Technical details: WebServiceException - javax.net.ssl.SSLException: Tag mismatch!

[AndersVilhelmsen]

I'm trying to set up a SMP-server for the first time, and now I ran into this problem. I've read the other thread about it (#221) but where the other thread was about the wrong certificate, I'm pretty sure this is something about the network configurations.

I'm using SMP 7.1.1, Tomcat 10.1.19, maven 3.6.3, java 11.0.22

The certificates seems to be alright:

The stack trace

[2024-04-23T06:47:40,869] [SMP-SERVER] [INFO ] [http-nio-80-exec-8] Trying to create new SMP 'SMP-PDK000636' with physical address '1.1.1.1' and logical address '***********' -- com.helger.peppol.smlclient.ManageServiceMetadataServiceCaller.create(ManageServiceMetadataServiceCaller.java:185) [2024-04-23T06:47:41,091] [SMP-SERVER] [WARN ] [http-nio-80-exec-8] Technical details -- com.helger.phoss.smp.ui.SMPCommonUI.getTechnicalDetailsUI(SMPCommonUI.java:380) jakarta.xml.ws.WebServiceException: javax.net.ssl.SSLException: Tag mismatch! at com.sun.xml.ws.transport.http.client.HttpClientTransport.readResponseCodeAndMessage(HttpClientTransport.java:181) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.transport.http.client.HttpTransportPipe.createResponsePacket(HttpTransportPipe.java:227) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.transport.http.client.HttpTransportPipe.process(HttpTransportPipe.java:218) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.transport.http.client.HttpTransportPipe.processRequest(HttpTransportPipe.java:131) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.transport.DeferredTransportPipe.processRequest(DeferredTransportPipe.java:111) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:1106) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:1020) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:989) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:847) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.client.Stub.process(Stub.java:431) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.client.sei.SEIStub.doProcess(SEIStub.java:160) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:78) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:62) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:132) ~[jaxws-rt-4.0.2.jar:4.0.2] at com.sun.proxy.$Proxy53.create(Unknown Source) ~[?:?] at com.helger.peppol.smlclient.ManageServiceMetadataServiceCaller.create(ManageServiceMetadataServiceCaller.java:193) ~[peppol-sml-client-9.3.0.jar:9.3.0] at com.helger.peppol.smlclient.ManageServiceMetadataServiceCaller.create(ManageServiceMetadataServiceCaller.java:157) ~[peppol-sml-client-9.3.0.jar:9.3.0] at com.helger.phoss.smp.ui.secure.PageSecureSMLRegCreate._registerSMPtoSML(PageSecureSMLRegCreate.java:134) ~[phoss-smp-webapp-7.1.1.jar:7.1.1] at com.helger.phoss.smp.ui.secure.PageSecureSMLRegCreate.fillContent(PageSecureSMLRegCreate.java:209) ~[phoss-smp-webapp-7.1.1.jar:7.1.1] at com.helger.phoss.smp.ui.secure.PageSecureSMLRegCreate.fillContent(PageSecureSMLRegCreate.java:55) ~[phoss-smp-webapp-7.1.1.jar:7.1.1] at com.helger.photon.uicore.page.AbstractWebPage.getContent(AbstractWebPage.java:162) ~[ph-oton-uicore-9.2.1.jar:9.2.1] at com.helger.photon.bootstrap4.uictrls.ext.BootstrapPageRenderer.getPageContent(BootstrapPageRenderer.java:133) ~[ph-oton-bootstrap4-uictrls-9.2.1.jar:9.2.1] at com.helger.photon.bootstrap4.uictrls.ext.BootstrapPageRenderer.getPageContent(BootstrapPageRenderer.java:160) ~[ph-oton-bootstrap4-uictrls-9.2.1.jar:9.2.1] at com.helger.phoss.smp.ui.secure.SMPRendererSecure.getContent(SMPRendererSecure.java:227) ~[phoss-smp-webapp-7.1.1.jar:7.1.1] at com.helger.phoss.smp.ui.SMPLayoutHTMLProvider.fillBody(SMPLayoutHTMLProvider.java:70) [phoss-smp-webapp-7.1.1.jar:7.1.1] at com.helger.photon.core.html.AbstractSWECHTMLProvider.fillHeadAndBody(AbstractSWECHTMLProvider.java:106) [ph-oton-core-9.2.1.jar:9.2.1] at com.helger.photon.core.html.AbstractHTMLProvider.createHTML(AbstractHTMLProvider.java:164) [ph-oton-core-9.2.1.jar:9.2.1] at com.helger.photon.app.html.PhotonHTMLHelper.createHTMLResponse(PhotonHTMLHelper.java:117) [ph-oton-app-9.2.1.jar:9.2.1] at com.helger.photon.core.servlet.AbstractApplicationXServletHandler.handleRequest(AbstractApplicationXServletHandler.java:102) [ph-oton-core-9.2.1.jar:9.2.1] at com.helger.phoss.smp.servlet.SMPApplicationXServletHandler.handleRequest(SMPApplicationXServletHandler.java:81) [phoss-smp-webapp-7.1.1.jar:7.1.1] at com.helger.xservlet.handler.simple.XServletHandlerToSimpleHandler.onRequest(XServletHandlerToSimpleHandler.java:241) [ph-xservlet-10.1.7.jar:10.1.7] at com.helger.xservlet.AbstractXServlet._invokeHandler(AbstractXServlet.java:355) [ph-xservlet-10.1.7.jar:10.1.7] at com.helger.xservlet.AbstractXServlet.service(AbstractXServlet.java:540) [ph-xservlet-10.1.7.jar:10.1.7] at jakarta.servlet.http.HttpServlet.service(HttpServlet.java:658) [servlet-api.jar:6.0] at com.helger.xservlet.AbstractXServlet.service(AbstractXServlet.java:596) [ph-xservlet-10.1.7.jar:10.1.7] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:205) [catalina.jar:10.1.19] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [catalina.jar:10.1.19] at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:51) [tomcat-websocket.jar:10.1.19] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [catalina.jar:10.1.19] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [catalina.jar:10.1.19] at com.helger.web.servlets.scope.AbstractScopeAwareFilter.doHttpFilter(AbstractScopeAwareFilter.java:82) [ph-web-10.1.7.jar:10.1.7] at com.helger.servlet.filter.AbstractHttpServletFilter.doFilter(AbstractHttpServletFilter.java:66) [ph-servlet-10.1.7.jar:10.1.7] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [catalina.jar:10.1.19] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [catalina.jar:10.1.19] at com.helger.xservlet.AbstractXFilter.doHttpFilter(AbstractXFilter.java:190) [ph-xservlet-10.1.7.jar:10.1.7] at