java.io.IOException: exception decrypting data - java.security.InvalidKeyException: Illegal key size (NiFi v1.5.0)

[#1]

Hi,

I am trying to upgrade NiFi to version 1.5.0 from 0.6.1.

I have downloaded HDF 3.1.1 and updated the Apache NiFi JARs to version 1.5.0 in my application.

When I try to start/load NiFi, I get below Java security exception:

2018-06-11 15:18:08,046 WARN [main] org.eclipse.jetty.webapp.WebAppContext Failed startup of context o.e.j.w.WebAppContext@1f628b31{/nifi-api,file:///*****/*****/NiFi/dev.2018-06-11-1515/nifi-1.5.0.3.1...}
org.apache.nifi.web.NiFiCoreException: Unable to start Flow Controller.
at org.apache.nifi.web.contextlistener.ApplicationStartupContextListener.contextInitialized(ApplicationStartupContextListener.java:88)
at org.eclipse.jetty.server.handler.ContextHandler.callContextInitialized(ContextHandler.java:876)
at org.eclipse.jetty.servlet.ServletContextHandler.callContextInitialized(ServletContextHandler.java:532)
at org.eclipse.jetty.server.handler.ContextHandler.startContext(ContextHandler.java:839)
at org.eclipse.jetty.servlet.ServletContextHandler.startContext(ServletContextHandler.java:344)
at org.eclipse.jetty.webapp.WebAppContext.startWebapp(WebAppContext.java:1480)
at org.eclipse.jetty.webapp.WebAppContext.startContext(WebAppContext.java:1442)
at org.eclipse.jetty.server.handler.ContextHandler.doStart(ContextHandler.java:799)
at org.eclipse.jetty.servlet.ServletContextHandler.doStart(ServletContextHandler.java:261)
at org.eclipse.jetty.webapp.WebAppContext.doStart(WebAppContext.java:540)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:113)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:105)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.server.handler.gzip.GzipHandler.doStart(GzipHandler.java:290)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:113)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)
at org.eclipse.jetty.server.Server.start(Server.java:452)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:105)
at org.eclipse.jetty.server.handler.AbstractHandler.doStart(AbstractHandler.java:113)
at org.eclipse.jetty.server.Server.doStart(Server.java:419)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.apache.nifi.web.server.JettyServer.start(JettyServer.java:777)
at org.apache.nifi.NiFi.<init>(NiFi.java:160)
at org.apache.nifi.NiFi.main(NiFi.java:268)
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'flowService': FactoryBean threw exception on object creation; nested exception is org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'flowController': FactoryBean threw exception on object creation; nested exception is org.apache.nifi.framework.security.util.SslContextCreationException: java.io.IOException: exception decrypting data - java.security.InvalidKeyException: Illegal key size
at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:175)
at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBeanRegistrySupport.java:103)
at org.springframework.beans.factory.support.AbstractBeanFactory.getObjectForBeanInstance(AbstractBeanFactory.java:1634)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:317)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1084)
at org.apache.nifi.web.contextlistener.ApplicationStartupContextListener.contextInitialized(ApplicationStartupContextListener.java:55)
... 32 common frames omitted
Caused by: org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'flowController': FactoryBean threw exception on object creation; nested exception is org.apache.nifi.framework.security.util.SslContextCreationException: java.io.IOException: exception decrypting data - java.security.InvalidKeyException: Illegal key size
at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:175)
at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.getObjectFromFactoryBean(FactoryBeanRegistrySupport.java:103)
at org.springframework.beans.factory.support.AbstractBeanFactory.getObjectForBeanInstance(AbstractBeanFactory.java:1634)
at org.springframework.beans.factory.support.AbstractBeanFactory.doGetBean(AbstractBeanFactory.java:317)
at org.springframework.beans.factory.support.AbstractBeanFactory.getBean(AbstractBeanFactory.java:202)
at org.springframework.context.support.AbstractApplicationContext.getBean(AbstractApplicationContext.java:1084)
at org.apache.nifi.spring.StandardFlowServiceFactoryBean.getObject(StandardFlowServiceFactoryBean.java:48)
at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:168)
... 38 common frames omitted
Caused by: org.apache.nifi.framework.security.util.SslContextCreationException: java.io.IOException: exception decrypting data - java.security.InvalidKeyException: Illegal key size
