Domino and No trusted certificate found

We have few agents that communicate with other systems via and today at 13:00 we got such answer from Domino when we tried to set connection with external system. That was a huge problem for us since it affect our business.

 javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: No trusted certificate found  
  at com.ibm.jsse2.o.a(o.java:8)  
  at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:549)  
  at com.ibm.jsse2.kb.a(kb.java:355)  
  at com.ibm.jsse2.kb.a(kb.java:130)  
  at com.ibm.jsse2.lb.a(lb.java:135)  
  at com.ibm.jsse2.lb.a(lb.java:368)  
  at com.ibm.jsse2.kb.s(kb.java:442)  
  at com.ibm.jsse2.kb.a(kb.java:136)  
  at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:495)  
  at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:223)  
  at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:724)  
  at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:81)  
  at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:8)  
  at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:20)  

It took some time to fix it, but here is a solution

Problem

A Java application running on a Domino server connecting over SSL to another server may require having the SSL certificate authority of the other server imported into its JVM.

Symptom

When a Java application running on a Domino server connects over SSL to another server, but does not have that server's trusted root certificates, an error may occur. One example of such an error is: HTTP JVM: javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.g: No trusted certificate found.

Cause

The trusted root certificates that signed the remote server's SSL certificate must be also be trusted by the Domino server's JVM if a Java application is making an SSL connection.

Resolving the problem

To add the trusted root certificates to a Domino server JVM follow these steps:

A. Obtain the Certificate to be Imported

Each browser displays certificates in different ways, but they are usually quite similar. On the browser's URL bar, there is usually a zone that you can click on to display SSL certificate information. For example, you may see a padlock in the status bar, and clicking on the padlock opens the certificate information. Once the certificate information is open, click on the "Certification Path" informatino. There normally will be a way to export each of the signing certificates (trusted roots). Export the certifiers in the "Base-64 encoded X.509 (.CER)" format. The exported file in this format will be an ASCII text file that has "BEGIN CERTIFICATE" and "END CERTIFICATE" lines at the top and bottom. Once you have exported the certificates that signed the remote server's SSL certificate you can then import them into the JVM.

B. Import the SSL certifier into the JVM.

If Domino is on a UNIX server, perform these steps on a Windows workstation, and then move the cacerts to the server after the import is completed.

Import the SSL Certificate into the JVM using these steps:

• Open a command line and change directory to C:\Lotus\Domino\jvm\bin.
• Run the batch file "IKEYMAN.exe" (a Java application will load).
• Click "Key Database File" then "Open".
• Browse to C:\Lotus\Domino\jvm\lib\security\cacerts. Note, you will have to view "All Files" to locate cacerts.
• Supply the default password of "changeit". Note, consult your administrator if you receive an error pertaining to the password.
• Select "Signer Certificates" in the drop-down menu.
• Click "Add"
• Select "Browse" and locate the .CER file you copied.
• Click "OK" and enter a descriptive label.
• On the Domino console issue the command "restart task http".

Original link I found on IBM Importing an SSL Certificate Authority into the JVM

Related topics:
IBM Domino Java: No trusted certificate found. Fail?
Domino and No trusted certificate found
Disabling certificate validation in Java

Issues when developing IBM Domino Notes applications

Some minor stuff about Domino Designer.

• Undo/'Ctrl+Z' does does not work properly when you developing in Lotus Script, if you do it few times it might mess your code
• 'Ctrl+C'/'Ctrl+V' sometimes does not work from first attempt, so you need to do it twice
• 'Ctrl+C'/'Ctrl+V' sometimes it sets focus on penultimate character so you have to do 1 extra actions to continue write code
• I still have crashes in Domino Designer without any reasons and I've no customization to my Designer
• I'm not happy about speed in Designer, however maybe I expect to much

It is 2013 and Ctrl+Z still work odd, how could it be?
Do you have something to add to that list? :) Please - comments about that!

IBM Designer Java Console effect?

I've faced up with interesting problems. I'm doing integration between MailChimp and Domino application. MailChimp service has very good API so it was not huge problem to push/poll data to/from it and we already implemented solution based on Java. The fun started when I tried to do LS2J part. My first request to java method came up with this dialog

That error does not happen if I enable Java Console in IBM Domino Designer. When Console is up - everything works perfect, otherwise this error:

LS2J Error: Threw java.lang.SecurityException: not allowed to access members in class interface java.util.Map

I can't explain how Java Console affect my security level, however definitely it does. I think it possibly grant users with more access when it is running and maybe there is an explanation why. Does anybody of you can explain that?

