NetWorker Java keytool importing CA certificate results in Unparseable AuthorityInfoAccess extension due to java.io.IOException: invalid URI name"

Resumen: When attempting to import a CA certificate using Java's keytool binary. The following error is produced. ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false Unparseable AuthorityInfoAccess extension due to java.io.IOException: invalid URI name:file:// \SAMPLE.string.comCertEnrollSAMPLE.string.com ...

Este artículo se aplica a: Este artículo no se aplica a: Este artículo no está vinculado a ningún producto específico. En este artículo no se identifican todas las versiones de los productos.
Consultar otros recursos

Síntomas

When attempting to import a CA certificate using Java's keytool binary. The following error is produced: 

ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false Unparseable AuthorityInfoAccess extension due to java.io.IOException:
Invalid URI name:file:// \\SAMPLE.string.com\CertEnroll\SAMPLE.string.com

Causa

The problem is with OID 1.3.6.1.5.5.7.1.1 which is the Authority Information Access Extension. The General Name encoding of the URI is incorrect. Oracle s JVM tries to parse the extension and encounters the problem.

Resolución

This is not a NetWorker issue.

See RFC 2459 This hyperlink is taking you to a website outside of Dell Technologies., for details on how the extension should be encoded. Also, see RFC 2459 This hyperlink is taking you to a website outside of Dell Technologies. page #32 for URI standards.

Generate the CA with the correct URI encoding or without URI. Steps for importing the CA certificate are outlined in the below "Notes" section and in the "NetWorker Security Configuration Guide." See the documentation for your NetWorker version. https://www.dell.com/support/product-details/en-us/product/networker/docs

Información adicional

Identify your Java install path:


Linux

If using NetWorker Runtime Environment (NRE): /opt/nre/java/latest
If using Oracle Java Runtime Environment (JRE): /usr/java/latest

Windows:

If using NetWorker Runtime Environment (NRE): C:\Program Files\NRE\java\jre#.#.#_### (Version folder varies depending on the NRE version installed).
If using Oracle Java Runtime Environment (JRE), the install path varies depending on the options selected during install.


How to correctly import a CA certificate:

 

Check to see if a certificate has been imported for your LDAPS server: 
java_path/bin/keytool -list -keystore java_path/lib/security/cacerts -storepass changeit
NOTE:JAVA's default keytool password is changeit 
Optionally, if the keystore contains expired trusted Java certificates for the LDAPS server, delete the certificates: 
java_path/bin/keytool -delete -alias ALIAS_NAME -keystore java_path/lib/security/cacerts -storepass changeit
It is recommended to use openssl to validate the certificate on the NetWorker server: 
openssl s_client -showcerts -connect LDAPS_server:636
NOTE: The output of this command lists the root Certificate Authority (CA) certificate, and any Intermediate certificate (if used). By default Windows does not include the openssl program. The OpenSSL website describes how to download and install the program. Optionally, the command can be run on a Linux host (if available in the environment). The output of the command can be copied to the NetWorker server. 
Certificate file example
Create a file for each certificate, for example:
  • Intermediate Certificate One: ICA1.crt
  • Intermediate Certificate Two: ICA2.crt
  • Root Certificate: RCA.crt
NOTE: If OpenSSL shows only one certificate, there are no intermediate certificates. The certificate configuration varies depending on the environment configuration. Import the certificate chain in the order shown in OpenSSL: the first certificate is the last intermediate certificate, and the last is the root CA.

 

The certificates can be imported by running the Java keytool program:
For any intermediate certificates in a certificate chain: 
java_path/bin/keytool -import -alias ICA1 -keystore java_path/lib/security/cacerts -storepass "password" -file ICA1_certificate_file
java_path/bin/keytool -import -alias ICA2 -keystore java_path/lib/security/cacerts -storepass "password" -file ICA2_certificate_file
...and so forth
For the root CA: 
java_path/bin/keytool -import -alias CA -keystore java_path/lib/security/cacerts -storepass "password" -file rootCA_certificate_file
If no errors are reported, Enter "yes" to trust the certificate.

Once the certificate files have been imported, restart the NetWorker server services. This is required in order for the authentication service (authc) to re-read the cacerts file and load the certificates.
Linux:  
systemctl restart networker
Windows: 
net stop nsrd
net start nsrd
 

Productos afectados

NetWorker

Productos

NetWorker, NetWorker Management Console
Propiedades del artículo
Número de artículo: 000032279
Tipo de artículo: Solution
Última modificación: 14 mar 2025
Versión:  5
Encuentra las respuestas que necesitas con la ayuda de otros usuarios de Dell
Servicios de asistencia
Comprueba si tu dispositivo está cubierto por los servicios de asistencia.