JDK-8173460 : Error with Keytool - Invalid RSA Private key
  • Type: Bug
  • Component: security-libs
  • Sub-Component: java.security
  • Affected Version: 8u121
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: generic
  • CPU: generic
  • Submitted: 2017-01-24
  • Updated: 2017-03-14
  • Resolved: 2017-02-20
Related Reports
Duplicate :  
JDK-8175251 - Failed to load RSA private key from pkcs12
Description
FULL PRODUCT VERSION :
java version "1.8.0_121"
Java(TM) SE Runtime Environment (build 1.8.0_121-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.121-b13, mixed mode)

ADDITIONAL OS VERSION INFORMATION :
Windows 8.1 professionnel

A DESCRIPTION OF THE PROBLEM :
When I try to generate a JKS certificate store, I get a "java.security.InvalidKeyException" exception: Invalid RSA private key.
The command line works correctly with versions 8u111 and 8u112.

The command line :

"C:\Program Files (x86)\Java\jdk1.8.0_121\bin\keytool.exe" -importkeystore -srckeystore "C:\Users\AGENCE33\Desktop\gestion certificat\certificate.pfx" -srcstoretype pkcs12 -srcalias "1" -destkeystore "C:\Users\AGENCE33\Desktop\gestion certificat\keystore.jks" -deststoretype jks -deststorepass "password" -destalias "NameAlias"

Result :
erreur keytool : java.security.UnrecoverableKeyException: Get Key failed: java.s
ecurity.InvalidKeyException: Invalid RSA private key
java.security.UnrecoverableKeyException: Get Key failed: java.security.InvalidKe
yException: Invalid RSA private key
        at sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:4
10)
        at sun.security.pkcs12.PKCS12KeyStore.engineGetEntry(PKCS12KeyStore.java
:1282)
        at java.security.KeyStore.getEntry(KeyStore.java:1521)
        at sun.security.tools.keytool.Main.recoverEntry(Main.java:3200)
        at sun.security.tools.keytool.Main.doImportKeyStoreSingle(Main.java:1978
)
        at sun.security.tools.keytool.Main.doImportKeyStore(Main.java:1929)
        at sun.security.tools.keytool.Main.doCommands(Main.java:1024)
        at sun.security.tools.keytool.Main.run(Main.java:343)
        at sun.security.tools.keytool.Main.main(Main.java:336)
Caused by: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyE
xception: Invalid RSA private key
        at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.ja
va:217)
        at java.security.KeyFactory.generatePrivate(KeyFactory.java:372)
        at sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:3
76)
        ... 8 more
Caused by: java.security.InvalidKeyException: Invalid RSA private key
        at sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyIm
pl.java:206)
        at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:342)
        at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:356)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.<init>(RSAPrivateCrtKeyImpl.jav
a:91)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(RSAPrivateCrtKeyImpl.jav
a:75)
        at sun.security.rsa.RSAKeyFactory.generatePrivate(RSAKeyFactory.java:316
)
        at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.ja
va:213)
        ... 10 more
Caused by: java.io.IOException: DerInputStream.getLength(): Redundant length byt
es found
        at sun.security.util.DerInputStream.getLength(DerInputStream.java:606)
        at sun.security.util.DerInputStream.getLength(DerInputStream.java:569)
        at sun.security.util.DerInputStream.getBigInteger(DerInputStream.java:20
7)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.getBigInteger(RSAPrivateCrtKeyI
mpl.java:214)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyIm
pl.java:197)
        ... 16 more

REGRESSION.  Last worked in version 8u112

ADDITIONAL REGRESSION INFORMATION: 
With the version 8u112, certificate store JKS is create

STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
Execute the command line :
"C:\Program Files (x86)\Java\jdk1.8.0_121\bin\keytool.exe" -importkeystore -srckeystore "C:\Users\AGENCE33\Desktop\gestion certificat\certificate.pfx" -srcstoretype pkcs12 -srcalias "1" -destkeystore "C:\Users\AGENCE33\Desktop\gestion certificat\keystore.jks" -deststoretype jks -deststorepass "password" -destalias "NameAlias"

