Why this certificate error in Glassfish 4.1?

Question

In the below output I am being asked if I trust a certificate, which I was not asked about in Glassfish 4.0. If I answe yes, then it still fails which can be seen.

I am starting it with asadmin start-domain and then change the admin password to x in this test. I change the passowrd with asadmin --user admin change-admin-password and asadmin enable-secure-admin .

This is the error:

Do you trust the above certificate [y|N] -->y
Authentication failed for user: admin (Usually, this means invalid user name and/or password)
Command change-admin-password failed.

Question

Does anyone know why Glassfish 4.1 asks about this certificate and how I can make it work, as I can't login even though it ends with it was a success.

Waiting for domain1 to start .......
Successfully started the domain : domain1
domain  Location: /opt/glassfish4/glassfish/domains/domain1
Log File: /opt/glassfish4/glassfish/domains/domain1/logs/server.log
Admin Port: 4848
Command start-domain executed successfully.
=> Modifying password of admin to preset in Glassfish
spawn asadmin --user admin change-admin-password
Enter the admin password> 
Enter the new admin password> 
Enter the new admin password again> 
[
[
  Version: V3
  Subject: CN=localhost, OU=GlassFish, O=Oracle Corporation, L=Santa Clara, ST=California, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 19016962123073818913980587828837922486576420141613590721707437891327039833432551153803083906839156766507774007880420863368627703049499522525030078369904284618227297420407350669314980277911425446307700835083768858763078579295691981047129695516569551334653620772195238596206551972125661803284768176221481772121528672632308667324875827891801774801031021244005840124791813739105291627626830463412652100947239506418948577875286315103270404232934705194347849152036735770668664880970935638976368368387912487716546355239785885758256691359924727187516306879956018711242524702651771632411566014598382402754461656354400636380993
  public exponent: 65537
  Validity: [From: Thu Aug 21 13:30:10 UTC 2014,
               To: Sun Aug 18 13:30:10 UTC 2024]
  Issuer: CN=localhost, OU=GlassFish, O=Oracle Corporation, L=Santa Clara, ST=California, C=US
  SerialNumber: [    31eb8d9f]

Certificate Extensions: 1
[1]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 13 55 DB 7D A9 31 71 A3   33 40 56 D3 49 A9 77 42  .U...1q.3@V.I.wB
0010: 90 A3 59 39                                        ..Y9
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 07 E5 F1 96 38 CE 55 33   1C 65 A5 5A 38 90 EB 98  ....8.U3.e.Z8...
0010: 59 A1 AE 19 5F BF 5F 53   BE CF 36 54 2F 03 5D 5E  Y..._._S..6T/.]^
0020: 9D 21 3C DC CC C9 A1 5E   E0 0B 71 31 36 CE 3A DB  .!<....^..q16.:.
0030: BB 78 40 ED 5B FB 0A F0   E6 01 5A C3 29 CD 0B E1  .x@.[.....Z.)...
0040: A1 0D A9 99 ED D8 28 78   DA 1B 2F 15 25 46 85 D8  ......(x../.%F..
0050: B3 8F E7 79 0F EF 37 6A   55 06 E0 2D 0C 67 F3 60  ...y..7jU..-.g.`
0060: 46 AB C2 F5 AC 70 5E 9F   3C EF E3 33 61 34 C4 F9  F....p^.<..3a4..
0070: CB 5A 83 10 82 E5 DA F3   15 1D 28 B2 F9 DE 53 F0  .Z........(...S.
0080: 10 72 79 48 BA B4 AC EC   49 16 92 D8 A6 48 B5 A7  .ryH....I....H..
0090: 3A 6F 37 15 02 F4 66 66   94 8C 82 2C 57 7A 45 04  :o7...ff...,WzE.
00A0: 33 31 F6 9B 7C 6A 04 B0   0A 01 8E 8E B9 31 9E 9A  31...j.......1..
00B0: AC 53 F7 CB 38 F6 E5 DB   86 FF F2 D8 39 77 34 47  .S..8.......9w4G
00C0: 5F 7F EC F3 37 79 08 EB   59 B5 90 3F D9 7E E8 70  _...7y..Y..?...p
00D0: C3 F4 DD 17 EC B4 19 D0   08 26 7E CB 64 46 17 B8  .........&..dF..
00E0: 08 D8 A7 99 1E CF F1 2B   79 86 F1 22 6F C4 05 94  .......+y.."o...
00F0: E1 4F E1 64 E4 F0 47 8D   95 95 08 4F FE F9 60 E4  .O.d..G....O..`.

