Solution to "OpenSSL::X509::StoreError: setting default path failed: Invalid keystore format" for JRuby

solution.md

Solution to StoreError: invalid keystore format (OS X)

The following error appeared upon upgrading JRuby:

OpenSSL::X509::StoreError: setting default path failed: Invalid keystore format

Download cacert.pem

wget http://curl.haxx.se/ca/cacert.pem

Create a keystore from the file

sudo keytool -importcert -file cacert.pem -keystore /Users/youruser/.keystore

Set SSL_CERT_FILE

export SSL_CERT_FILE=/Users/youruser/.keystore

Install gems

jruby -S gem install whatever

So, I tried all that... nuked rvm and homebrew... clean reinstall. Same problem.

What DID work for me was everything above, but with the addition of adding in the login and root certificates from the macOS Keychain.app and also adding an alias to each of the keystore imports:

wget http://curl.haxx.se/ca/cacert.pem
sudo keytool -importcert -file cacert.pem -alias mozilla-certs -keystore ~/.keystore

security find-certificate -a -p /Library/Keychains/System.keychain > LoginCerts.cer
sudo keytool -importcert -file LoginCerts.cer -alias login-certs -keystore ~/.keystore

security find-certificate -a -p /System/Library/Keychains/SystemRootCertificates.keychain >> RootCertificates.cer
sudo keytool -importcert -file RootCertificates.cer -alias root-certs -keystore ~/.keystore

Then adding this to ~/.zshrc (or ~/.bash_profile):

export SSL_CERT_FILE=~/.keystore

Thanks all for your help on this. Troubleshooting this killed a lot of my time but being a front-end dev I had no idea WTF I was doing and all your comments gave me some direction.

I came across the same errors as @suranyami did but to get this working with jRuby I reinstalled RVM, Homebrew, and updated my JDK.

$ ruby -ropenssl -e 'puts OpenSSL::X509::DEFAULT_CERT_FILE'
/Library/Java/JavaVirtualMachines/jdk1.8.0_112.jdk/Contents/Home/jre/lib/security/cacerts

Thank you for this! I spent a fair amount of time on this problem, and this page was the most helpful. Want to make two additions:

1. Information about http://curl.haxx.se/ca/cacert.pem is at https://curl.haxx.se/docs/caextract.html

2. I found my problem to be only that my $JAVA_HOME/lib/security/cacerts file was corrupt in some way. I verified it by running this
   command:

$ keytool -list -storepass changeit \
    -keystore $(/usr/libexec/java_home -v 1.8)/jre/lib/security/cacerts
keytool error: java.io.IOException: Invalid keystore format

Taking the error message at its word, I simply removed and reinstalled the JDK. When the above command listed the keys in the cacerts file, then jruby installed fine without errors. I then was able to remove the ~/.keystore file and SSL_CERT_FILE setting.

+1 to everyone who posted all your helpful comments.

I've been dealing with this for months, commenting and uncommenting export SSL_CERT_FILE=... until I finally got fed up.

I tried pretty much everything listed here.

The steps that finally resolved everything for me.

• Installed the latest version of openssl via homebrew: brew install openssl
• Ensured that it had up to date certs in the right localtions
• Manually added a symlink in /usr/local/bin/ -> {the location of the latest homebrew version}
• Uninstalled all the previous versions of the java jdk

cd /Library/Java/JavaVirtualMachines/
sudo rm -rf jdk1.*

• Uninstalled rvm: rvm implode
• Restarted my machine
• Finally installed a new jdk , re-installed rvm, jruby, bundler, etc

Finally everything is working, no SSL_CERT_FILE, no random keystore files, no failures

ALSO: I would avoid rvm osx-ssl-certs update all this breaks my jdk cert everytime.

I'd like to add a few of points to make the procedure 100% clear:

• when prompted for keystore password I used "changeit" which is similar to the default Java one
  -- Enter keystore password: then type "changeit"
  -- Re-enter new password: and retype "changeit"
• when prompted to "Trust this certificate? [no]" enter "yes"
• for Bash users to make this persist add to your .bash_profile
  -- export SSL_CERT_FILE=/Users/youruser/.keystore

And to add to @madebysquares comment - I broke my install by running 'rvm osx-ssl-certs update all' too. RVM should not allow this to run on jruby until it does not break all jrubies.

how to solve invalid keystore format????????

how to solve invalid keystore error??????

how to solve invalid keystore error??????

nuking jdk seems to help

❤️ https://gist.github.com/kendagriff/adec3713b4dfe6a1abdf#gistcomment-1933072 this is EXACTLY how to fix. I have been dealing with this issue for months and setting that cert file every time.

• In finder go to /Library/Java/JavaVirtualMachines
• Delete your JDK(s) in that directory
• DL the JDK version you'd like: http://www.oracle.com/technetwork/java/javase/downloads/index.html (I used JDK 8 http://www.oracle.com/technetwork/java/javase/downloads/jdk8-downloads-2133151.html)
• Install and no more will you have to type export SSL_CERT_FILE=/Users/youruser/.keystore