update-ca-certificates fails due to no /etc/ssl/certs/java directory existing

[Stephen Fletcher]

Issue:
/etc/ssl/certs/java/cacerts cannot update when running /usr/local/share/ca-certificates and attempting to update when ca-certificates-java package is installed

Issue Description:

When /etc/ssl/certs/java is not available the update-ca-certificates fails with the following taceback:

org.debian.security.UnableToSaveKeystoreException: There was a problem saving the new Java keystore.
        at org.debian.security.KeyStoreHandler.save(KeyStoreHandler.java:86)
        at org.debian.security.UpdateCertificates.finish(UpdateCertificates.java:108)
        at org.debian.security.UpdateCertificates.main(UpdateCertificates.java:54)
Caused by: java.io.FileNotFoundException: /etc/ssl/certs/java/cacerts (No such file or directory)
        at java.base/java.io.FileOutputStream.open0(Native Method)
        at java.base/java.io.FileOutputStream.open(FileOutputStream.java:298)
        at java.base/java.io.FileOutputStream.<init>(FileOutputStream.java:237)
        at java.base/java.io.FileOutputStream.<init>(FileOutputStream.java:126)
        at org.debian.security.KeyStoreHandler.save(KeyStoreHandler.java:82)
        ... 2 more
E: /etc/ca-certificates/update.d/jks-keystore exited with code 1.

No updated /etc/ssl/certs/java/cacerts is created.

Workaround:

        if [ ! -d "/etc/ssl/certs/java" ]; then
         mkdir -p /etc/ssl/certs/java
        fi

[Alex Murray (alexmurray)]

Thanks for reporting this issue, do you mind if I make the bug public so other developers can see it and have the opportunity to resolve it?

[Stephen Fletcher (mridion)]

Issue occurs in /etc/ca-certificates/update.d/jks-keystore

Attached is a patch to create the directory if missing and set correct permissions.

[Stephen Fletcher (mridion)]

sure no problem. I have added a fix for the issue. ca-certificates-java does appear to correctly create the directory on installation. It just fails to be recreated if deleted through the normal update script.
None of core ssl cert update component is affected. It would only potentially fail for any further custom hook scripts that are added by the end user if the included one is run first.

[Stephen Fletcher (mridion)]

I modified the patch to ensure the original directory permissions are recreated

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "Patch to recreate /etc/ssl/certs/java if missing with original permissions when jks-keystore hook run via update-ca-certificates" seems to be a patch. If it isn't, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are a member of the ~ubuntu-reviewers, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issues please contact him.]

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.