Does configuration file allow for javax.net.ssl.trustStoreType?

[zymbuzz]

Hello,

Thanks again for this package. I have a question that may need only a short answer:)

Does the configuration file allow the determination of the truststoretype with the argument "javax.net.ssl.trustStoreType"?

I need to specify the truststore:
javax.net.ssl.trustStore=""
javax.net.ssl.trustStoreType=Windows-ROOT

I tried to see if it works when using STATA 18, but it does not. Did you have experience with this?
Could it be that just like MATLAB, STATA overrides these settings?

Note that STATA comes with zulu-jdk17.0.14. Could the issue be related to #271 ?

Regards

[amattioc]

Hi @zymbuzz, the "javax.net.ssl.trustStoreType" parameter is not in the list that we manage using the configuration file. Anyway I just tested stata 18 on windows and it seems to work fine.

What provider are you trying to query?

[zymbuzz]

Hi @amattioc

Thanks a lot for looking into this.

I can access all databases if I work from home, but I can only access some at work (ECB or NBB, for example). My IT specialist suggested that Windows-Root should solve an issue, but I still cannot connect to BIS_public, for instance.

For Matlab, I passed java configuration using java.opts, but I am not aware of a procedure for STATA.

Does the plugin use Java as supplied by STATA or the one available in the system (JAVA_HOME)? It may be related to the fact that some JAVA version may not support javax.net.ssl.trustStoreType = "Windows-ROOT"

⏰ INFO [i.b.o.s.util.QueryRunner:runQuery] Contacting web service with query: https://stats.bis.org/api/v1/dataflow/all/all/latest
⏰ SEVERE [i.b.o.s.util.QueryRunner:runQuery] Exception. Class: javax.net.ssl.SSLHandshakeException - Message: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
⏰ SEVERE [i.b.o.s.helper.SDMXHelper:lambda$updateSource$42] Exception. Class: it.bancaditalia.oss.sdmx.exceptions.SdmxIOException .Message: Connection problems while talking to endpoint: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

[amattioc]

Hi @zymbuzz as you correctly noticed the problem is probably related to the different JVMs and the certificates they recognize as valid. We have the same problem here for some providers and that's the reason why we give the possibility to use a custom trust store setting the specific property.

This is the method we use for STATA and all other tools and it works for us. STATA, unless configured differently, uses its internal JVM and in our environment correctly points to the trust store we specify in the configuration.properties file (i.e. javax.net.ssl.trustStore property) where we load the missing certificates.

In MATLAB this does not work because the trust store is already loaded when the property is read, but you already discovered it and you found the same workaround that we use :-)

[zymbuzz]

Thanks again for looking into this.

I guess creating a copy of the trust store may not be attractive to the user when setting up the package. I am worried that it may discourage some of my colleagues from adopting this tool. Do you have an easy way to create a copy?

Instead, allowing for the option "javax.net.ssl.trustStoreType" would solve all issues. I was wondering if it is possible to allow for this option in future updates to the package?

Actually, we tried this on R and it worked.

options(java.parameters = "-Djavax.net.ssl.trustStoreType=Windows-ROOT") #w/o this line PKI errors appear
library(rJava)
library(RJSDMX)

sdmxHelp()

[vpinna80]

EDIT: sorry, I answered for MATLAB though you were interested in Stata.
For Stata, as a temporary workaround, you can execute this at Stata prompt as the first session, or in your profile.do/sysprofile.do:

java, shared(BItools): java.lang.System.setProperty("javax.net.ssl.trustStoreType", "Windows-ROOT")

---

MATLAB accepts Java startup options by means of a java.opts file.
in particular you can add a single line in that file with your option:

-Djavax.net.ssl.trustStoreType=Windows-ROOT

[zymbuzz]

Yes, that works perfectly for Matlab. We have a similar workaround for R as well. But I struggle with STATA

[zymbuzz]

@vpinna80 Thanks a lot for this. It works super well.

If I can be somewhat hopeful, it would be truly convenient to allow for this Java parameter in the configuration file in the future version of the connector.