlias(PrivateKeyStrategyFromAliasCaseInsensitive.java:102)
[2025-01-30T09:08:42,924] [SMP-SERVER] [ERROR] [http-nio-9090-exec-3] Internal error in addServiceGroupToIndex for iso6523-actorid-upis::9949:bizbox:test -- com.helger.pd.client.PDClient.lambda$_createDefaultExCb$0(PDClient.java:62)
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[?:?]
at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117) ~[?:?]
at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:353) ~[?:?]
at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293) ~[?:?]
at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:192) ~[?:?]
at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172) ~[?:?]
at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1514) ~[?:?]

[phax]

Hi, it seems like your Peppol Directory keystore configuration is invalid (it can't find an alias).

Please use the following configuration for the Directory client:

## Directory client

pdclient.keystore.type         = ${smp.keystore.type}
pdclient.keystore.path         = ${smp.keystore.path}
pdclient.keystore.password     = ${smp.keystore.password}
pdclient.keystore.key.alias    = ${smp.keystore.key.alias}
pdclient.keystore.key.password = ${smp.keystore.key.password}

pdclient.truststore.type     = ${smp.truststore.type}
pdclient.truststore.path     = ${smp.truststore.path}
pdclient.truststore.password = ${smp.truststore.password}

Note: The usage of variables inside the config file is new.

Afterwards, restart SMP. Than also open "Certificate Information" page and check if everything is green.

[horacis]

Hi

Thank you for response.

We already had those properties in application.properties:

Directory client

pdclient.keystore.type = ${smp.keystore.type}
pdclient.keystore.path = ${smp.keystore.path}
pdclient.keystore.password = ${smp.keystore.password}
pdclient.keystore.key.alias = ${smp.keystore.key.alias}
pdclient.keystore.key.password = ${smp.keystore.key.password}

pdclient.truststore.type = ${smp.truststore.type}
pdclient.truststore.path = ${smp.truststore.path}
pdclient.truststore.password = ${smp.truststore.password}

and also down below:

Keystore data

The path maybe within the classpath or an absolute file path

smp.keystore.type = jks
smp.keystore.path = /app/Tomcat/apache-tomcat-10.1.34/conf/phax/keystore/smp-keystore.jks
smp.keystore.password = ************
smp.keystore.key.alias = pop000203-smp
smp.keystore.key.password = ************

This default truststore handles the Peppol PKIs (packed into the application via peppol-commons.jar)

smp.truststore.type = jks
smp.truststore.path = /app/Tomcat/apache-tomcat-10.1.34/conf/phax/keystore/complete-truststore.jks
smp.truststore.password = ********************

Certificate looks OK:

But still an issue:

[phax]

Okay, thanks for the swift response - that indeed looks good :)
Can you please check in "Administration | SMP Settings" whether you are using "https://test-directory.peppol.eu" as the Directory URL?

Edit: you don't need to copy the file complete-truststore.jks - by using the path truststore/complete-truststore.jks it is taken from a shipped JAR file

[horacis]

Hi,

Thank you for help provided.

There was wrong URL set. I had to change URL to https://test-directory.peppol.eu/

Sorry to bother you.

Thank you again.

Best regards.

[phax]

Excellent - great to hear :) Happy peppoling