com.helger.servlet.filter.AbstractHttpServletFilter.doFilter(AbstractHttpServletFilter.java:66) [ph-servlet-10.1.7.jar:10.1.7] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [catalina.jar:10.1.19] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [catalina.jar:10.1.19] at com.helger.servlet.filter.CharacterEncodingFilter.doHttpFilter(CharacterEncodingFilter.java:184) [ph-servlet-10.1.7.jar:10.1.7] at com.helger.servlet.filter.AbstractHttpServletFilter.doFilter(AbstractHttpServletFilter.java:66) [ph-servlet-10.1.7.jar:10.1.7] at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:174) [catalina.jar:10.1.19] at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:149) [catalina.jar:10.1.19] at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:167) [catalina.jar:10.1.19] at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:90) [catalina.jar:10.1.19] at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:482) [catalina.jar:10.1.19] at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:115) [catalina.jar:10.1.19] at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:93) [catalina.jar:10.1.19] at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:673) [catalina.jar:10.1.19] at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74) [catalina.jar:10.1.19] at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:344) [catalina.jar:10.1.19] at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:391) [tomcat-coyote.jar:10.1.19] at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:63) [tomcat-coyote.jar:10.1.19] at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:896) [tomcat-coyote.jar:10.1.19] at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1744) [tomcat-coyote.jar:10.1.19] at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:52) [tomcat-coyote.jar:10.1.19] at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191) [tomcat-util.jar:10.1.19] at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659) [tomcat-util.jar:10.1.19] at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:63) [tomcat-util.jar:10.1.19] at java.base/java.lang.Thread.run(Thread.java:829) [?:?] Caused by: javax.net.ssl.SSLException: Tag mismatch! at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:133) ~[?:?] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:360) ~[?:?] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:303) ~[?:?] at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:298) ~[?:?] at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:123) ~[?:?] at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1514) ~[?:?] at java.base/sun.security.ssl.SSLSocketImpl.readApplicationRecord(SSLSocketImpl.java:1481) ~[?:?] at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1070) ~[?:?] at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252) ~[?:?] at java.base/java.io.BufferedInputStream.read1(BufferedInputStream.java:292) ~[?:?] at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:351) ~[?:?] at java.base/sun.net.www.http.HttpClient.parseHTTPHeader(HttpClient.java:789) ~[?:?] at java.base/sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:724) ~[?:?] at java.base/sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:748) ~[?:?] at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1615) ~[?:?] at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1520) ~[?:?] at java.base/java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:527) ~[?:?] at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:334) ~[?:?] at com.sun.xml.ws.transport.http.client.HttpClientTransport.readResponseCodeAndMessage(HttpClientTransport.java:177) ~[jaxws-rt-4.0.2.jar:4.0.2] ... 68 more Caused by: javax.crypto.AEADBadTagException: Tag mismatch! at java.base/com.sun.crypto.provider.GaloisCounterMode.decryptFinal(GaloisCounterMode.java:623) ~[?:?] at java.base/com.sun.crypto.provider.CipherCore.finalNoPadding(CipherCore.java:1122) ~[?:?] at java.base/com.sun.crypto.provider.CipherCore.fillOutputBuffer(CipherCore.java:1059) ~[?:?] at java.base/com.sun.crypto.provider.CipherCore.doFinal(CipherCore.java:945) ~[?:?] at java.base/com.sun.crypto.provider.AESCipher.engineDoFinal(AESCipher.java:491) ~[?:?] at java.base/javax.crypto.CipherSpi.bufferCrypt(CipherSpi.java:779) ~[?:?] at java.base/javax.crypto.CipherSpi.engineDoFinal(CipherSpi.java:730) ~[?:?] at java.base/javax.crypto.Cipher.doFinal(Cipher.java:2497) ~[?:?] at java.base/sun.security.ssl.SSLCipher$T13GcmReadCipherGenerator$GcmReadCipher.decrypt(SSLCipher.java:1929) ~[?:?] at java.base/sun.security.ssl.SSLSocketInputRecord.decodeInputRecord(SSLSocketInputRecord.java:264) ~[?:?] at java.base/sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:181) ~[?:?] at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:111) ~[?:?] at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1514) ~[?:?] at java.base/sun.security.ssl.SSLSocketImpl.readApplicationRecord(SSLSocketImpl.java:1481) ~[?:?] at java.base/sun.security.ssl.SSLSocketImpl$AppInputStream.read(SSLSocketImpl.java:1070) ~[?:?] at java.base/java.io.BufferedInputStream.fill(BufferedInputStream.java:252) ~[?:?] at java.base/java.io.BufferedInputStream.read1(BufferedInputStream.java:292) ~[?:?] at java.base/java.io.BufferedInputStream.read(BufferedInputStream.java:351) ~[?:?] at java.base/sun.net.www.http.HttpClient.parseHTTPHeader(HttpClient.java:789) ~[?:?] at java.base/sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:724) ~[?:?] at java.base/sun.net.www.http.HttpClient.parseHTTP(HttpClient.java:748) ~[?:?] at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1615) ~[?:?] at java.base/sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1520) ~[?:?] at java.base/java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:527) ~[?:?] at java.base/sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:334) ~[?:?] at com.sun.xml.ws.transport.http.client.HttpClientTransport.readResponseCodeAndMessage(HttpClientTransport.java:177) ~[jaxws-rt-4.0.2.jar:4.0.2] ... 68 more