at org.apache.nifi.framework.security.util.SslContextFactory.createSslContext(SslContextFactory.java:106)
at org.apache.nifi.controller.FlowController.<init>(FlowController.java:478)
at org.apache.nifi.controller.FlowController.createStandaloneInstance(FlowController.java:409)
at org.apache.nifi.spring.FlowControllerFactoryBean.getObject(FlowControllerFactoryBean.java:77)
at org.springframework.beans.factory.support.FactoryBeanRegistrySupport.doGetObjectFromFactoryBean(FactoryBeanRegistrySupport.java:168)
... 45 common frames omitted
Caused by: java.io.IOException: exception decrypting data - java.security.InvalidKeyException: Illegal key size
at org.bouncycastle.jcajce.provider.keystore.pkcs12.PKCS12KeyStoreSpi.cryptData(Unknown Source)
at org.bouncycastle.jcajce.provider.keystore.pkcs12.PKCS12KeyStoreSpi.engineLoad(Unknown Source)
at java.security.KeyStore.load(KeyStore.java:1445)
at org.apache.nifi.framework.security.util.SslContextFactory.createSslContext(SslContextFactory.java:86)
... 49 common frames omitted
2018-06-11 15:18:08,861 INFO [main] o.e.j.a.AnnotationConfiguration Scanning elapsed time=546ms
2018-06-11 15:18:08,865 INFO [main] o.e.j.C./nifi-content-viewer No Spring WebApplicationInitializer types detected on classpath
2018-06-11 15:18:08,903 INFO [main] o.e.jetty.server.handler.ContextHandler Started o.e.j.w.WebAppContext@1a8b7423{/nifi-content-viewer,file:///*****/*****/NiFi/dev.2018-06-11-1515/nif...}
2018-06-11 15:18:08,905 INFO [main] o.e.jetty.server.handler.ContextHandler Started o.e.j.s.h.ContextHandler@283693af{/nifi-docs,null,AVAILABLE}
2018-06-11 15:18:08,953 INFO [main] o.e.j.a.AnnotationConfiguration Scanning elapsed time=26ms
2018-06-11 15:18:08,956 INFO [main] o.e.jetty.ContextHandler./nifi-docs No Spring WebApplicationInitializer types detected on classpath
2018-06-11 15:18:08,994 INFO [main] o.e.jetty.server.handler.ContextHandler Started o.e.j.w.WebAppContext@695dc0e6{/nifi-docs,file:///*****/*****/NiFi/dev.2018-06-11-1515/nifi-1.5.0.3....}
2018-06-11 15:18:09,044 INFO [main] o.e.j.a.AnnotationConfiguration Scanning elapsed time=25ms
2018-06-11 15:18:09,047 INFO [main] org.eclipse.jetty.ContextHandler./ No Spring WebApplicationInitializer types detected on classpath
2018-06-11 15:18:09,079 INFO [main] o.e.jetty.server.handler.ContextHandler Started o.e.j.w.WebAppContext@1f5359a8{/,file:///*****/*****/NiFi/dev.2018-06-11-1515/nifi-1.5.0.3.1.1.0-35/...}
2018-06-11 15:18:09,102 WARN [main] org.apache.nifi.web.server.JettyServer Failed to start web server... shutting down.
java.io.IOException: exception decrypting data - java.security.InvalidKeyException: Illegal key size
at org.bouncycastle.jcajce.provider.keystore.pkcs12.PKCS12KeyStoreSpi.cryptData(Unknown Source)
at org.bouncycastle.jcajce.provider.keystore.pkcs12.PKCS12KeyStoreSpi.engineLoad(Unknown Source)
at java.security.KeyStore.load(KeyStore.java:1445)
at org.eclipse.jetty.util.security.CertificateUtils.getKeyStore(CertificateUtils.java:52)
at org.eclipse.jetty.util.ssl.SslContextFactory.loadKeyStore(SslContextFactory.java:998)
at org.eclipse.jetty.util.ssl.SslContextFactory.load(SslContextFactory.java:252)
at org.eclipse.jetty.util.ssl.SslContextFactory.doStart(SslContextFactory.java:219)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:113)
at org.eclipse.jetty.server.SslConnectionFactory.doStart(SslConnectionFactory.java:72)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.util.component.ContainerLifeCycle.start(ContainerLifeCycle.java:131)
at org.eclipse.jetty.util.component.ContainerLifeCycle.doStart(ContainerLifeCycle.java:113)
at org.eclipse.jetty.server.AbstractConnector.doStart(AbstractConnector.java:270)
at org.eclipse.jetty.server.AbstractNetworkConnector.doStart(AbstractNetworkConnector.java:81)
at org.eclipse.jetty.server.ServerConnector.doStart(ServerConnector.java:236)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.eclipse.jetty.server.Server.doStart(Server.java:431)
at org.eclipse.jetty.util.component.AbstractLifeCycle.start(AbstractLifeCycle.java:68)
at org.apache.nifi.web.server.JettyServer.start(JettyServer.java:777)
at org.apache.nifi.NiFi.<init>(NiFi.java:160)
at org.apache.nifi.NiFi.main(NiFi.java:268)
2018-06-11 15:18:09,103 INFO [Thread-8] org.apache.nifi.NiFi Initiating shutdown of Jetty web server...
2018-06-11 15:18:09,111 INFO [Thread-8] o.eclipse.jetty.server.AbstractConnector Stopped ServerConnector@73b82df3{SSL,[ssl, http/1.1]}{0.0.0.0:9990}
2018-06-11 15:18:09,111 INFO [Thread-8] org.eclipse.jetty.server.session Stopped scavenging