How we cook GitHub, Jira and Jenkins with Domino

Why would I use it?

I'll describe briefly how we use GitHub, Jira and Jenkins together to make better development process. More details will come later when I get some desire :). OK, lets look what benefits we have from using these tools.

GitHub with Jenkins

GitHub has number of Service Hooks and one of them is for Jenkins. It allows to trigger build jobs when pushes are made to GitHub. You don't need to have any skill to do that, let's look on screen below. So once you made a push, Jenkins start to work.

GitHub with JIRA

It's possible to made connection between JIRA and GitHub, so once you made push to GitHub JIRA will update related ticket, you only need to specify ticket number in comments. As a result you will have history with commits directly in JIRA ticket. Let's look on ticket I've closed few days ago.

You can see what exactly have been done in order to fix the ticket. Also you can get more details if you wish, you only need to click on any of those updated files and then you will see that

Jenkins and Domino

That is most complicated part. In order to synchronize changes from GitHub to Domino application we use Jenkins (if you remember once push happens we trigger hook on Jenkins). Unfortunately there are no plugins that could do that, instead you have to write your own. That's it why we have ~60 seconds delay (I mentioned it in previous posts) after push.

Summary

For me JIRA and GitHub is de facto standard our days. Jenkins in our case is necessary to use in order to push changes from GitHub to Domino. It's a bit complicated process so you need before, if it is really what you need.

Other articles in this series

1. How we build our web applications based on Domino
2. Split back-end and front-end areas, they should not block each other and be independent as much as it is possible.
3. Front-end guys should not have any knowledge about Domino, they don't need IBM Designer installed at all.
4. Back-end guys must have knowledge about Domino, however they don't need to use IBM Designer, only in very rare cases. Backend should be done using only Java (no LS/SSJS/@Formula etc)
5. Using Git+Jira is must and Jenkins server as builder server
6. Auto-tests.

Java as backend for web applications based on Domino

Is it enough to use only Java?

Yes. Our newly created applications have been written only for web and we did all back-end with Java only (the only exclusions are selection for Views). No, we do not miss @Formula, Lotus Script or SSJS, we simply do not need those languages in our daily work. Java is better than LS/SSJS for us. You can develop much better/faster using Java and get all candies: open sources, forums, stackoverflow or even shift at some point to Java completely if it has sense for you. However, if you read my main posts I mentioned that we still had some problems while work with Java, Solution isn't really perfect and let me explain all those weakness we have right now.

• Domino has 2 Java runtimes (huge pain for us): one is for xPages and another one for Java Libraries+Agents. Java Libraries can be reuse in xPages and back JAVA/JAR are not accessible from Libraies/Agents. Our Java libraries are core for xPages and it means we have to build JAR from them and include them for xPages. It takes time and we really do not like that, it simply looks wrong. The solution is to put JAR to Domino OS, however we are limited with access to Domino's OS. Due to that fact we have one serious disadvantage - our JAR files that we attached to Libraries and Agents have to be extracted and loaded to memory each time we run agents.
• We are forced to use IBM Designer (and few of us would like to work in different IDE). As I mentioned we work via GitHub and it takes some time to build project (developer -> github -> jenkins -> domino). That's not a problem for FE, as they can do their tasks locally and after all just commit changes. BE part is located on Server so if we work without IBM Designer we have to wait 1-2 mins till changes come to it and only then we can do our tests. That's sad.

Does it mean @formula, Lotus Script, SSJS are not required to know?

Those languages are still important part of our 'old applications' and it will take years to completely re-write them to web and there should be a sense to do that, as it is time/money, @formula language is still only 1 way to make selection in Notes Views.

Pros

• open source;
• problems resolving (forums, community);
• more abilities;
• in case of migration to java platform, easy migration;

Cons

• 2 Java Runtimes
• ...

Summary

We are happy with what we have so far. We still have problems in terms of how to setup our development process. We will continue to look for perfect solution for our problems.

Other articles in this series

1. How we build our web applications based on Domino
2. Split back-end and front-end areas, they should not block each other and be independent as much as it is possible.
3. Front-end guys should not have any knowledge about Domino, they don't need IBM Designer installed at all.
4. Back-end guys must have knowledge about Domino, however they don't need to use IBM Designer, only in very rare cases. Backend should be done using only Java (no LS/SSJS/@Formula etc)
5. Using Git+Jira is must and Jenkins server as builder server
6. Auto-tests.