The application.properties

global.debug = false global.production = true global.debugjaxws = false

/## Directory client

pdclient.keystore.type = ${smp.keystore.type}
pdclient.keystore.path = ${smp.keystore.path}
pdclient.keystore.password = ${smp.keystore.password}
pdclient.keystore.key.alias = ${smp.keystore.key.alias}
pdclient.keystore.key.password = ${smp.keystore.key.password}

pdclient.truststore.type = ${smp.truststore.type}
pdclient.truststore.path = ${smp.truststore.path}
pdclient.truststore.password = ${smp.truststore.password}

/# SMP client

smpclient.truststore.type = ${smp.truststore.type}
smpclient.truststore.path = ${smp.truststore.path}
smpclient.truststore.password = ${smp.truststore.password}

/# Central directory where the data should be stored.
/# This should be an absolute path in production
/# Make sure write access is granted to this directory
webapp.datapath = /home/ec2-user/smp/home/data
/#webapp.datapath = /var/smp

/# Should all files of the application checked for readability?
/# This should only be set to true when datapath is a relative directory inside a production version
webapp.checkfileaccess = false

/# Is it a test version? E.g. a separate header is shown
webapp.testversion = false

/# Use slow, but fancy dynamic table on the start page?
webapp.startpage.dynamictable = false

/# Participant list is enabled by default
webapp.startpage.participants.none = false

/# Don't show content of extensions by default on start page
webapp.startpage.extensions.show = false

/# The name of the Directory implementation
webapp.directory.name = Peppol Directory

/# Don't show content of extensions by default in service groups
webapp.servicegroups.extensions.show = false

/# Should the error details of failed logins be shown?
webapp.security.login.errordetails = true

/# Should the /public part show a login
webapp.public.login.enabled = true

/# Should the application name and version be shown on the /public part?
webapp.public.showappname = true

/# Should the link to the source be shown on the /public part?
webapp.public.showsource = true

/# Should the author be shown on the /public part?
webapp.public.showauthor = true

/# Configure an imprint on the UI
webapp.imprint.enabled = false
webapp.imprint.text = Responsible person
webapp.imprint.href = https://www.google.com
webapp.imprint.target = _blank
webapp.imprint.cssclasses = mx-3 badge badge-primary