NiFi starts fine when I start/load using 0.6.1 version but throws above exception when I start with version 1.5.0.

I have checked for JCE JARs in /jre/lib/security folder and they are present but were installed long time ago(~2years ago).

Can someone please help me on this?

Any help is appreciated.

Thanks

[#2]

you can't just drop some jars in a directory and have it work. there have been massive changes since 0.6.1. You need to install to a fresh directory. you can download nifi directly from nifi.apache.org and install 1.6 in a clean directory. Configuration files and other things have changed.

HDF 3.1 really should be installed via Ambari in a clean environment.

Nars have changed, security, repositories.

Export all your templates from NiFi 0.6.1.

Install NiFi 1.6.0 in a new directory (or new machine) and new port.

Import those templates. Setup connections. I would recommend downloading and install NiFi registry for flow versioning and backups.

[#3]

@Harish Vaibhav Kali It seems the problem could be related to sensitive properties. Perhaps exporting your flow as template and importing it could help on this case.

HTH

[#4]

@Felix Albani

I am not trying to configure any templates as of now. I am trying to load the NiFi Web UI first without any templates/flows but unfortunately I get this error every time I start NiFi.

Don't know how it works well in case of v0.6.1.

[#5]

@Timothy Spann

I have installed v0.6.1 and v1.5.0 in two separate folders. I am not trying to export any templates/flows from 0.6.1 to 1.5.0 but I am trying to bring up the NiFi Web UI with v1.5.0. Unfortunately I get this error when I start NiFi with v1.5.0. Is there anything I am missing? Do you think updating the JCE JARs helps?

[#6]

Does the user running nifi 1.5.0 have permissions to that directory?

Is that the directory of the Java instance used to run NiFi 1.5? You need JDK 1.8.

https://docs.hortonworks.com/HDPDocuments/HDF3/HDF-3.1.2/bk_installing-upgrading-nifi/content/instal...

https://docs.hortonworks.com/HDPDocuments/HDF3/HDF-3.1.2/bk_release-notes/content/ch_hdf_relnotes.ht...

Upgrade Guide

https://docs.hortonworks.com/HDPDocuments/HDF3/HDF-3.1.2/bk_installing-upgrading-nifi/content/ch_upg...

You may have to update that key:

https://stackoverflow.com/questions/24907530/java-security-invalidkeyexception-illegal-key-size-or-d...

https://community.hortonworks.com/questions/88190/not-able-to-start-nifi.html

You may need to install JCE

https://askubuntu.com/questions/780306/how-can-i-install-jce