ca-certificates-java fails to install java cacerts

[Eric Jiang]

What I expected:
ca-certificates-java 20110912ubuntu3.2 should install /etc/ssl/certs/java/cacerts

What happened:
ca-certificates-java did not install /etc/ssl/certs/java/cacerts, leaving the JVM's symlink dangling.
/usr/lib/jvm/java-7-openjdk-i386/jre/lib/security/cacerts -> /etc/ssl/certs/java/cacerts

This leaves Java applications that depend on CA certs broken, usually with a "the trustAnchors parameter must be non-empty".

Apt-get install log:

root:~# apt-get --reinstall install ca-certificates-java
Reading package lists... Done
Building dependency tree
Reading state information... Done
0 upgraded, 0 newly installed, 1 reinstalled, 0 to remove and 0 not upgraded.
Need to get 0 B/8,434 B of archives.
After this operation, 0 B of additional disk space will be used.
(Reading database ... 171214 files and directories currently installed.)
Preparing to replace ca-certificates-java 20110912ubuntu3.2 (using .../ca-certificates-java_20110912ubuntu3.2_all.deb) ...
Unpacking replacement ca-certificates-java ...
Setting up ca-certificates-java (20110912ubuntu3.2) ...

[Jamie Strandboge (jdstrand)]

Thank you for using Ubuntu and reporting a bug.

I am unable to reproduce this. I tried various ways to reproduce this, all resulting in /etc/ssl/certs/java/cacerts in the end. Specifically:

* Install 20110912ubuntu3 - upgrade to 20110912ubuntu3.2: ok
* Install 20110912ubuntu3 - upgrade to 20110912ubuntu3.1 - upgrade to 20110912ubuntu3.2: ok
* Install 20100412 (what is in 11.04; failed on install, but cacerts still there) - upgrade to 20110912ubuntu3 - upgrade to 20110912ubuntu3.2: ok
* Install 20100412 (what is in 11.04; failed on install, but cacerts still there) - upgrade to 20100412ubuntu0.11.04.1 (failed on install, but cacerts still there) - upgrade to 20110912ubuntu3.2: ok
* Install 20110912ubuntu3 - perform 'rm /etc/ssl/certs/java/cacerts' - upgrade to 20110912ubuntu3.2: ok

Before installing an earlier release I would do 'sudo dpkg --purge --force-depends ca-certificates-java' and verify that /etc/ssl/certs/java/cacerts no longer exists.

Can you detail the exact steps to reproduce? Could your disk be full, have filesystem errors or somehow was remounted ro?

FYI, this should probably get your system back in working order:
$ sudo dpkg --purge --force-depends ca-certificates-java ; sudo apt-get install ca-certificates-java

[Jamie Strandboge (jdstrand)]

Also, what are the contents of the /etc/ssl/certs/java/ directory?

[Jamie Strandboge (jdstrand)]

I can say that if I do this:
$ rm /etc/ssl/certs/java/cacerts
$ sudo apt-get install --reinstall ca-certificates-java

That /etc/ssl/certs/java/cacerts is *not* regenerated, but that is intended behavior from the packaging. Is it possible you accidentally removed /etc/ssl/certs/java/cacerts when 20110912ubuntu3.2 was installed? If so, perform the last command I mentioned in comment #1 and it should be all fixed up.

[Eric Jiang (erjiang)]

Thanks for taking the time to look into this!

I am currently examining my apt log to see what happened. Apparently, ca-certificates-java failed to install with the following:

Setting up ca-certificates-java (20110912ubuntu3.2.) ...
/var/lib/dpkg/info/ca-certificates-java.postinst: line 51: java: command not found
done.

This makes sense to me, since I previously did not have java, and I installed openjdk-7-jre-headless with ca-certificates-java at the same time. I am currently installing Oneiric i386 Desktop into a VM to try to reproduce this.

[Eric Jiang (erjiang)]

I reproduced this bug by installing a fresh install from the Oneiric i386 desktop iso and updating all installed packages.

Using aptitude, I installed openjdk-7-jre-headless which depends on ca-certificates-java. Note that before the install, java is not available. The installation proceeded, except that java's cacerts failed to generate.

[Hans Joachim Desserud (hjd)]

I haven't been able to reproduce this issue, but just want to mention that similar ones have been reported where it can be triggered by installing openjdk-8-jre-headless 8 (bug 1396760), or maven toghether with openjdk-8-jdk (bug 1406483).

Looks like it is possible to end up in a situation where it attempts to run the ca-certificates-java postinstall before java has actually been installed.

[Launchpad Janitor (janitor)]

Status changed to 'Confirmed' because the bug affects multiple users.

[Michael Alexander (ftmichael)]

Thank you to Jamie Strandboge (jdstrand) in comment #1: http://bugs.launchpad.net/ubuntu/+source/ca-certificates-java/+bug/983302/comments/1 . This issue has been driving me nuts and nothing else I've tried has worked, but this fixed it instantly:

$ sudo dpkg --purge --force-depends ca-certificates-java

followed by

$ sudo apt-get install ca-certificates-java

[Brooks B (bmbeverst)]

Michael Alexander (ftmichael)'s fix worked for me!