/# Content Security Policy
csp.enabled = true
csp.reporting.only = false
csp.reporting.enabled = true

/# The backend to be used. Can either be "sql" or "xml" or "mongodb". Any other value will result in a startup error
smp.backend = sql

/## Keystore data
/# The path maybe within the classpath or an absolute file path
smp.keystore.type = PKCS12
smp.keystore.path = /home/ec2-user/smp/home/data/keystore/keystore.p12
smp.keystore.password = ********
smp.keystore.key.alias = cert
smp.keystore.key.password = *********

/# This default truststore handles the Peppol PKIs (packed into the application via peppol-commons.jar)
smp.truststore.type = jks
/# For Pilot:
smp.truststore.path = truststore/2018/smp-pilot-truststore.jks
/# For Production:
#smp.truststore.path = truststore/2018/smp-prod-truststore.jks
smp.truststore.password = peppol

/# Force all paths (links) to be "/" instead of the context path
/# This is helpful if the web application runs in a context like "/smp" but is proxied to a root path
smp.forceroot = true

/# If this property is specified, it will overwrite the automatically generated URL
/# for all cases where absolute URLs are necessary
/# This might be helpful when running on a proxied Tomcat behind a web server
smp.publicurl = *************

/# Is an SML needed in the current scenario - show warnings if true
sml.required=true

/## Write to SML? true or false
sml.enabled=false

/# The SMP ID also used in the SML!
sml.smpid=SMP-PDK000636

/# SML connection timeout milliseconds
#sml.connection.timeout.ms = 5000

/# SML request timeout milliseconds
#sml.request.timeout.ms = 20000

/# Enable Directory integration?
smp.directory.integration.enabled=true

/# Use PEPPOL identifiers (with all constraints) or simple, unchecked identifiers?
/# Possible values are "peppol", "simple" and "bdxr"
smp.identifiertype=peppol

/# Define the type of the REST interface. Use this to switch between PEPPOL and BDXR
/# return XMLs. Possible values are "peppol" and "bdxr"
smp.rest.type=peppol

/# Log exceptions occurring in the REST API that are returned as HTTP errors?
smp.rest.log.exceptions=false

/# Add payload to HTTP responses in case of REST API errors?
smp.rest.payload.on.error=true

/# The time zone to be used
#smp.timezone = Europe/Vienna

/# http/https Proxy settings
#http.proxyHost = 10.0.0.10
#http.proxyPort = 8080
#https.proxyHost = 10.0.0.10
#https.proxyPort = 8080
/# Credentials for the proxy server (if needed)
#proxy.username =
#proxy.password =

/## Required when using the SQL backend

/# MySQL example
jdbc.driver = com.mysql.cj.jdbc.Driver

jdbc.url = jdbc:mysql://localhost:3306/smp?useUnicode=true&useJDBCCompliantTimezoneShift=true&useLegacyDatetimeCode=false&serverTimezone=UTC&autoReconnect=true
jdbc.user = ******
jdbc.password = *****

jdbc.schema = smp
target-database = MySQL

/# PostgreSQL example
#jdbc.driver = org.postgresql.Driver
#jdbc.url = jdbc:postgresql://localhost:5432/smp
#jdbc.user = smp
#jdbc.password = smp
#jdbc.schema = smp
#target-database = PostgreSQL

/## Warn if JDBC execution time is exceeded? (since 5.0.6)
jdbc.execution-time-warning.enabled = true
jdbc.execution-time-warning.ms = 5000

#jdbc.debug.connections = false
#jdbc.debug.transactions = false
#jdbc.debug.sql = false

[phax]

Hi Anders,
Thanks for providing the data in such a structured format.
Your screenshot shows an image with the "Peppol Production Certificate" whereas your configuration file shows you are using the "Pilot trust store" (truststore/2018/smp-pilot-truststore.jks).

Please make sure, the following items are aligned:

• Your keystore must be production or test/pilot
• The chosen truststore must be production or test/pilot
• Inside the GUI page "Administration | SMP Settings" you need to choose SML for production or SMK for pilot/test:
  

In case you don't know, https://github.com/phax/phoss-smp/blob/master/docs/Setting%20up%20an%20SMP%20for%20Peppol.pdf contains a step-by-step guideline to setup an SMP.

hth, Philip

[AndersVilhelmsen]

Hi Philip,

Thank you very much. It works now.

Somehow I totally missed out the lines:
/# For Pilot:
#smp.truststore.path = truststore/2018/smp-pilot-truststore.jks
/# For Production:
smp.truststore.path = truststore/2018/smp-prod-truststore.jks

I have used the guide, and I think it's a very well written :-)

/Anders