Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

java.io.IOException: Invalid DER: object is not integer (continued) #185

Closed
clouddistortion opened this issue Feb 14, 2018 · 13 comments
Closed

java.io.IOException: Invalid DER: object is not integer (continued) #185

clouddistortion opened this issue Feb 14, 2018 · 13 comments

Comments

@clouddistortion
Copy link

unfortunately I am unable to reopen the task #135 again, so I am posting this question here again.

Hi,

I am trying to get the client api (0.2) up and running but unfortunately I am getting the following error:

2017-12-05 16:21:10 ERROR {main} io.kubernetes.client.util.Config - Failed to invoke build key managers
java.io.IOException: Invalid DER: object is not integer
at io.kubernetes.client.util.SSLUtils$Asn1Object.getInteger(SSLUtils.java:229)
at io.kubernetes.client.util.SSLUtils.next(SSLUtils.java:160)
at io.kubernetes.client.util.SSLUtils.decodePKCS1(SSLUtils.java:155)
at io.kubernetes.client.util.SSLUtils.createKeyStore(SSLUtils.java:100)
at io.kubernetes.client.util.SSLUtils.createKeyStore(SSLUtils.java:78)
at io.kubernetes.client.util.SSLUtils.keyManagers(SSLUtils.java:63)
at io.kubernetes.client.util.Config.fromConfig(Config.java:110)

I tried it with the following code (via config yaml as string and via ~/.kube/config file)

ApiClient apiClient = Config
.fromConfig(configAsString)
//.fromConfig(new FileReader("/Users/me/.kube/config"))
.setVerifyingSsl(false);
Configuration.setDefaultApiClient(apiClient);

kubectl on command line works fine with my config

Do you have any suggestions? Is there anybody whom I can send an example kubeconfig with the keys and certificates for testing? I am not allowed to post it here though.
@brendandburns
Copy link
Contributor

I'd rather not have a working kubeconfig. Is there any chance you can re-create a similar kubeconfig with fake (or deleted) certificates?

@clouddistortion
Copy link
Author

Hi, why not? It's not a problem working with it cause the certificates are created by an in company CA. The ones I have sent you already expired.

Or do you see another issue?

@brendandburns
Copy link
Contributor

brendandburns commented Feb 16, 2018 via email

@clouddistortion
Copy link
Author

Yeah, you re fine. The cluster was removed a couple of weeks again - also only available within the local company network

@brendandburns
Copy link
Contributor

brendandburns commented Feb 17, 2018 via email

@clouddistortion
Copy link
Author

Hi, to [email protected]

@brendandburns
Copy link
Contributor

Ok, I found the problem.

We are hard-coding "RSA" here:

java/util/src/main/java/io/kubernetes/client/util/credentials/ClientCertificateAuthentication.java

Line 29 in 505a812

final KeyManager[] keyManagers =

And your key is an eliptical curve key.

For now, you need to use an RSA key, or manually edit the library SSHUtils.java code to change 'RSA' to 'EC'

I'll work to add EC support to the library...

@brendandburns
Copy link
Contributor

I took a stab at EC support today, it did not end well... I think the short term fix is to convert to RSA. I'll continue to try to convince Java to load an EC key, but it might take a while...

@brendandburns brendandburns mentioned this issue Feb 23, 2018
Merged
@brendandburns
Copy link
Contributor

Ok, that took longer than it should have, but the fix is now in PR, I'd love it if you could try it out and verify...

@clouddistortion
Copy link
Author

Hi,
just had a quick test and I am not sure if I am doin sth wrong now. This is the code I quickly tried:

ApiClient client = Config.fromConfig("/Users/minime/Desktop/kubeconfig");
Configuration.setDefaultApiClient(client);

CoreV1Api api = new CoreV1Api();
V1PodList list = api.listPodForAllNamespaces(null, null, null, null, null, null, null, null, null);
for (V1Pod item : list.getItems()) {
    System.out.println(item.getMetadata().getName());
}

seems like the certificates are empty (see IllegalArgumentException)

ApiClient.applySslSettings

else if (sslCaCert != null) {
     char[] password = null; // Any password will work.

     CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");

     Collection<? extends Certificate> certificates = certificateFactory.generateCertificates(sslCaCert);
     if (certificates.isEmpty()) {
         throw new IllegalArgumentException("expected non-empty set of trusted certificates");
     }
}

@ceeaspb
Copy link
Contributor

ceeaspb commented Feb 23, 2018

@jevin36 looks like I may have hit the same thing in #197

@karthikkondapally
Copy link
Contributor

karthikkondapally commented Feb 23, 2018 •
edited
Loading

@jevin36

initially verifySSL by default was false. but after push #175, verifySSL by default is true.
Even i got the error:
Exception in thread "main" java.lang.IllegalArgumentException: expected non-empty set of trusted certificates
but if you add insecure-skip-tls-verify: true in (kubeconfig.yaml in cluster section)
it works then.

we can also skip verify ssl instead of adding above key value pair to config

ApiClient client = ClientBuilder
				   .kubeconfig(KubeConfig.loadKubeConfig(new FileReader("/home/karthik/.kube/config")))
				   .setVerifyingSsl(false)
				   .build();

@clouddistortion
Copy link
Author

#198 fixes the problem correctly for me too

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@clouddistortion @brendandburns @ceeaspb @karthikkondapally