]
Do you trust the above certificate [y|N] -->y
Authentication failed for user: admin (Usually, this means invalid user name and/or password)
Command change-admin-password failed.
=> Enabling secure admin login
spawn asadmin enable-secure-admin
Enter admin user name>  admin
Enter admin password for user "admin"> 
Authentication failed for user: admin
(Usually, this means invalid user name and/or password)
Command enable-secure-admin failed.
=> Done!
========================================================================
You can now connect to this Glassfish server using:

     admin:x

Please remember to change the above password as soon as possible!
========================================================================
=> Restarting Glassfish server
Waiting for the domain to stop .
Command stop-domain executed successfully.
=> Starting and running Glassfish server

Answer 1

  Subject: CN=localhost, OU=GlassFish, O=Oracle Corporation, L=Santa Clara, ST=California, C=US
  ...
  Issuer: CN=localhost, OU=GlassFish, O=Oracle Corporation, L=Santa Clara, ST=California, C=US

Its a self signed certificate. You have to establish trust for it. Load it in a trust store.

When using Chrome, you can't just load it in a trust store. The certificate must be signed by a CA. Its OK to create your own CA to do it, but it must be signed by an authority.

  Version: V3
  Subject: CN=localhost, OU=GlassFish, O=Oracle Corporation, L=Santa Clara, ST=California, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
  ...

Don't put DNS names like localhost in the Common Name (CN). Its deprecated by both the IETF and CA/Browser Forums. Instead, put a friendly name like "Oracle Corporation" in the CN. You put a friendly name there because its displayed to the user.

Do put DNS names in the Subject Alternate Name (SAN). Both the IETF and CA/Browser Forums specify DNS names go in the SAN.

Chrome is the most strict when it comes to accepting certificates. I believe the latest Java is similar. If you are using Chrome and you put a DNS name in the CN, then you must put the same DNS name in the SAN. So there's no way to avoid putting a DNS name in the SAN.

Chrome does not allow self-signed certificates. It requires the server's certificate be signed by a CA (ie, it cannot be self signed). Its OK to sign with a private CA not preloaded in the public CA Zoo. Just add the CA to your browser. Or get the server certificate signed by a CA Cartel member ( Startcom offers free Class 1 certificates).

Answer 2

I know this post is quite old, but I also struggled with a similar problem while I was trying to create a Docker container which installs a Glassfish 4.1.1 server and deploy an application afterwards. The Dockerfile script stops every time when the "Do you trust the above certificate" dialog appears. Maybe I could help someone with my following instructions.

You have to establish trust for it. Load it in a trust store.

after jww wrote these sentences I started looking for a suitable trust store. I found out that the local user which is running the asadmin command has a dedicated trust store under ~/.gfclient/truststore

If you want to prevent displaying this dialog you have to add the glassfish certificates into your local glassfish trust store. I assume in the following instructions that you use domain1 and you are using the default certificate s1as :

1. keytool -export -alias s1as -file /tmp/s1as.cert -keystore /path/to/glassfish/domains/domain1/config/keystore.jks
2. keytool -import -alias s1as -file /tmp/s1as.cert -keystore ~/.gfclient/truststore

The default password for the local glassfish trust store is changeit . Afterwards you shouldn't been asked again if you trust this glassfish connection.

Answer 3

Best answer by Dennis' Tech Crib Sheets :

Just add the --interactive=false property to the asadmin command.