EXPECTED VERSUS ACTUAL BEHAVIOR :
EXPECTED -
The generation of certificate store JKS with no error.
ACTUAL -
Error Exception :

erreur keytool : java.security.UnrecoverableKeyException: Get Key failed: java.s
ecurity.InvalidKeyException: Invalid RSA private key
java.security.UnrecoverableKeyException: Get Key failed: java.security.InvalidKe
yException: Invalid RSA private key
        at sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:4
10)
        at sun.security.pkcs12.PKCS12KeyStore.engineGetEntry(PKCS12KeyStore.java
:1282)
        at java.security.KeyStore.getEntry(KeyStore.java:1521)
        at sun.security.tools.keytool.Main.recoverEntry(Main.java:3200)
        at sun.security.tools.keytool.Main.doImportKeyStoreSingle(Main.java:1978
)
        at sun.security.tools.keytool.Main.doImportKeyStore(Main.java:1929)
        at sun.security.tools.keytool.Main.doCommands(Main.java:1024)
        at sun.security.tools.keytool.Main.run(Main.java:343)
        at sun.security.tools.keytool.Main.main(Main.java:336)
Caused by: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyE
xception: Invalid RSA private key
        at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.ja
va:217)
        at java.security.KeyFactory.generatePrivate(KeyFactory.java:372)
        at sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:3
76)
        ... 8 more
Caused by: java.security.InvalidKeyException: Invalid RSA private key
        at sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyIm
pl.java:206)
        at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:342)
        at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:356)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.<init>(RSAPrivateCrtKeyImpl.jav
a:91)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(RSAPrivateCrtKeyImpl.jav
a:75)
        at sun.security.rsa.RSAKeyFactory.generatePrivate(RSAKeyFactory.java:316
)
        at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.ja
va:213)
        ... 10 more
Caused by: java.io.IOException: DerInputStream.getLength(): Redundant length byt
es found
        at sun.security.util.DerInputStream.getLength(DerInputStream.java:606)
        at sun.security.util.DerInputStream.getLength(DerInputStream.java:569)
        at sun.security.util.DerInputStream.getBigInteger(DerInputStream.java:20
7)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.getBigInteger(RSAPrivateCrtKeyI
mpl.java:214)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyIm
pl.java:197)
        ... 16 more

ERROR MESSAGES/STACK TRACES THAT OCCUR :
erreur keytool : java.security.UnrecoverableKeyException: Get Key failed: java.s
ecurity.InvalidKeyException: Invalid RSA private key
java.security.UnrecoverableKeyException: Get Key failed: java.security.InvalidKe
yException: Invalid RSA private key
        at sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:4
10)
        at sun.security.pkcs12.PKCS12KeyStore.engineGetEntry(PKCS12KeyStore.java
:1282)
        at java.security.KeyStore.getEntry(KeyStore.java:1521)
        at sun.security.tools.keytool.Main.recoverEntry(Main.java:3200)
        at sun.security.tools.keytool.Main.doImportKeyStoreSingle(Main.java:1978
)
        at sun.security.tools.keytool.Main.doImportKeyStore(Main.java:1929)
        at sun.security.tools.keytool.Main.doCommands(Main.java:1024)
        at sun.security.tools.keytool.Main.run(Main.java:343)
        at sun.security.tools.keytool.Main.main(Main.java:336)
Caused by: java.security.spec.InvalidKeySpecException: java.security.InvalidKeyE
xception: Invalid RSA private key
        at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.ja
va:217)
        at java.security.KeyFactory.generatePrivate(KeyFactory.java:372)
        at sun.security.pkcs12.PKCS12KeyStore.engineGetKey(PKCS12KeyStore.java:3
76)
        ... 8 more
Caused by: java.security.InvalidKeyException: Invalid RSA private key
        at sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyIm
pl.java:206)
        at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:342)
        at sun.security.pkcs.PKCS8Key.decode(PKCS8Key.java:356)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.<init>(RSAPrivateCrtKeyImpl.jav
a:91)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.newKey(RSAPrivateCrtKeyImpl.jav
a:75)
        at sun.security.rsa.RSAKeyFactory.generatePrivate(RSAKeyFactory.java:316
)
        at sun.security.rsa.RSAKeyFactory.engineGeneratePrivate(RSAKeyFactory.ja
va:213)
        ... 10 more
Caused by: java.io.IOException: DerInputStream.getLength(): Redundant length byt
es found
        at sun.security.util.DerInputStream.getLength(DerInputStream.java:606)
        at sun.security.util.DerInputStream.getLength(DerInputStream.java:569)
        at sun.security.util.DerInputStream.getBigInteger(DerInputStream.java:20
7)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.getBigInteger(RSAPrivateCrtKeyI
mpl.java:214)
        at sun.security.rsa.RSAPrivateCrtKeyImpl.parseKeyBits(RSAPrivateCrtKeyIm
pl.java:197)
        ... 16 more

REPRODUCIBILITY :
This bug can be reproduced always.
Comments
Additional information provided by the submitter through the JDK-8175251 . Closing this as duplicate.
20-02-2017
To submitter: ----------------- I could not reproduce the issue described in the bug report with JDK 8u121. I tried with two different PKCS12 Keystores and each time the export to JKS was successful. Can you please provide a test certificate with which to reproduce the issue.
27-01-2017